{ "openapi": "3.0.3", "info": { "title": "Firewall Policy API", "version": "1.0.0", "description": "Firewall policy \u2014 rules, objects, change management, audits, NAT, automation, and WAF exceptions." }, "servers": [ { "url": "https://versus-demo.com" } ], "paths": { "/api/firewall-audits/": { "get": { "operationId": "firewall_audits_list", "parameters": [ { "in": "query", "name": "audit_type", "schema": { "type": "string", "enum": [ "pci_dss_v4" ] }, "description": "* `pci_dss_v4` - PCI DSS v4.0" }, { "in": "query", "name": "device", "schema": { "type": "integer" } }, { "name": "ordering", "required": false, "in": "query", "description": "Which field to use when ordering the results.", "schema": { "type": "string" } }, { "name": "page", "required": false, "in": "query", "description": "A page number within the paginated result set.", "schema": { "type": "integer" } }, { "name": "page_size", "required": false, "in": "query", "description": "Number of results to return per page.", "schema": { "type": "integer" } }, { "name": "search", "required": false, "in": "query", "description": "A search term.", "schema": { "type": "string" } }, { "in": "query", "name": "status", "schema": { "type": "string", "enum": [ "complete", "failed", "running" ] }, "description": "* `running` - Running\n* `complete` - Complete\n* `failed` - Failed" } ], "tags": [ "firewall-audits" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedFirewallAuditRunList" } } }, "description": "" } }, "summary": "List firewall audits" } }, "/api/firewall-audits/{id}/": { "get": { "operationId": "firewall_audits_retrieve", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this firewall audit run.", "required": true } ], "tags": [ "firewall-audits" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FirewallAuditRun" } } }, "description": "" } }, "summary": "Retrieve firewall audit" } }, "/api/firewall-audits/{id}/findings/": { "get": { "operationId": "firewall_audits_findings_retrieve", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this firewall audit run.", "required": true } ], "tags": [ "firewall-audits" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FirewallAuditRun" } } }, "description": "" } }, "summary": "Findings: firewall audit" } }, "/api/firewall-audits/checklist/": { "get": { "operationId": "firewall_audits_checklist_retrieve", "description": "Return the full PCI DSS v4.0 checklist definition with descriptions and severity.", "tags": [ "firewall-audits" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FirewallAuditRun" } } }, "description": "" } }, "summary": "List checklists" } }, "/api/firewall-audits/run_all/": { "post": { "operationId": "firewall_audits_run_all_create", "description": "Run PCI audit on every firewall/ADC device, optionally scoped to a device group.", "tags": [ "firewall-audits" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FirewallAuditRunRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/FirewallAuditRunRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/FirewallAuditRunRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FirewallAuditRun" } } }, "description": "" } }, "summary": "Create run all" } }, "/api/firewall-audits/run_audit/": { "post": { "operationId": "firewall_audits_run_audit_create", "tags": [ "firewall-audits" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FirewallAuditRunRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/FirewallAuditRunRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/FirewallAuditRunRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FirewallAuditRun" } } }, "description": "" } }, "summary": "Create run audit" } }, "/api/firewall-automation/access-requests/": { "get": { "operationId": "firewall_automation_access_requests_list", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "name": "ordering", "required": false, "in": "query", "description": "Which field to use when ordering the results.", "schema": { "type": "string" } }, { "name": "search", "required": false, "in": "query", "description": "A search term.", "schema": { "type": "string" } } ], "tags": [ "firewall-automation" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/AccessRequestList" } } } }, "description": "" } }, "summary": "List access requests" }, "post": { "operationId": "firewall_automation_access_requests_create", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "tags": [ "firewall-automation" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccessRequestRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/AccessRequestRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/AccessRequestRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccessRequest" } } }, "description": "" } }, "summary": "Create access request" } }, "/api/firewall-automation/access-requests/{id}/": { "get": { "operationId": "firewall_automation_access_requests_retrieve", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this access request.", "required": true } ], "tags": [ "firewall-automation" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccessRequest" } } }, "description": "" } }, "summary": "Retrieve access request" }, "put": { "operationId": "firewall_automation_access_requests_update", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this access request.", "required": true } ], "tags": [ "firewall-automation" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccessRequestRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/AccessRequestRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/AccessRequestRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccessRequest" } } }, "description": "" } }, "summary": "Update access request" }, "patch": { "operationId": "firewall_automation_access_requests_partial_update", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this access request.", "required": true } ], "tags": [ "firewall-automation" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PatchedAccessRequestRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/PatchedAccessRequestRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/PatchedAccessRequestRequest" } } } }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccessRequest" } } }, "description": "" } }, "summary": "Update access request" }, "delete": { "operationId": "firewall_automation_access_requests_destroy", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this access request.", "required": true } ], "tags": [ "firewall-automation" ], "security": [ { "jwtAuth": [] } ], "responses": { "204": { "description": "No response body" } }, "summary": "Delete access request" } }, "/api/firewall-automation/access-requests/{id}/approve/": { "post": { "operationId": "firewall_automation_access_requests_approve_create", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this access request.", "required": true } ], "tags": [ "firewall-automation" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccessRequestRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/AccessRequestRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/AccessRequestRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccessRequest" } } }, "description": "" } }, "summary": "Approve: access request" } }, "/api/firewall-automation/access-requests/{id}/reject/": { "post": { "operationId": "firewall_automation_access_requests_reject_create", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this access request.", "required": true } ], "tags": [ "firewall-automation" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccessRequestRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/AccessRequestRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/AccessRequestRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccessRequest" } } }, "description": "" } }, "summary": "Reject: access request" } }, "/api/firewall-automation/access-requests/{id}/retry_path/": { "post": { "operationId": "firewall_automation_access_requests_retry_path_create", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this access request.", "required": true } ], "tags": [ "firewall-automation" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccessRequestRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/AccessRequestRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/AccessRequestRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccessRequest" } } }, "description": "" } }, "summary": "Retry path: access request" } }, "/api/firewall-automation/access-requests/{id}/timeline/": { "get": { "operationId": "firewall_automation_access_requests_timeline_retrieve", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this access request.", "required": true } ], "tags": [ "firewall-automation" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccessRequest" } } }, "description": "" } }, "summary": "Timeline: access request" } }, "/api/firewall-automation/snow-webhook/": { "post": { "operationId": "firewall_automation_snow_webhook_create", "tags": [ "firewall-automation" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "Create snow webhook" } }, "/api/firewall-changes/": { "get": { "operationId": "firewall_changes_list", "parameters": [ { "in": "query", "name": "change_type", "schema": { "type": "string", "enum": [ "create", "delete", "push_to_device", "toggle_disable", "toggle_enable", "update" ] }, "description": "* `create` - Create Rule\n* `update` - Update Rule\n* `delete` - Delete Rule\n* `toggle_enable` - Enable Rule\n* `toggle_disable` - Disable Rule\n* `push_to_device` - Push to Device" }, { "in": "query", "name": "device", "schema": { "type": "integer" } }, { "name": "ordering", "required": false, "in": "query", "description": "Which field to use when ordering the results.", "schema": { "type": "string" } }, { "name": "page", "required": false, "in": "query", "description": "A page number within the paginated result set.", "schema": { "type": "integer" } }, { "name": "page_size", "required": false, "in": "query", "description": "Number of results to return per page.", "schema": { "type": "integer" } }, { "name": "search", "required": false, "in": "query", "description": "A search term.", "schema": { "type": "string" } }, { "in": "query", "name": "status", "schema": { "type": "string", "enum": [ "approved", "complete", "executing", "failed", "pending_approval", "pending_snow", "rejected" ] }, "description": "* `pending_snow` - Creating SNOW CHG\n* `pending_approval` - Awaiting Approval\n* `approved` - Approved\n* `rejected` - Rejected\n* `executing` - Executing\n* `complete` - Complete\n* `failed` - Failed" } ], "tags": [ "firewall-changes" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedFirewallChangeRequestList" } } }, "description": "" } }, "summary": "List firewall changes" } }, "/api/firewall-changes/{id}/": { "get": { "operationId": "firewall_changes_retrieve", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this firewall change request.", "required": true } ], "tags": [ "firewall-changes" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FirewallChangeRequest" } } }, "description": "" } }, "summary": "Retrieve firewall change" } }, "/api/firewall-changes/{id}/cancel/": { "post": { "operationId": "firewall_changes_cancel_create", "description": "Cancel a pending change request and close the SNOW CHG.", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this firewall change request.", "required": true } ], "tags": [ "firewall-changes" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FirewallChangeRequestRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/FirewallChangeRequestRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/FirewallChangeRequestRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FirewallChangeRequest" } } }, "description": "" } }, "summary": "Cancel: firewall change" } }, "/api/firewall-changes/{id}/check_approval/": { "post": { "operationId": "firewall_changes_check_approval_create", "description": "Poll ServiceNow for approval status and update the change record.", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this firewall change request.", "required": true } ], "tags": [ "firewall-changes" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FirewallChangeRequestRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/FirewallChangeRequestRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/FirewallChangeRequestRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FirewallChangeRequest" } } }, "description": "" } }, "summary": "Check approval: firewall change" } }, "/api/firewall-changes/{id}/execute/": { "post": { "operationId": "firewall_changes_execute_create", "description": "Execute an approved change (checks SNOW approval first).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this firewall change request.", "required": true } ], "tags": [ "firewall-changes" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FirewallChangeRequestRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/FirewallChangeRequestRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/FirewallChangeRequestRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FirewallChangeRequest" } } }, "description": "" } }, "summary": "Execute: firewall change" } }, "/api/firewall-objects/": { "get": { "operationId": "firewall_objects_list", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "query", "name": "device", "schema": { "type": "integer" } }, { "in": "query", "name": "name", "schema": { "type": "string" } }, { "in": "query", "name": "object_type", "schema": { "type": "string", "enum": [ "address", "address_group", "application", "external_dyn", "service", "service_group", "tag" ] }, "description": "* `address` - Address\n* `address_group` - Address Group\n* `service` - Service\n* `service_group` - Service Group\n* `application` - Application\n* `tag` - Tag\n* `external_dyn` - External Dynamic List" }, { "name": "ordering", "required": false, "in": "query", "description": "Which field to use when ordering the results.", "schema": { "type": "string" } }, { "name": "page", "required": false, "in": "query", "description": "A page number within the paginated result set.", "schema": { "type": "integer" } }, { "name": "page_size", "required": false, "in": "query", "description": "Number of results to return per page.", "schema": { "type": "integer" } }, { "name": "search", "required": false, "in": "query", "description": "A search term.", "schema": { "type": "string" } }, { "in": "query", "name": "vsys", "schema": { "type": "string" } } ], "tags": [ "firewall-objects" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedFirewallObjectList" } } }, "description": "" } }, "summary": "List firewall objects" }, "post": { "operationId": "firewall_objects_create", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "tags": [ "firewall-objects" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FirewallObjectRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/FirewallObjectRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/FirewallObjectRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FirewallObject" } } }, "description": "" } }, "summary": "Create firewall object" } }, "/api/firewall-objects/{id}/": { "get": { "operationId": "firewall_objects_retrieve", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this firewall object.", "required": true } ], "tags": [ "firewall-objects" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FirewallObject" } } }, "description": "" } }, "summary": "Retrieve firewall object" }, "put": { "operationId": "firewall_objects_update", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this firewall object.", "required": true } ], "tags": [ "firewall-objects" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FirewallObjectRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/FirewallObjectRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/FirewallObjectRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FirewallObject" } } }, "description": "" } }, "summary": "Update firewall object" }, "patch": { "operationId": "firewall_objects_partial_update", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this firewall object.", "required": true } ], "tags": [ "firewall-objects" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PatchedFirewallObjectRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/PatchedFirewallObjectRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/PatchedFirewallObjectRequest" } } } }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FirewallObject" } } }, "description": "" } }, "summary": "Update firewall object" }, "delete": { "operationId": "firewall_objects_destroy", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this firewall object.", "required": true } ], "tags": [ "firewall-objects" ], "security": [ { "jwtAuth": [] } ], "responses": { "204": { "description": "No response body" } }, "summary": "Delete firewall object" } }, "/api/firewall-objects/resolve/": { "get": { "operationId": "firewall_objects_resolve_retrieve", "description": "Recursively resolve an address object/group to a flat list of IPs/CIDRs.", "tags": [ "firewall-objects" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FirewallObject" } } }, "description": "" } }, "summary": "List resolves" } }, "/api/firewall-rule-sets/": { "get": { "operationId": "firewall_rule_sets_list", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "query", "name": "device", "schema": { "type": "integer" } }, { "name": "ordering", "required": false, "in": "query", "description": "Which field to use when ordering the results.", "schema": { "type": "string" } }, { "name": "page", "required": false, "in": "query", "description": "A page number within the paginated result set.", "schema": { "type": "integer" } }, { "name": "page_size", "required": false, "in": "query", "description": "Number of results to return per page.", "schema": { "type": "integer" } }, { "in": "query", "name": "rule_type", "schema": { "type": "string" } }, { "name": "search", "required": false, "in": "query", "description": "A search term.", "schema": { "type": "string" } }, { "in": "query", "name": "vsys", "schema": { "type": "string" } } ], "tags": [ "firewall-rule-sets" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedFirewallRuleSetList" } } }, "description": "" } }, "summary": "List firewall rule sets" }, "post": { "operationId": "firewall_rule_sets_create", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "tags": [ "firewall-rule-sets" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FirewallRuleSetRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/FirewallRuleSetRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/FirewallRuleSetRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FirewallRuleSet" } } }, "description": "" } }, "summary": "Create firewall rule set" } }, "/api/firewall-rule-sets/{id}/": { "get": { "operationId": "firewall_rule_sets_retrieve", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this firewall rule set.", "required": true } ], "tags": [ "firewall-rule-sets" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FirewallRuleSet" } } }, "description": "" } }, "summary": "Retrieve firewall rule set" }, "put": { "operationId": "firewall_rule_sets_update", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this firewall rule set.", "required": true } ], "tags": [ "firewall-rule-sets" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FirewallRuleSetRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/FirewallRuleSetRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/FirewallRuleSetRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FirewallRuleSet" } } }, "description": "" } }, "summary": "Update firewall rule set" }, "patch": { "operationId": "firewall_rule_sets_partial_update", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this firewall rule set.", "required": true } ], "tags": [ "firewall-rule-sets" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PatchedFirewallRuleSetRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/PatchedFirewallRuleSetRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/PatchedFirewallRuleSetRequest" } } } }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FirewallRuleSet" } } }, "description": "" } }, "summary": "Update firewall rule set" }, "delete": { "operationId": "firewall_rule_sets_destroy", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this firewall rule set.", "required": true } ], "tags": [ "firewall-rule-sets" ], "security": [ { "jwtAuth": [] } ], "responses": { "204": { "description": "No response body" } }, "summary": "Delete firewall rule set" } }, "/api/firewall-rules/": { "get": { "operationId": "firewall_rules_list", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "query", "name": "action", "schema": { "type": "string", "enum": [ "allow", "deny", "dnat", "drop", "reset", "snat" ] }, "description": "* `allow` - Allow\n* `deny` - Deny\n* `drop` - Drop\n* `reset` - Reset\n* `snat` - SNAT\n* `dnat` - DNAT" }, { "in": "query", "name": "device", "schema": { "type": "integer" } }, { "in": "query", "name": "enabled", "schema": { "type": "boolean" } }, { "name": "ordering", "required": false, "in": "query", "description": "Which field to use when ordering the results.", "schema": { "type": "string" } }, { "name": "page", "required": false, "in": "query", "description": "A page number within the paginated result set.", "schema": { "type": "integer" } }, { "name": "page_size", "required": false, "in": "query", "description": "Number of results to return per page.", "schema": { "type": "integer" } }, { "in": "query", "name": "rule_set", "schema": { "type": "integer" } }, { "name": "search", "required": false, "in": "query", "description": "A search term.", "schema": { "type": "string" } } ], "tags": [ "firewall-rules" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedFirewallRuleList" } } }, "description": "" } }, "summary": "List firewall rules" }, "post": { "operationId": "firewall_rules_create", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "tags": [ "firewall-rules" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FirewallRuleRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/FirewallRuleRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/FirewallRuleRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FirewallRule" } } }, "description": "" } }, "summary": "Create firewall rule" } }, "/api/firewall-rules/{id}/": { "get": { "operationId": "firewall_rules_retrieve", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this firewall rule.", "required": true } ], "tags": [ "firewall-rules" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FirewallRule" } } }, "description": "" } }, "summary": "Retrieve firewall rule" }, "put": { "operationId": "firewall_rules_update", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this firewall rule.", "required": true } ], "tags": [ "firewall-rules" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FirewallRuleRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/FirewallRuleRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/FirewallRuleRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FirewallRule" } } }, "description": "" } }, "summary": "Update firewall rule" }, "patch": { "operationId": "firewall_rules_partial_update", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this firewall rule.", "required": true } ], "tags": [ "firewall-rules" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PatchedFirewallRuleRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/PatchedFirewallRuleRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/PatchedFirewallRuleRequest" } } } }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FirewallRule" } } }, "description": "" } }, "summary": "Update firewall rule" }, "delete": { "operationId": "firewall_rules_destroy", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this firewall rule.", "required": true } ], "tags": [ "firewall-rules" ], "security": [ { "jwtAuth": [] } ], "responses": { "204": { "description": "No response body" } }, "summary": "Delete firewall rule" } }, "/api/firewall-rules/{id}/push_to_device/": { "post": { "operationId": "firewall_rules_push_to_device_create", "description": "Gate a push-to-device behind a ServiceNow change request.", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this firewall rule.", "required": true } ], "tags": [ "firewall-rules" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FirewallRuleRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/FirewallRuleRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/FirewallRuleRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FirewallRule" } } }, "description": "" } }, "summary": "Push to device: firewall rule" } }, "/api/firewall-rules/{id}/toggle_enabled/": { "post": { "operationId": "firewall_rules_toggle_enabled_create", "description": "Gate enable/disable behind a ServiceNow change request.", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this firewall rule.", "required": true } ], "tags": [ "firewall-rules" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FirewallRuleRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/FirewallRuleRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/FirewallRuleRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FirewallRule" } } }, "description": "" } }, "summary": "Toggle enabled: firewall rule" } }, "/api/firewall-rules/sync_hit_counts/": { "post": { "operationId": "firewall_rules_sync_hit_counts_create", "description": "Pull rule hit counts from Panorama and update hit_count / last_hit on each rule.", "tags": [ "firewall-rules" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FirewallRuleRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/FirewallRuleRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/FirewallRuleRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FirewallRule" } } }, "description": "" } }, "summary": "Create sync hit count" } }, "/api/nat-rules/": { "get": { "operationId": "nat_rules_list", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "query", "name": "device", "schema": { "type": "integer" } }, { "in": "query", "name": "enabled", "schema": { "type": "boolean" } }, { "in": "query", "name": "nat_type", "schema": { "type": "string", "enum": [ "dnat", "dynamic", "no_nat", "static" ] }, "description": "* `static` - Static NAT\n* `dynamic` - Dynamic NAT / PAT\n* `dnat` - Destination NAT / DNAT\n* `no_nat` - No NAT" }, { "name": "ordering", "required": false, "in": "query", "description": "Which field to use when ordering the results.", "schema": { "type": "string" } }, { "name": "page", "required": false, "in": "query", "description": "A page number within the paginated result set.", "schema": { "type": "integer" } }, { "name": "page_size", "required": false, "in": "query", "description": "Number of results to return per page.", "schema": { "type": "integer" } }, { "name": "search", "required": false, "in": "query", "description": "A search term.", "schema": { "type": "string" } } ], "tags": [ "nat-rules" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedNatRuleList" } } }, "description": "" } }, "summary": "List nat rules" }, "post": { "operationId": "nat_rules_create", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "tags": [ "nat-rules" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/NatRuleRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/NatRuleRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/NatRuleRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/NatRule" } } }, "description": "" } }, "summary": "Create nat rule" } }, "/api/nat-rules/{id}/": { "get": { "operationId": "nat_rules_retrieve", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this nat rule.", "required": true } ], "tags": [ "nat-rules" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/NatRule" } } }, "description": "" } }, "summary": "Retrieve nat rule" }, "put": { "operationId": "nat_rules_update", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this nat rule.", "required": true } ], "tags": [ "nat-rules" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/NatRuleRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/NatRuleRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/NatRuleRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/NatRule" } } }, "description": "" } }, "summary": "Update nat rule" }, "patch": { "operationId": "nat_rules_partial_update", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this nat rule.", "required": true } ], "tags": [ "nat-rules" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PatchedNatRuleRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/PatchedNatRuleRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/PatchedNatRuleRequest" } } } }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/NatRule" } } }, "description": "" } }, "summary": "Update nat rule" }, "delete": { "operationId": "nat_rules_destroy", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this nat rule.", "required": true } ], "tags": [ "nat-rules" ], "security": [ { "jwtAuth": [] } ], "responses": { "204": { "description": "No response body" } }, "summary": "Delete nat rule" } }, "/api/policies/": { "get": { "operationId": "policies_list", "parameters": [ { "in": "query", "name": "device", "schema": { "type": "integer" } }, { "name": "ordering", "required": false, "in": "query", "description": "Which field to use when ordering the results.", "schema": { "type": "string" } }, { "name": "page", "required": false, "in": "query", "description": "A page number within the paginated result set.", "schema": { "type": "integer" } }, { "name": "page_size", "required": false, "in": "query", "description": "Number of results to return per page.", "schema": { "type": "integer" } }, { "in": "query", "name": "partition", "schema": { "type": "string" } }, { "name": "search", "required": false, "in": "query", "description": "A search term.", "schema": { "type": "string" } } ], "tags": [ "policies" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedLtmPolicyList" } } }, "description": "" } }, "summary": "List policys" } }, "/api/policies/{id}/": { "get": { "operationId": "policies_retrieve", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this ltm policy.", "required": true } ], "tags": [ "policies" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LtmPolicy" } } }, "description": "" } }, "summary": "Retrieve policy" } }, "/api/policy/analyze/": { "post": { "operationId": "policy_analyze_create", "description": "POST /api/policy/analyze/\nBody: {\"device_id\": }\nTriggers static analysis on a device synchronously and returns summary.", "tags": [ "policy" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "Create analyze" } }, "/api/policy/controls/": { "get": { "operationId": "policy_controls_list", "description": "CRUD for compliance controls.", "parameters": [ { "in": "query", "name": "check_type", "schema": { "type": "string", "enum": [ "device_config", "process", "rule_predicate", "zone_matrix" ] }, "description": "* `rule_predicate` - Rule Predicate\n* `zone_matrix` - Zone Matrix\n* `device_config` - Device Config\n* `process` - Process" }, { "in": "query", "name": "enabled", "schema": { "type": "boolean" } }, { "in": "query", "name": "framework", "schema": { "type": "string", "enum": [ "custom", "dora", "nist_800_53", "pci_dss" ] }, "description": "* `pci_dss` - PCI DSS\n* `nist_800_53` - NIST 800-53\n* `dora` - DORA\n* `custom` - Custom" }, { "in": "query", "name": "is_builtin", "schema": { "type": "boolean" } }, { "name": "ordering", "required": false, "in": "query", "description": "Which field to use when ordering the results.", "schema": { "type": "string" } }, { "name": "page", "required": false, "in": "query", "description": "A page number within the paginated result set.", "schema": { "type": "integer" } }, { "name": "page_size", "required": false, "in": "query", "description": "Number of results to return per page.", "schema": { "type": "integer" } }, { "name": "search", "required": false, "in": "query", "description": "A search term.", "schema": { "type": "string" } } ], "tags": [ "policy" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedComplianceControlList" } } }, "description": "" } }, "summary": "List controls" }, "post": { "operationId": "policy_controls_create", "description": "CRUD for compliance controls.", "tags": [ "policy" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ComplianceControlRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/ComplianceControlRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/ComplianceControlRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ComplianceControl" } } }, "description": "" } }, "summary": "Create control" } }, "/api/policy/controls/{id}/": { "get": { "operationId": "policy_controls_retrieve", "description": "CRUD for compliance controls.", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this compliance control.", "required": true } ], "tags": [ "policy" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ComplianceControl" } } }, "description": "" } }, "summary": "Retrieve control" }, "put": { "operationId": "policy_controls_update", "description": "CRUD for compliance controls.", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this compliance control.", "required": true } ], "tags": [ "policy" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ComplianceControlRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/ComplianceControlRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/ComplianceControlRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ComplianceControl" } } }, "description": "" } }, "summary": "Update control" }, "patch": { "operationId": "policy_controls_partial_update", "description": "CRUD for compliance controls.", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this compliance control.", "required": true } ], "tags": [ "policy" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PatchedComplianceControlRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/PatchedComplianceControlRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/PatchedComplianceControlRequest" } } } }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ComplianceControl" } } }, "description": "" } }, "summary": "Update control" }, "delete": { "operationId": "policy_controls_destroy", "description": "CRUD for compliance controls.", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this compliance control.", "required": true } ], "tags": [ "policy" ], "security": [ { "jwtAuth": [] } ], "responses": { "204": { "description": "No response body" } }, "summary": "Delete control" } }, "/api/policy/exceptions/": { "get": { "operationId": "policy_exceptions_list", "description": "CRUD for policy exceptions.", "parameters": [ { "in": "query", "name": "approved_by", "schema": { "type": "integer" } }, { "in": "query", "name": "is_active", "schema": { "type": "boolean" } }, { "name": "ordering", "required": false, "in": "query", "description": "Which field to use when ordering the results.", "schema": { "type": "string" } }, { "name": "page", "required": false, "in": "query", "description": "A page number within the paginated result set.", "schema": { "type": "integer" } }, { "name": "page_size", "required": false, "in": "query", "description": "Number of results to return per page.", "schema": { "type": "integer" } }, { "name": "search", "required": false, "in": "query", "description": "A search term.", "schema": { "type": "string" } }, { "in": "query", "name": "violation", "schema": { "type": "integer" } } ], "tags": [ "policy" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedPolicyExceptionList" } } }, "description": "" } }, "summary": "List exceptions" }, "post": { "operationId": "policy_exceptions_create", "description": "CRUD for policy exceptions.", "tags": [ "policy" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PolicyExceptionRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/PolicyExceptionRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/PolicyExceptionRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PolicyException" } } }, "description": "" } }, "summary": "Create exception" } }, "/api/policy/exceptions/{id}/": { "get": { "operationId": "policy_exceptions_retrieve", "description": "CRUD for policy exceptions.", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this policy exception.", "required": true } ], "tags": [ "policy" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PolicyException" } } }, "description": "" } }, "summary": "Retrieve exception" }, "put": { "operationId": "policy_exceptions_update", "description": "CRUD for policy exceptions.", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this policy exception.", "required": true } ], "tags": [ "policy" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PolicyExceptionRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/PolicyExceptionRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/PolicyExceptionRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PolicyException" } } }, "description": "" } }, "summary": "Update exception" }, "patch": { "operationId": "policy_exceptions_partial_update", "description": "CRUD for policy exceptions.", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this policy exception.", "required": true } ], "tags": [ "policy" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PatchedPolicyExceptionRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/PatchedPolicyExceptionRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/PatchedPolicyExceptionRequest" } } } }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PolicyException" } } }, "description": "" } }, "summary": "Update exception" }, "delete": { "operationId": "policy_exceptions_destroy", "description": "CRUD for policy exceptions.", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this policy exception.", "required": true } ], "tags": [ "policy" ], "security": [ { "jwtAuth": [] } ], "responses": { "204": { "description": "No response body" } }, "summary": "Delete exception" } }, "/api/policy/exposure/": { "get": { "operationId": "policy_exposure_list", "description": "GET /api/policy/exposure/", "parameters": [ { "in": "query", "name": "cve_id", "schema": { "type": "string" } }, { "in": "query", "name": "device", "schema": { "type": "integer" } }, { "name": "ordering", "required": false, "in": "query", "description": "Which field to use when ordering the results.", "schema": { "type": "string" } }, { "name": "page", "required": false, "in": "query", "description": "A page number within the paginated result set.", "schema": { "type": "integer" } }, { "name": "page_size", "required": false, "in": "query", "description": "Number of results to return per page.", "schema": { "type": "integer" } }, { "in": "query", "name": "reachable_from_zone", "schema": { "type": "string" } }, { "name": "search", "required": false, "in": "query", "description": "A search term.", "schema": { "type": "string" } } ], "tags": [ "policy" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedExposureFindingList" } } }, "description": "" } }, "summary": "List exposures" } }, "/api/policy/exposure/{id}/": { "get": { "operationId": "policy_exposure_retrieve", "description": "GET /api/policy/exposure/", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this exposure finding.", "required": true } ], "tags": [ "policy" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExposureFinding" } } }, "description": "" } }, "summary": "Retrieve exposure" } }, "/api/policy/findings/": { "get": { "operationId": "policy_findings_list", "description": "GET/PATCH /api/policy/findings/", "parameters": [ { "in": "query", "name": "device", "schema": { "type": "integer" } }, { "in": "query", "name": "finding_type", "schema": { "type": "string", "enum": [ "disabled", "expired", "overly_permissive", "redundant", "shadowed", "unused", "unused_object" ] }, "description": "* `unused` - Unused\n* `shadowed` - Shadowed\n* `redundant` - Redundant\n* `expired` - Expired\n* `disabled` - Disabled\n* `overly_permissive` - Overly Permissive\n* `unused_object` - Unused Object" }, { "name": "ordering", "required": false, "in": "query", "description": "Which field to use when ordering the results.", "schema": { "type": "string" } }, { "name": "page", "required": false, "in": "query", "description": "A page number within the paginated result set.", "schema": { "type": "integer" } }, { "name": "page_size", "required": false, "in": "query", "description": "Number of results to return per page.", "schema": { "type": "integer" } }, { "name": "search", "required": false, "in": "query", "description": "A search term.", "schema": { "type": "string" } }, { "in": "query", "name": "severity", "schema": { "type": "string", "enum": [ "critical", "high", "info", "low", "medium" ] }, "description": "* `critical` - Critical\n* `high` - High\n* `medium` - Medium\n* `low` - Low\n* `info` - Info" }, { "in": "query", "name": "status", "schema": { "type": "string", "enum": [ "acknowledged", "open", "resolved", "suppressed" ] }, "description": "* `open` - Open\n* `acknowledged` - Acknowledged\n* `resolved` - Resolved\n* `suppressed` - Suppressed" } ], "tags": [ "policy" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedRuleFindingList" } } }, "description": "" } }, "summary": "List findings" } }, "/api/policy/findings/{id}/": { "get": { "operationId": "policy_findings_retrieve", "description": "GET/PATCH /api/policy/findings/", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this rule finding.", "required": true } ], "tags": [ "policy" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RuleFinding" } } }, "description": "" } }, "summary": "Retrieve finding" }, "patch": { "operationId": "policy_findings_partial_update", "description": "GET/PATCH /api/policy/findings/", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this rule finding.", "required": true } ], "tags": [ "policy" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PatchedRuleFindingRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/PatchedRuleFindingRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/PatchedRuleFindingRequest" } } } }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RuleFinding" } } }, "description": "" } }, "summary": "Update finding" } }, "/api/policy/impact-analysis/": { "post": { "operationId": "policy_impact_analysis_create", "description": "POST /api/policy/impact-analysis/\nBody: {\"query\": \"\"}\nReturns rules and objects that reference the given IP/CIDR.", "tags": [ "policy" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "Create impact analysi" } }, "/api/policy/recert/": { "get": { "operationId": "policy_recert_list", "description": "Full CRUD + transition actions for recertification reviews.", "parameters": [ { "in": "query", "name": "assigned_to", "schema": { "type": "integer" } }, { "name": "ordering", "required": false, "in": "query", "description": "Which field to use when ordering the results.", "schema": { "type": "string" } }, { "name": "page", "required": false, "in": "query", "description": "A page number within the paginated result set.", "schema": { "type": "integer" } }, { "name": "page_size", "required": false, "in": "query", "description": "Number of results to return per page.", "schema": { "type": "integer" } }, { "name": "search", "required": false, "in": "query", "description": "A search term.", "schema": { "type": "string" } }, { "in": "query", "name": "status", "schema": { "type": "string", "enum": [ "assigned", "certified", "closed", "decertified", "modify_requested", "open" ] }, "description": "* `open` - Open\n* `assigned` - Assigned\n* `certified` - Certified\n* `modify_requested` - Modify Requested\n* `decertified` - Decertified\n* `closed` - Closed" }, { "in": "query", "name": "trigger", "schema": { "type": "string", "enum": [ "compliance", "manual", "scheduled", "usage_based" ] }, "description": "* `scheduled` - Scheduled\n* `usage_based` - Usage Based\n* `compliance` - Compliance Violation\n* `manual` - Manual" } ], "tags": [ "policy" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedRecertReviewList" } } }, "description": "" } }, "summary": "List recerts" }, "post": { "operationId": "policy_recert_create", "description": "Full CRUD + transition actions for recertification reviews.", "tags": [ "policy" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RecertReviewRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/RecertReviewRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/RecertReviewRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RecertReview" } } }, "description": "" } }, "summary": "Create recert" } }, "/api/policy/recert/{id}/": { "get": { "operationId": "policy_recert_retrieve", "description": "Full CRUD + transition actions for recertification reviews.", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this recert review.", "required": true } ], "tags": [ "policy" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RecertReview" } } }, "description": "" } }, "summary": "Retrieve recert" }, "put": { "operationId": "policy_recert_update", "description": "Full CRUD + transition actions for recertification reviews.", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this recert review.", "required": true } ], "tags": [ "policy" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RecertReviewRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/RecertReviewRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/RecertReviewRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RecertReview" } } }, "description": "" } }, "summary": "Update recert" }, "patch": { "operationId": "policy_recert_partial_update", "description": "Full CRUD + transition actions for recertification reviews.", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this recert review.", "required": true } ], "tags": [ "policy" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PatchedRecertReviewRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/PatchedRecertReviewRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/PatchedRecertReviewRequest" } } } }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RecertReview" } } }, "description": "" } }, "summary": "Update recert" }, "delete": { "operationId": "policy_recert_destroy", "description": "Full CRUD + transition actions for recertification reviews.", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this recert review.", "required": true } ], "tags": [ "policy" ], "security": [ { "jwtAuth": [] } ], "responses": { "204": { "description": "No response body" } }, "summary": "Delete recert" } }, "/api/policy/recert/{id}/assign/": { "post": { "operationId": "policy_recert_assign_create", "description": "Full CRUD + transition actions for recertification reviews.", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this recert review.", "required": true } ], "tags": [ "policy" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RecertReviewRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/RecertReviewRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/RecertReviewRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RecertReview" } } }, "description": "" } }, "summary": "Assign: recert" } }, "/api/policy/recert/{id}/certify/": { "post": { "operationId": "policy_recert_certify_create", "description": "Full CRUD + transition actions for recertification reviews.", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this recert review.", "required": true } ], "tags": [ "policy" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RecertReviewRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/RecertReviewRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/RecertReviewRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RecertReview" } } }, "description": "" } }, "summary": "Certify: recert" } }, "/api/policy/recert/{id}/decertify/": { "post": { "operationId": "policy_recert_decertify_create", "description": "Full CRUD + transition actions for recertification reviews.", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this recert review.", "required": true } ], "tags": [ "policy" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RecertReviewRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/RecertReviewRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/RecertReviewRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RecertReview" } } }, "description": "" } }, "summary": "Decertify: recert" } }, "/api/policy/recert/{id}/request-modify/": { "post": { "operationId": "policy_recert_request_modify_create", "description": "Full CRUD + transition actions for recertification reviews.", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this recert review.", "required": true } ], "tags": [ "policy" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RecertReviewRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/RecertReviewRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/RecertReviewRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RecertReview" } } }, "description": "" } }, "summary": "Request modify: recert" } }, "/api/policy/rule-meta/": { "get": { "operationId": "policy_rule_meta_list", "description": "GET/POST/PATCH /api/policy/rule-meta/", "parameters": [ { "in": "query", "name": "certification_status", "schema": { "type": "string", "enum": [ "certified", "decertified", "due", "never_reviewed", "overdue" ] }, "description": "* `never_reviewed` - Never Reviewed\n* `certified` - Certified\n* `due` - Due\n* `overdue` - Overdue\n* `decertified` - Decertified" }, { "name": "ordering", "required": false, "in": "query", "description": "Which field to use when ordering the results.", "schema": { "type": "string" } }, { "in": "query", "name": "owner", "schema": { "type": "integer" } }, { "name": "page", "required": false, "in": "query", "description": "A page number within the paginated result set.", "schema": { "type": "integer" } }, { "name": "page_size", "required": false, "in": "query", "description": "Number of results to return per page.", "schema": { "type": "integer" } }, { "in": "query", "name": "rule", "schema": { "type": "integer" } }, { "name": "search", "required": false, "in": "query", "description": "A search term.", "schema": { "type": "string" } } ], "tags": [ "policy" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedRuleMetaList" } } }, "description": "" } }, "summary": "List rule metas" }, "post": { "operationId": "policy_rule_meta_create", "description": "GET/POST/PATCH /api/policy/rule-meta/", "tags": [ "policy" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RuleMetaRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/RuleMetaRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/RuleMetaRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RuleMeta" } } }, "description": "" } }, "summary": "Create rule meta" } }, "/api/policy/rule-meta/{id}/": { "get": { "operationId": "policy_rule_meta_retrieve", "description": "GET/POST/PATCH /api/policy/rule-meta/", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this rule meta.", "required": true } ], "tags": [ "policy" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RuleMeta" } } }, "description": "" } }, "summary": "Retrieve rule meta" }, "put": { "operationId": "policy_rule_meta_update", "description": "GET/POST/PATCH /api/policy/rule-meta/", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this rule meta.", "required": true } ], "tags": [ "policy" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RuleMetaRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/RuleMetaRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/RuleMetaRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RuleMeta" } } }, "description": "" } }, "summary": "Update rule meta" }, "patch": { "operationId": "policy_rule_meta_partial_update", "description": "GET/POST/PATCH /api/policy/rule-meta/", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this rule meta.", "required": true } ], "tags": [ "policy" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PatchedRuleMetaRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/PatchedRuleMetaRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/PatchedRuleMetaRequest" } } } }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RuleMeta" } } }, "description": "" } }, "summary": "Update rule meta" }, "delete": { "operationId": "policy_rule_meta_destroy", "description": "GET/POST/PATCH /api/policy/rule-meta/", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this rule meta.", "required": true } ], "tags": [ "policy" ], "security": [ { "jwtAuth": [] } ], "responses": { "204": { "description": "No response body" } }, "summary": "Delete rule meta" } }, "/api/policy/rule-meta/bulk-assign-owner/": { "post": { "operationId": "policy_rule_meta_bulk_assign_owner_create", "description": "GET/POST/PATCH /api/policy/rule-meta/", "tags": [ "policy" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RuleMetaRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/RuleMetaRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/RuleMetaRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RuleMeta" } } }, "description": "" } }, "summary": "Create bulk assign owner" } }, "/api/policy/seg-policy/": { "get": { "operationId": "policy_seg_policy_list", "description": "CRUD + activate action for segmentation policies.", "parameters": [ { "name": "ordering", "required": false, "in": "query", "description": "Which field to use when ordering the results.", "schema": { "type": "string" } }, { "name": "page", "required": false, "in": "query", "description": "A page number within the paginated result set.", "schema": { "type": "integer" } }, { "name": "page_size", "required": false, "in": "query", "description": "Number of results to return per page.", "schema": { "type": "integer" } }, { "name": "search", "required": false, "in": "query", "description": "A search term.", "schema": { "type": "string" } }, { "in": "query", "name": "status", "schema": { "type": "string", "enum": [ "active", "archived", "draft" ] }, "description": "* `draft` - Draft\n* `active` - Active\n* `archived` - Archived" } ], "tags": [ "policy" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedSegmentationPolicyList" } } }, "description": "" } }, "summary": "List seg policys" }, "post": { "operationId": "policy_seg_policy_create", "description": "CRUD + activate action for segmentation policies.", "tags": [ "policy" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SegmentationPolicyRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/SegmentationPolicyRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/SegmentationPolicyRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SegmentationPolicy" } } }, "description": "" } }, "summary": "Create seg policy" } }, "/api/policy/seg-policy/{id}/": { "get": { "operationId": "policy_seg_policy_retrieve", "description": "CRUD + activate action for segmentation policies.", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this segmentation policy.", "required": true } ], "tags": [ "policy" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SegmentationPolicy" } } }, "description": "" } }, "summary": "Retrieve seg policy" }, "put": { "operationId": "policy_seg_policy_update", "description": "CRUD + activate action for segmentation policies.", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this segmentation policy.", "required": true } ], "tags": [ "policy" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SegmentationPolicyRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/SegmentationPolicyRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/SegmentationPolicyRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SegmentationPolicy" } } }, "description": "" } }, "summary": "Update seg policy" }, "patch": { "operationId": "policy_seg_policy_partial_update", "description": "CRUD + activate action for segmentation policies.", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this segmentation policy.", "required": true } ], "tags": [ "policy" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PatchedSegmentationPolicyRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/PatchedSegmentationPolicyRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/PatchedSegmentationPolicyRequest" } } } }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SegmentationPolicy" } } }, "description": "" } }, "summary": "Update seg policy" }, "delete": { "operationId": "policy_seg_policy_destroy", "description": "CRUD + activate action for segmentation policies.", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this segmentation policy.", "required": true } ], "tags": [ "policy" ], "security": [ { "jwtAuth": [] } ], "responses": { "204": { "description": "No response body" } }, "summary": "Delete seg policy" } }, "/api/policy/seg-policy/{id}/activate/": { "post": { "operationId": "policy_seg_policy_activate_create", "description": "CRUD + activate action for segmentation policies.", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this segmentation policy.", "required": true } ], "tags": [ "policy" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SegmentationPolicyRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/SegmentationPolicyRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/SegmentationPolicyRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SegmentationPolicy" } } }, "description": "" } }, "summary": "Activate: seg policy" } }, "/api/policy/usage/": { "get": { "operationId": "policy_usage_list", "description": "GET /api/policy/usage/", "parameters": [ { "in": "query", "name": "device", "schema": { "type": "integer" } }, { "name": "ordering", "required": false, "in": "query", "description": "Which field to use when ordering the results.", "schema": { "type": "string" } }, { "name": "page", "required": false, "in": "query", "description": "A page number within the paginated result set.", "schema": { "type": "integer" } }, { "name": "page_size", "required": false, "in": "query", "description": "Number of results to return per page.", "schema": { "type": "integer" } }, { "in": "query", "name": "rule_uid", "schema": { "type": "string" } }, { "name": "search", "required": false, "in": "query", "description": "A search term.", "schema": { "type": "string" } } ], "tags": [ "policy" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedRuleUsageStateList" } } }, "description": "" } }, "summary": "List usages" } }, "/api/policy/usage/{id}/": { "get": { "operationId": "policy_usage_retrieve", "description": "GET /api/policy/usage/", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this rule usage state.", "required": true } ], "tags": [ "policy" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RuleUsageState" } } }, "description": "" } }, "summary": "Retrieve usage" } }, "/api/policy/violations/": { "get": { "operationId": "policy_violations_list", "description": "CRUD + add_exception action for compliance violations.", "parameters": [ { "in": "query", "name": "control", "schema": { "type": "integer" } }, { "in": "query", "name": "device", "schema": { "type": "integer" } }, { "name": "ordering", "required": false, "in": "query", "description": "Which field to use when ordering the results.", "schema": { "type": "string" } }, { "name": "page", "required": false, "in": "query", "description": "A page number within the paginated result set.", "schema": { "type": "integer" } }, { "name": "page_size", "required": false, "in": "query", "description": "Number of results to return per page.", "schema": { "type": "integer" } }, { "name": "search", "required": false, "in": "query", "description": "A search term.", "schema": { "type": "string" } }, { "in": "query", "name": "status", "schema": { "type": "string", "enum": [ "exception", "open", "resolved" ] }, "description": "* `open` - Open\n* `exception` - Exception\n* `resolved` - Resolved" } ], "tags": [ "policy" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedComplianceViolationList" } } }, "description": "" } }, "summary": "List violations" } }, "/api/policy/violations/{id}/": { "get": { "operationId": "policy_violations_retrieve", "description": "CRUD + add_exception action for compliance violations.", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this compliance violation.", "required": true } ], "tags": [ "policy" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ComplianceViolation" } } }, "description": "" } }, "summary": "Retrieve violation" }, "patch": { "operationId": "policy_violations_partial_update", "description": "CRUD + add_exception action for compliance violations.", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this compliance violation.", "required": true } ], "tags": [ "policy" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PatchedComplianceViolationRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/PatchedComplianceViolationRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/PatchedComplianceViolationRequest" } } } }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ComplianceViolation" } } }, "description": "" } }, "summary": "Update violation" } }, "/api/policy/zone-cells/": { "get": { "operationId": "policy_zone_cells_list", "description": "CRUD for zone policy cells.", "parameters": [ { "in": "query", "name": "dst_zone", "schema": { "type": "string" } }, { "name": "ordering", "required": false, "in": "query", "description": "Which field to use when ordering the results.", "schema": { "type": "string" } }, { "name": "page", "required": false, "in": "query", "description": "A page number within the paginated result set.", "schema": { "type": "integer" } }, { "name": "page_size", "required": false, "in": "query", "description": "Number of results to return per page.", "schema": { "type": "integer" } }, { "in": "query", "name": "policy", "schema": { "type": "integer" } }, { "name": "search", "required": false, "in": "query", "description": "A search term.", "schema": { "type": "string" } }, { "in": "query", "name": "src_zone", "schema": { "type": "string" } }, { "in": "query", "name": "stance", "schema": { "type": "string", "enum": [ "allow_all", "deny_all", "restricted" ] }, "description": "* `allow_all` - Allow All\n* `deny_all` - Deny All\n* `restricted` - Restricted" } ], "tags": [ "policy" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedZonePolicyCellList" } } }, "description": "" } }, "summary": "List zone cells" }, "post": { "operationId": "policy_zone_cells_create", "description": "CRUD for zone policy cells.", "tags": [ "policy" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ZonePolicyCellRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/ZonePolicyCellRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/ZonePolicyCellRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ZonePolicyCell" } } }, "description": "" } }, "summary": "Create zone cell" } }, "/api/policy/zone-cells/{id}/": { "get": { "operationId": "policy_zone_cells_retrieve", "description": "CRUD for zone policy cells.", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this zone policy cell.", "required": true } ], "tags": [ "policy" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ZonePolicyCell" } } }, "description": "" } }, "summary": "Retrieve zone cell" }, "put": { "operationId": "policy_zone_cells_update", "description": "CRUD for zone policy cells.", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this zone policy cell.", "required": true } ], "tags": [ "policy" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ZonePolicyCellRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/ZonePolicyCellRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/ZonePolicyCellRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ZonePolicyCell" } } }, "description": "" } }, "summary": "Update zone cell" }, "patch": { "operationId": "policy_zone_cells_partial_update", "description": "CRUD for zone policy cells.", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this zone policy cell.", "required": true } ], "tags": [ "policy" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PatchedZonePolicyCellRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/PatchedZonePolicyCellRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/PatchedZonePolicyCellRequest" } } } }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ZonePolicyCell" } } }, "description": "" } }, "summary": "Update zone cell" }, "delete": { "operationId": "policy_zone_cells_destroy", "description": "CRUD for zone policy cells.", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this zone policy cell.", "required": true } ], "tags": [ "policy" ], "security": [ { "jwtAuth": [] } ], "responses": { "204": { "description": "No response body" } }, "summary": "Delete zone cell" } }, "/api/waf-exceptions/": { "get": { "operationId": "waf_exceptions_list", "description": "WAF exception requests go through a risk-tiered ServiceNow change +\napproval gate before being pushed to F5 XC, run entirely on the\napps.workflows graph engine (see apps.applications.waf_exception_workflow\nand apps.workflows.steps.xc_waf_exception \u2014 Phase 6, Architecture\nDecision 4) \u2014 this used to push immediately on create with no\nchange-control step.\n\nPhase 5 (VS-SPEC-XC-WAF-EXC-001 \u00a74/\u00a76) adds: every create is run through\nthe shadow/conflict analyzer against the VS's live WafRuleInventory\n(shadowed-new / redundant block the request outright; shadowing-others\nrequires acknowledge_shadowing=true), gets a server-computed risk_tier,\nand gets an auto-generated rule_name when the caller doesn't supply one\n(used as the future XC rule's metadata.name).", "parameters": [ { "name": "ordering", "required": false, "in": "query", "description": "Which field to use when ordering the results.", "schema": { "type": "string" } }, { "name": "page", "required": false, "in": "query", "description": "A page number within the paginated result set.", "schema": { "type": "integer" } }, { "name": "page_size", "required": false, "in": "query", "description": "Number of results to return per page.", "schema": { "type": "integer" } }, { "name": "search", "required": false, "in": "query", "description": "A search term.", "schema": { "type": "string" } }, { "in": "query", "name": "status", "schema": { "type": "string", "enum": [ "applied", "applying", "approved", "cancelled", "draft", "drift_detected", "expired", "failed", "pending_approval", "rejected", "removed", "requested", "verify_failed" ] }, "description": "* `requested` - Requested\n* `pending_approval` - Pending SNOW Approval\n* `rejected` - Rejected\n* `applied` - Applied\n* `failed` - Failed\n* `draft` - Draft\n* `approved` - Approved\n* `applying` - Applying\n* `verify_failed` - Verify Failed\n* `cancelled` - Cancelled\n* `expired` - Expired\n* `removed` - Removed\n* `drift_detected` - Drift Detected" }, { "in": "query", "name": "virtual_server", "schema": { "type": "integer" } } ], "tags": [ "waf-exceptions" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedWafExceptionList" } } }, "description": "" } }, "summary": "List waf exceptions" }, "post": { "operationId": "waf_exceptions_create", "description": "WAF exception requests go through a risk-tiered ServiceNow change +\napproval gate before being pushed to F5 XC, run entirely on the\napps.workflows graph engine (see apps.applications.waf_exception_workflow\nand apps.workflows.steps.xc_waf_exception \u2014 Phase 6, Architecture\nDecision 4) \u2014 this used to push immediately on create with no\nchange-control step.\n\nPhase 5 (VS-SPEC-XC-WAF-EXC-001 \u00a74/\u00a76) adds: every create is run through\nthe shadow/conflict analyzer against the VS's live WafRuleInventory\n(shadowed-new / redundant block the request outright; shadowing-others\nrequires acknowledge_shadowing=true), gets a server-computed risk_tier,\nand gets an auto-generated rule_name when the caller doesn't supply one\n(used as the future XC rule's metadata.name).", "tags": [ "waf-exceptions" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WafExceptionRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/WafExceptionRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/WafExceptionRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WafException" } } }, "description": "" } }, "summary": "Create waf exception" } }, "/api/waf-exceptions/{id}/": { "get": { "operationId": "waf_exceptions_retrieve", "description": "WAF exception requests go through a risk-tiered ServiceNow change +\napproval gate before being pushed to F5 XC, run entirely on the\napps.workflows graph engine (see apps.applications.waf_exception_workflow\nand apps.workflows.steps.xc_waf_exception \u2014 Phase 6, Architecture\nDecision 4) \u2014 this used to push immediately on create with no\nchange-control step.\n\nPhase 5 (VS-SPEC-XC-WAF-EXC-001 \u00a74/\u00a76) adds: every create is run through\nthe shadow/conflict analyzer against the VS's live WafRuleInventory\n(shadowed-new / redundant block the request outright; shadowing-others\nrequires acknowledge_shadowing=true), gets a server-computed risk_tier,\nand gets an auto-generated rule_name when the caller doesn't supply one\n(used as the future XC rule's metadata.name).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this waf exception.", "required": true } ], "tags": [ "waf-exceptions" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WafException" } } }, "description": "" } }, "summary": "Retrieve waf exception" }, "put": { "operationId": "waf_exceptions_update", "description": "WAF exception requests go through a risk-tiered ServiceNow change +\napproval gate before being pushed to F5 XC, run entirely on the\napps.workflows graph engine (see apps.applications.waf_exception_workflow\nand apps.workflows.steps.xc_waf_exception \u2014 Phase 6, Architecture\nDecision 4) \u2014 this used to push immediately on create with no\nchange-control step.\n\nPhase 5 (VS-SPEC-XC-WAF-EXC-001 \u00a74/\u00a76) adds: every create is run through\nthe shadow/conflict analyzer against the VS's live WafRuleInventory\n(shadowed-new / redundant block the request outright; shadowing-others\nrequires acknowledge_shadowing=true), gets a server-computed risk_tier,\nand gets an auto-generated rule_name when the caller doesn't supply one\n(used as the future XC rule's metadata.name).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this waf exception.", "required": true } ], "tags": [ "waf-exceptions" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WafExceptionRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/WafExceptionRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/WafExceptionRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WafException" } } }, "description": "" } }, "summary": "Update waf exception" }, "patch": { "operationId": "waf_exceptions_partial_update", "description": "WAF exception requests go through a risk-tiered ServiceNow change +\napproval gate before being pushed to F5 XC, run entirely on the\napps.workflows graph engine (see apps.applications.waf_exception_workflow\nand apps.workflows.steps.xc_waf_exception \u2014 Phase 6, Architecture\nDecision 4) \u2014 this used to push immediately on create with no\nchange-control step.\n\nPhase 5 (VS-SPEC-XC-WAF-EXC-001 \u00a74/\u00a76) adds: every create is run through\nthe shadow/conflict analyzer against the VS's live WafRuleInventory\n(shadowed-new / redundant block the request outright; shadowing-others\nrequires acknowledge_shadowing=true), gets a server-computed risk_tier,\nand gets an auto-generated rule_name when the caller doesn't supply one\n(used as the future XC rule's metadata.name).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this waf exception.", "required": true } ], "tags": [ "waf-exceptions" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PatchedWafExceptionRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/PatchedWafExceptionRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/PatchedWafExceptionRequest" } } } }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WafException" } } }, "description": "" } }, "summary": "Update waf exception" }, "delete": { "operationId": "waf_exceptions_destroy", "description": "WAF exception requests go through a risk-tiered ServiceNow change +\napproval gate before being pushed to F5 XC, run entirely on the\napps.workflows graph engine (see apps.applications.waf_exception_workflow\nand apps.workflows.steps.xc_waf_exception \u2014 Phase 6, Architecture\nDecision 4) \u2014 this used to push immediately on create with no\nchange-control step.\n\nPhase 5 (VS-SPEC-XC-WAF-EXC-001 \u00a74/\u00a76) adds: every create is run through\nthe shadow/conflict analyzer against the VS's live WafRuleInventory\n(shadowed-new / redundant block the request outright; shadowing-others\nrequires acknowledge_shadowing=true), gets a server-computed risk_tier,\nand gets an auto-generated rule_name when the caller doesn't supply one\n(used as the future XC rule's metadata.name).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this waf exception.", "required": true } ], "tags": [ "waf-exceptions" ], "security": [ { "jwtAuth": [] } ], "responses": { "204": { "description": "No response body" } }, "summary": "Delete waf exception" } }, "/api/waf-exceptions/{id}/retry/": { "post": { "operationId": "waf_exceptions_retry_create", "description": "Starts a fresh apply-pipeline run for this exception \u2014 used when\na previous run failed (SNOW instance unreachable, XC apply failed,\nor a post-approval verify_failed). Known simplification: always\nrestarts from the top rather than resuming mid-graph, so a retry\nafter an already-approved change opens a new change rather than\nreusing it.", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this waf exception.", "required": true } ], "tags": [ "waf-exceptions" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WafExceptionRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/WafExceptionRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/WafExceptionRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WafException" } } }, "description": "" } }, "summary": "Retry: waf exception" } }, "/api/waf-exceptions/shadow-check/": { "post": { "operationId": "waf_exceptions_shadow_check_create", "description": "Preview endpoint (\u00a74.4): runs the same shadow/conflict analysis\nand rule-JSON build the create endpoint uses, without persisting\nanything \u2014 lets the frontend show findings and the exact JSON\nobject before the user submits.", "tags": [ "waf-exceptions" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WafExceptionRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/WafExceptionRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/WafExceptionRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WafException" } } }, "description": "" } }, "summary": "Create shadow check" } }, "/api/waf-requests/": { "get": { "operationId": "waf_requests_list", "parameters": [ { "in": "query", "name": "device", "schema": { "type": "integer" } }, { "in": "query", "name": "enforced", "schema": { "type": "boolean" } }, { "name": "ordering", "required": false, "in": "query", "description": "Which field to use when ordering the results.", "schema": { "type": "string" } }, { "name": "page", "required": false, "in": "query", "description": "A page number within the paginated result set.", "schema": { "type": "integer" } }, { "name": "page_size", "required": false, "in": "query", "description": "Number of results to return per page.", "schema": { "type": "integer" } }, { "name": "search", "required": false, "in": "query", "description": "A search term.", "schema": { "type": "string" } }, { "in": "query", "name": "severity", "schema": { "type": "string" } } ], "tags": [ "waf-requests" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedWafRequestList" } } }, "description": "" } }, "summary": "List waf requests" }, "post": { "operationId": "waf_requests_create", "tags": [ "waf-requests" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WafRequestRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/WafRequestRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/WafRequestRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WafRequest" } } }, "description": "" } }, "summary": "Create waf request" } }, "/api/waf-requests/{id}/": { "get": { "operationId": "waf_requests_retrieve", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this waf request.", "required": true } ], "tags": [ "waf-requests" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WafRequest" } } }, "description": "" } }, "summary": "Retrieve waf request" }, "put": { "operationId": "waf_requests_update", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this waf request.", "required": true } ], "tags": [ "waf-requests" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WafRequestRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/WafRequestRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/WafRequestRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WafRequest" } } }, "description": "" } }, "summary": "Update waf request" }, "patch": { "operationId": "waf_requests_partial_update", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this waf request.", "required": true } ], "tags": [ "waf-requests" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PatchedWafRequestRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/PatchedWafRequestRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/PatchedWafRequestRequest" } } } }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WafRequest" } } }, "description": "" } }, "summary": "Update waf request" }, "delete": { "operationId": "waf_requests_destroy", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this waf request.", "required": true } ], "tags": [ "waf-requests" ], "security": [ { "jwtAuth": [] } ], "responses": { "204": { "description": "No response body" } }, "summary": "Delete waf request" } }, "/api/waf-requests/summary/": { "get": { "operationId": "waf_requests_summary_retrieve", "tags": [ "waf-requests" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WafRequest" } } }, "description": "" } }, "summary": "List summarys" } } }, "components": { "schemas": { "MatchTypeEnum": { "enum": [ "url_path", "signature_id", "source_ip", "other" ], "type": "string", "description": "* `url_path` - URL Path\n* `signature_id` - Signature ID\n* `source_ip` - Source IP\n* `other` - Other" }, "PaginatedFirewallRuleSetList": { "type": "object", "required": [ "count", "results" ], "properties": { "count": { "type": "integer", "example": 123 }, "next": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=4" }, "previous": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=2" }, "results": { "type": "array", "items": { "$ref": "#/components/schemas/FirewallRuleSet" } } } }, "FirewallAuditRunRequest": { "type": "object", "properties": { "audit_type": { "$ref": "#/components/schemas/AuditTypeEnum" }, "status": { "$ref": "#/components/schemas/FirewallAuditRunStatusEnum" }, "total_rules": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648 }, "findings_critical": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648 }, "findings_high": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648 }, "findings_medium": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648 }, "findings_low": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648 }, "findings_info": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648 }, "score": { "type": "number", "format": "double", "nullable": true }, "completed_at": { "type": "string", "format": "date-time", "nullable": true }, "created_by": { "type": "string", "maxLength": 100 }, "device": { "type": "integer" }, "rule_set": { "type": "integer", "nullable": true } }, "required": [ "device" ] }, "LtmPolicy": { "type": "object", "properties": { "id": { "type": "integer", "readOnly": true }, "device_name": { "type": "string", "readOnly": true }, "name": { "type": "string", "maxLength": 300 }, "partition": { "type": "string", "default": "Common", "maxLength": 100 }, "strategy": { "type": "string", "maxLength": 200 }, "status": { "type": "string", "maxLength": 20 }, "raw_config": {}, "created_at": { "type": "string", "format": "date-time", "readOnly": true }, "device": { "type": "integer" } }, "required": [ "created_at", "device", "device_name", "id", "name" ] }, "PaginatedLtmPolicyList": { "type": "object", "required": [ "count", "results" ], "properties": { "count": { "type": "integer", "example": 123 }, "next": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=4" }, "previous": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=2" }, "results": { "type": "array", "items": { "$ref": "#/components/schemas/LtmPolicy" } } } }, "NatTypeEnum": { "enum": [ "static", "dynamic", "dnat", "no_nat" ], "type": "string", "description": "* `static` - Static NAT\n* `dynamic` - Dynamic NAT / PAT\n* `dnat` - Destination NAT / DNAT\n* `no_nat` - No NAT" }, "PaginatedFirewallChangeRequestList": { "type": "object", "required": [ "count", "results" ], "properties": { "count": { "type": "integer", "example": 123 }, "next": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=4" }, "previous": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=2" }, "results": { "type": "array", "items": { "$ref": "#/components/schemas/FirewallChangeRequest" } } } }, "PatchedWafExceptionRequest": { "type": "object", "properties": { "virtual_server": { "type": "integer" }, "match_type": { "$ref": "#/components/schemas/MatchTypeEnum" }, "match_value": { "type": "string", "default": "" }, "reason": { "type": "string", "minLength": 1 }, "requested_by": { "type": "string", "maxLength": 150 }, "scope_kind": { "$ref": "#/components/schemas/ScopeKindEnum" }, "route_ref": { "type": "string", "maxLength": 200 }, "rule_name": { "type": "string", "maxLength": 200 }, "match_domain_kind": { "$ref": "#/components/schemas/MatchDomainKindEnum" }, "match_domain": { "type": "string", "maxLength": 300 }, "match_path_kind": { "$ref": "#/components/schemas/MatchPathKindEnum" }, "match_path": { "type": "string", "maxLength": 500 }, "match_methods": {}, "exclusion_kind": { "$ref": "#/components/schemas/ExclusionKindEnum" }, "signatures": {}, "attack_types": {}, "violations": {}, "bot_names": {}, "source_kind": { "$ref": "#/components/schemas/SourceKindEnum" }, "expires_at": { "type": "string", "format": "date-time", "nullable": true }, "placement": { "type": "string", "minLength": 1, "maxLength": 100 }, "acknowledge_shadowing": { "type": "boolean", "writeOnly": true, "default": false } } }, "ComplianceControlRequest": { "type": "object", "properties": { "control_id": { "type": "string", "minLength": 1, "maxLength": 100 }, "framework": { "$ref": "#/components/schemas/FrameworkEnum" }, "reference": { "type": "string", "minLength": 1, "maxLength": 200 }, "name": { "type": "string", "minLength": 1, "maxLength": 300 }, "description": { "type": "string" }, "check_type": { "$ref": "#/components/schemas/CheckTypeEnum" }, "predicate": {}, "severity": { "$ref": "#/components/schemas/Severity0d8Enum" }, "remediation_hint": { "type": "string" }, "enabled": { "type": "boolean" }, "is_builtin": { "type": "boolean" } }, "required": [ "check_type", "control_id", "framework", "name", "reference" ] }, "PaginatedRecertReviewList": { "type": "object", "required": [ "count", "results" ], "properties": { "count": { "type": "integer", "example": 123 }, "next": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=4" }, "previous": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=2" }, "results": { "type": "array", "items": { "$ref": "#/components/schemas/RecertReview" } } } }, "PatchedRecertReviewRequest": { "type": "object", "properties": { "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "trigger": { "$ref": "#/components/schemas/RecertReviewTriggerEnum" }, "status": { "$ref": "#/components/schemas/RecertReviewStatusEnum" }, "due_at": { "type": "string", "format": "date-time", "nullable": true }, "idempotency_key": { "type": "string", "minLength": 1, "maxLength": 200 }, "servicenow_task_id": { "type": "string", "maxLength": 200 }, "rule_meta": { "type": "integer" }, "assigned_to": { "type": "integer", "nullable": true } } }, "PatchedComplianceControlRequest": { "type": "object", "properties": { "control_id": { "type": "string", "minLength": 1, "maxLength": 100 }, "framework": { "$ref": "#/components/schemas/FrameworkEnum" }, "reference": { "type": "string", "minLength": 1, "maxLength": 200 }, "name": { "type": "string", "minLength": 1, "maxLength": 300 }, "description": { "type": "string" }, "check_type": { "$ref": "#/components/schemas/CheckTypeEnum" }, "predicate": {}, "severity": { "$ref": "#/components/schemas/Severity0d8Enum" }, "remediation_hint": { "type": "string" }, "enabled": { "type": "boolean" }, "is_builtin": { "type": "boolean" } } }, "PatchedRuleMetaRequest": { "type": "object", "properties": { "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "business_justification": { "type": "string" }, "ticket_ref": { "type": "string", "maxLength": 200 }, "created_via": { "$ref": "#/components/schemas/CreatedViaEnum" }, "expires_at": { "type": "string", "format": "date-time", "nullable": true }, "suggested_owner_confidence": { "type": "number", "format": "double" }, "rule": { "type": "integer" }, "owner": { "type": "integer", "nullable": true }, "suggested_owner": { "type": "integer", "nullable": true } } }, "RecertReviewRequest": { "type": "object", "properties": { "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "trigger": { "$ref": "#/components/schemas/RecertReviewTriggerEnum" }, "status": { "$ref": "#/components/schemas/RecertReviewStatusEnum" }, "due_at": { "type": "string", "format": "date-time", "nullable": true }, "idempotency_key": { "type": "string", "minLength": 1, "maxLength": 200 }, "servicenow_task_id": { "type": "string", "maxLength": 200 }, "rule_meta": { "type": "integer" }, "assigned_to": { "type": "integer", "nullable": true } }, "required": [ "idempotency_key", "rule_meta", "trigger" ] }, "PaginatedNatRuleList": { "type": "object", "required": [ "count", "results" ], "properties": { "count": { "type": "integer", "example": 123 }, "next": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=4" }, "previous": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=2" }, "results": { "type": "array", "items": { "$ref": "#/components/schemas/NatRule" } } } }, "PaginatedFirewallRuleList": { "type": "object", "required": [ "count", "results" ], "properties": { "count": { "type": "integer", "example": 123 }, "next": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=4" }, "previous": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=2" }, "results": { "type": "array", "items": { "$ref": "#/components/schemas/FirewallRule" } } } }, "FirewallChangeRequest": { "type": "object", "properties": { "id": { "type": "integer", "readOnly": true }, "device_name": { "type": "string", "readOnly": true }, "rule_name": { "type": "string", "readOnly": true }, "snow_instance_name": { "type": "string", "readOnly": true }, "change_type_label": { "type": "string", "readOnly": true }, "status_label": { "type": "string", "readOnly": true }, "change_type": { "$ref": "#/components/schemas/ChangeType5b9Enum" }, "proposed_data": {}, "snow_chg_number": { "type": "string", "maxLength": 50 }, "snow_chg_sys_id": { "type": "string", "maxLength": 100 }, "status": { "$ref": "#/components/schemas/StatusDf8Enum" }, "result": { "type": "string" }, "created_by": { "type": "string", "maxLength": 100 }, "approved_by": { "type": "string", "maxLength": 100 }, "created_at": { "type": "string", "format": "date-time", "readOnly": true }, "executed_at": { "type": "string", "format": "date-time", "nullable": true }, "device": { "type": "integer" }, "rule": { "type": "integer", "nullable": true }, "snow_instance": { "type": "integer", "nullable": true } }, "required": [ "change_type", "change_type_label", "created_at", "device", "device_name", "id", "rule_name", "snow_instance_name", "status_label" ] }, "FirewallRuleSetRequest": { "type": "object", "properties": { "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "name": { "type": "string", "minLength": 1, "maxLength": 200 }, "rule_type": { "type": "string", "minLength": 1, "maxLength": 50 }, "vsys": { "type": "string", "maxLength": 50 }, "managed_device": { "type": "string", "maxLength": 200 }, "device": { "type": "integer" } }, "required": [ "device", "name", "vsys" ] }, "PaginatedExposureFindingList": { "type": "object", "required": [ "count", "results" ], "properties": { "count": { "type": "integer", "example": 123 }, "next": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=4" }, "previous": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=2" }, "results": { "type": "array", "items": { "$ref": "#/components/schemas/ExposureFinding" } } } }, "PaginatedPolicyExceptionList": { "type": "object", "required": [ "count", "results" ], "properties": { "count": { "type": "integer", "example": 123 }, "next": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=4" }, "previous": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=2" }, "results": { "type": "array", "items": { "$ref": "#/components/schemas/PolicyException" } } } }, "Severity0d8Enum": { "enum": [ "critical", "high", "medium", "low", "info" ], "type": "string", "description": "* `critical` - Critical\n* `high` - High\n* `medium` - Medium\n* `low` - Low\n* `info` - Info" }, "ExposureFinding": { "type": "object", "properties": { "id": { "type": "integer", "readOnly": true }, "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "cve_id": { "type": "string", "maxLength": 100 }, "cvss_score": { "type": "number", "format": "double" }, "reachable_from_zone": { "type": "string", "maxLength": 100 }, "enabling_rules": {}, "exposure_score": { "type": "number", "format": "double" }, "asset_ip": { "type": "string", "maxLength": 100 }, "computed_at": { "type": "string", "format": "date-time", "readOnly": true }, "device": { "type": "integer" } }, "required": [ "computed_at", "cve_id", "device", "id", "reachable_from_zone" ] }, "ChangeType5b9Enum": { "enum": [ "create", "update", "delete", "toggle_enable", "toggle_disable", "push_to_device" ], "type": "string", "description": "* `create` - Create Rule\n* `update` - Update Rule\n* `delete` - Delete Rule\n* `toggle_enable` - Enable Rule\n* `toggle_disable` - Disable Rule\n* `push_to_device` - Push to Device" }, "FirewallAuditRunStatusEnum": { "enum": [ "running", "complete", "failed" ], "type": "string", "description": "* `running` - Running\n* `complete` - Complete\n* `failed` - Failed" }, "RecertReview": { "type": "object", "properties": { "id": { "type": "integer", "readOnly": true }, "events": { "type": "array", "items": { "$ref": "#/components/schemas/RecertReviewEvent" }, "readOnly": true }, "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "trigger": { "$ref": "#/components/schemas/RecertReviewTriggerEnum" }, "status": { "$ref": "#/components/schemas/RecertReviewStatusEnum" }, "due_at": { "type": "string", "format": "date-time", "nullable": true }, "closed_at": { "type": "string", "format": "date-time", "readOnly": true, "nullable": true }, "idempotency_key": { "type": "string", "maxLength": 200 }, "servicenow_task_id": { "type": "string", "maxLength": 200 }, "created_at": { "type": "string", "format": "date-time", "readOnly": true }, "rule_meta": { "type": "integer" }, "assigned_to": { "type": "integer", "nullable": true } }, "required": [ "closed_at", "created_at", "events", "id", "idempotency_key", "rule_meta", "trigger" ] }, "FirewallRuleRequest": { "type": "object", "properties": { "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "name": { "type": "string", "minLength": 1, "maxLength": 300 }, "sequence": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648 }, "action": { "$ref": "#/components/schemas/FirewallRuleActionEnum" }, "enabled": { "type": "boolean" }, "src_zones": {}, "dst_zones": {}, "src_addresses": {}, "dst_addresses": {}, "services": {}, "applications": {}, "log_setting": { "type": "string", "maxLength": 200 }, "description": { "type": "string" }, "tags": {}, "raw_data": {}, "hit_count": { "type": "integer", "maximum": 2147483647, "minimum": 0 }, "last_hit": { "type": "string", "format": "date-time", "nullable": true }, "rule_set": { "type": "integer" }, "device": { "type": "integer" } }, "required": [ "device", "name", "rule_set" ] }, "FirewallAuditRun": { "type": "object", "properties": { "id": { "type": "integer", "readOnly": true }, "device_name": { "type": "string", "readOnly": true }, "rule_set_name": { "type": "string", "readOnly": true }, "findings": { "type": "array", "items": { "$ref": "#/components/schemas/FirewallAuditFinding" }, "readOnly": true }, "findings_count": { "type": "string", "readOnly": true }, "audit_type": { "$ref": "#/components/schemas/AuditTypeEnum" }, "status": { "$ref": "#/components/schemas/FirewallAuditRunStatusEnum" }, "total_rules": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648 }, "findings_critical": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648 }, "findings_high": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648 }, "findings_medium": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648 }, "findings_low": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648 }, "findings_info": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648 }, "score": { "type": "number", "format": "double", "nullable": true }, "started_at": { "type": "string", "format": "date-time", "readOnly": true }, "completed_at": { "type": "string", "format": "date-time", "nullable": true }, "created_by": { "type": "string", "maxLength": 100 }, "device": { "type": "integer" }, "rule_set": { "type": "integer", "nullable": true } }, "required": [ "device", "device_name", "findings", "findings_count", "id", "rule_set_name", "started_at" ] }, "RiskTierEnum": { "enum": [ "narrow", "standard", "broad", "bypass" ], "type": "string", "description": "* `narrow` - Narrow\n* `standard` - Standard\n* `broad` - Broad\n* `bypass` - Bypass" }, "RuleFinding": { "type": "object", "properties": { "id": { "type": "integer", "readOnly": true }, "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "rule_uid": { "type": "string", "maxLength": 200 }, "object_uid": { "type": "string", "maxLength": 200 }, "finding_type": { "$ref": "#/components/schemas/FindingTypeEnum" }, "severity": { "$ref": "#/components/schemas/Severity0d8Enum" }, "evidence": {}, "permissiveness_score": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648 }, "analysis_truncated": { "type": "boolean" }, "first_detected": { "type": "string", "format": "date-time", "readOnly": true }, "last_confirmed": { "type": "string", "format": "date-time", "readOnly": true }, "status": { "$ref": "#/components/schemas/RuleFindingStatusEnum" }, "device": { "type": "integer" } }, "required": [ "device", "finding_type", "first_detected", "id", "last_confirmed" ] }, "SegmentationPolicy": { "type": "object", "properties": { "id": { "type": "integer", "readOnly": true }, "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "name": { "type": "string", "maxLength": 200 }, "version": { "type": "integer", "readOnly": true }, "status": { "$ref": "#/components/schemas/SegmentationPolicyStatusEnum" }, "description": { "type": "string" }, "created_at": { "type": "string", "format": "date-time", "readOnly": true }, "updated_at": { "type": "string", "format": "date-time", "readOnly": true }, "created_by": { "type": "integer", "nullable": true } }, "required": [ "created_at", "id", "name", "updated_at", "version" ] }, "MatchDomainKindEnum": { "enum": [ "any", "exact", "suffix" ], "type": "string", "description": "* `any` - Any\n* `exact` - Exact\n* `suffix` - Suffix" }, "NatRuleRequest": { "type": "object", "properties": { "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "name": { "type": "string", "minLength": 1, "maxLength": 300 }, "sequence": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648 }, "nat_type": { "$ref": "#/components/schemas/NatTypeEnum" }, "src_zones": {}, "dst_zones": {}, "src_addresses": {}, "dst_addresses": {}, "translated_src": { "type": "string", "maxLength": 300 }, "translated_dst": { "type": "string", "maxLength": 300 }, "translated_port": { "type": "string", "maxLength": 50 }, "enabled": { "type": "boolean" }, "description": { "type": "string" }, "raw_data": {}, "device": { "type": "integer" }, "rule_set": { "type": "integer", "nullable": true } }, "required": [ "device", "name" ] }, "PaginatedFirewallAuditRunList": { "type": "object", "required": [ "count", "results" ], "properties": { "count": { "type": "integer", "example": 123 }, "next": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=4" }, "previous": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=2" }, "results": { "type": "array", "items": { "$ref": "#/components/schemas/FirewallAuditRun" } } } }, "FindingTypeEnum": { "enum": [ "unused", "shadowed", "redundant", "expired", "disabled", "overly_permissive", "unused_object" ], "type": "string", "description": "* `unused` - Unused\n* `shadowed` - Shadowed\n* `redundant` - Redundant\n* `expired` - Expired\n* `disabled` - Disabled\n* `overly_permissive` - Overly Permissive\n* `unused_object` - Unused Object" }, "State589Enum": { "enum": [ "SUBMITTED", "BLOCKED_TOPOLOGY", "PATH_RESOLVED", "DESIGNED", "NO_CHANGE_REQUIRED", "VERIFICATION_FAILED", "VERIFIED", "APPROVED", "REJECTED", "PROVISIONING", "COMPLETED", "ROLLED_BACK", "FAILED" ], "type": "string", "description": "* `SUBMITTED` - Submitted\n* `BLOCKED_TOPOLOGY` - Blocked \u2013 Topology\n* `PATH_RESOLVED` - Path Resolved\n* `DESIGNED` - Designed\n* `NO_CHANGE_REQUIRED` - No Change Required\n* `VERIFICATION_FAILED` - Verification Failed\n* `VERIFIED` - Verified\n* `APPROVED` - Approved\n* `REJECTED` - Rejected\n* `PROVISIONING` - Provisioning\n* `COMPLETED` - Completed\n* `ROLLED_BACK` - Rolled Back\n* `FAILED` - Failed" }, "VerificationResult": { "type": "object", "properties": { "id": { "type": "integer", "readOnly": true }, "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "pep_id": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648 }, "pep_name": { "type": "string", "maxLength": 300 }, "checks": { "description": "[{type, status: PASS|WARN|FAIL, detail}]" }, "overall": { "$ref": "#/components/schemas/OverallEnum" }, "residual_risks": {}, "request": { "type": "integer" } }, "required": [ "id", "overall", "pep_id", "pep_name", "request" ] }, "ExclusionKindEnum": { "enum": [ "signatures", "attack_types", "violations", "bot_names", "skip_all_signatures", "skip_waf" ], "type": "string", "description": "* `signatures` - Specific Signatures\n* `attack_types` - Attack Type(s)\n* `violations` - Violation(s)\n* `bot_names` - Bot Detection Name(s)\n* `skip_all_signatures` - Skip All Signature Checks\n* `skip_waf` - Skip WAF Processing Entirely" }, "PolicyExceptionRequest": { "type": "object", "properties": { "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "justification": { "type": "string", "minLength": 1 }, "expires_at": { "type": "string", "format": "date-time" }, "ticket_ref": { "type": "string", "maxLength": 200 }, "is_active": { "type": "boolean" }, "violation": { "type": "integer" }, "approved_by": { "type": "integer", "nullable": true } }, "required": [ "expires_at", "justification", "violation" ] }, "SegmentationPolicyRequest": { "type": "object", "properties": { "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "name": { "type": "string", "minLength": 1, "maxLength": 200 }, "status": { "$ref": "#/components/schemas/SegmentationPolicyStatusEnum" }, "description": { "type": "string" }, "created_by": { "type": "integer", "nullable": true } }, "required": [ "name" ] }, "FirewallChangeRequestRequest": { "type": "object", "properties": { "change_type": { "$ref": "#/components/schemas/ChangeType5b9Enum" }, "proposed_data": {}, "snow_chg_number": { "type": "string", "maxLength": 50 }, "snow_chg_sys_id": { "type": "string", "maxLength": 100 }, "status": { "$ref": "#/components/schemas/StatusDf8Enum" }, "result": { "type": "string" }, "created_by": { "type": "string", "maxLength": 100 }, "approved_by": { "type": "string", "maxLength": 100 }, "executed_at": { "type": "string", "format": "date-time", "nullable": true }, "device": { "type": "integer" }, "rule": { "type": "integer", "nullable": true }, "snow_instance": { "type": "integer", "nullable": true } }, "required": [ "change_type", "device" ] }, "RuleUsageState": { "type": "object", "properties": { "id": { "type": "integer", "readOnly": true }, "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "rule_uid": { "type": "string", "maxLength": 200 }, "first_seen": { "type": "string", "format": "date-time", "readOnly": true }, "last_hit_at": { "type": "string", "format": "date-time", "nullable": true }, "hits_30d": { "type": "integer", "maximum": 9223372036854775807, "minimum": -9223372036854775808, "format": "int64" }, "hits_90d": { "type": "integer", "maximum": 9223372036854775807, "minimum": -9223372036854775808, "format": "int64" }, "hits_365d": { "type": "integer", "maximum": 9223372036854775807, "minimum": -9223372036854775808, "format": "int64" }, "counter_reset_detected": { "type": "boolean" }, "updated_at": { "type": "string", "format": "date-time", "readOnly": true }, "device": { "type": "integer" } }, "required": [ "device", "first_seen", "id", "rule_uid", "updated_at" ] }, "CertificationStatusEnum": { "enum": [ "never_reviewed", "certified", "due", "overdue", "decertified" ], "type": "string", "description": "* `never_reviewed` - Never Reviewed\n* `certified` - Certified\n* `due` - Due\n* `overdue` - Overdue\n* `decertified` - Decertified" }, "OverallEnum": { "enum": [ "PASS", "WARN", "BLOCK" ], "type": "string", "description": "* `PASS` - Pass\n* `WARN` - Warn\n* `BLOCK` - Block" }, "PatchedFirewallRuleSetRequest": { "type": "object", "properties": { "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "name": { "type": "string", "minLength": 1, "maxLength": 200 }, "rule_type": { "type": "string", "minLength": 1, "maxLength": 50 }, "vsys": { "type": "string", "maxLength": 50 }, "managed_device": { "type": "string", "maxLength": 200 }, "device": { "type": "integer" } } }, "ZonePolicyCell": { "type": "object", "properties": { "id": { "type": "integer", "readOnly": true }, "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "src_zone": { "type": "string", "maxLength": 100 }, "dst_zone": { "type": "string", "maxLength": 100 }, "stance": { "$ref": "#/components/schemas/StanceEnum" }, "allowed_services": {}, "conditions": {}, "policy": { "type": "integer" }, "steward": { "type": "integer", "nullable": true } }, "required": [ "dst_zone", "id", "policy", "src_zone" ] }, "FrameworkEnum": { "enum": [ "pci_dss", "nist_800_53", "dora", "custom" ], "type": "string", "description": "* `pci_dss` - PCI DSS\n* `nist_800_53` - NIST 800-53\n* `dora` - DORA\n* `custom` - Custom" }, "WafRequest": { "type": "object", "properties": { "id": { "type": "integer", "readOnly": true }, "device_name": { "type": "string", "readOnly": true }, "timestamp": { "type": "string", "format": "date-time" }, "source_ip": { "type": "string", "nullable": true }, "uri": { "type": "string" }, "violation_types": {}, "severity": { "type": "string", "maxLength": 20 }, "enforced": { "type": "boolean" }, "country": { "type": "string", "maxLength": 100 }, "created_at": { "type": "string", "format": "date-time", "readOnly": true }, "device": { "type": "integer" }, "virtual_server": { "type": "integer", "nullable": true } }, "required": [ "created_at", "device", "device_name", "id", "timestamp" ] }, "PaginatedComplianceViolationList": { "type": "object", "required": [ "count", "results" ], "properties": { "count": { "type": "integer", "example": 123 }, "next": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=4" }, "previous": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=2" }, "results": { "type": "array", "items": { "$ref": "#/components/schemas/ComplianceViolation" } } } }, "PatchedRuleFindingRequest": { "type": "object", "properties": { "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "rule_uid": { "type": "string", "maxLength": 200 }, "object_uid": { "type": "string", "maxLength": 200 }, "finding_type": { "$ref": "#/components/schemas/FindingTypeEnum" }, "severity": { "$ref": "#/components/schemas/Severity0d8Enum" }, "evidence": {}, "permissiveness_score": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648 }, "analysis_truncated": { "type": "boolean" }, "status": { "$ref": "#/components/schemas/RuleFindingStatusEnum" }, "device": { "type": "integer" } } }, "WafExceptionStatusEnum": { "enum": [ "requested", "pending_approval", "rejected", "applied", "failed", "draft", "approved", "applying", "verify_failed", "cancelled", "expired", "removed", "drift_detected" ], "type": "string", "description": "* `requested` - Requested\n* `pending_approval` - Pending SNOW Approval\n* `rejected` - Rejected\n* `applied` - Applied\n* `failed` - Failed\n* `draft` - Draft\n* `approved` - Approved\n* `applying` - Applying\n* `verify_failed` - Verify Failed\n* `cancelled` - Cancelled\n* `expired` - Expired\n* `removed` - Removed\n* `drift_detected` - Drift Detected" }, "PaginatedRuleMetaList": { "type": "object", "required": [ "count", "results" ], "properties": { "count": { "type": "integer", "example": 123 }, "next": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=4" }, "previous": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=2" }, "results": { "type": "array", "items": { "$ref": "#/components/schemas/RuleMeta" } } } }, "NatRule": { "type": "object", "properties": { "id": { "type": "integer", "readOnly": true }, "device_name": { "type": "string", "readOnly": true }, "rule_set_name": { "type": "string", "readOnly": true }, "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "name": { "type": "string", "maxLength": 300 }, "sequence": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648 }, "nat_type": { "$ref": "#/components/schemas/NatTypeEnum" }, "src_zones": {}, "dst_zones": {}, "src_addresses": {}, "dst_addresses": {}, "translated_src": { "type": "string", "maxLength": 300 }, "translated_dst": { "type": "string", "maxLength": 300 }, "translated_port": { "type": "string", "maxLength": 50 }, "enabled": { "type": "boolean" }, "description": { "type": "string" }, "raw_data": {}, "created_at": { "type": "string", "format": "date-time", "readOnly": true }, "device": { "type": "integer" }, "rule_set": { "type": "integer", "nullable": true } }, "required": [ "created_at", "device", "device_name", "id", "name", "rule_set_name" ] }, "PatchedFirewallRuleRequest": { "type": "object", "properties": { "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "name": { "type": "string", "minLength": 1, "maxLength": 300 }, "sequence": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648 }, "action": { "$ref": "#/components/schemas/FirewallRuleActionEnum" }, "enabled": { "type": "boolean" }, "src_zones": {}, "dst_zones": {}, "src_addresses": {}, "dst_addresses": {}, "services": {}, "applications": {}, "log_setting": { "type": "string", "maxLength": 200 }, "description": { "type": "string" }, "tags": {}, "raw_data": {}, "hit_count": { "type": "integer", "maximum": 2147483647, "minimum": 0 }, "last_hit": { "type": "string", "format": "date-time", "nullable": true }, "rule_set": { "type": "integer" }, "device": { "type": "integer" } } }, "PathComputation": { "type": "object", "properties": { "id": { "type": "integer", "readOnly": true }, "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "traversed_peps": { "description": "[{pep_id, pep_name, ingress_zone, egress_zone, device_vendor}]" }, "computed_at": { "type": "string", "format": "date-time", "readOnly": true }, "topology_snapshot_ref": { "type": "string", "maxLength": 200 }, "complete": { "type": "boolean" }, "block_reason": { "type": "string" }, "request": { "type": "integer" } }, "required": [ "computed_at", "id", "request" ] }, "RuleMetaRequest": { "type": "object", "properties": { "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "business_justification": { "type": "string" }, "ticket_ref": { "type": "string", "maxLength": 200 }, "created_via": { "$ref": "#/components/schemas/CreatedViaEnum" }, "expires_at": { "type": "string", "format": "date-time", "nullable": true }, "suggested_owner_confidence": { "type": "number", "format": "double" }, "rule": { "type": "integer" }, "owner": { "type": "integer", "nullable": true }, "suggested_owner": { "type": "integer", "nullable": true } }, "required": [ "rule" ] }, "PaginatedComplianceControlList": { "type": "object", "required": [ "count", "results" ], "properties": { "count": { "type": "integer", "example": 123 }, "next": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=4" }, "previous": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=2" }, "results": { "type": "array", "items": { "$ref": "#/components/schemas/ComplianceControl" } } } }, "ProvisioningJob": { "type": "object", "properties": { "id": { "type": "integer", "readOnly": true }, "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "state": { "$ref": "#/components/schemas/ProvisioningJobStateEnum" }, "per_pep_status": { "description": "[{pep_id, pep_name, phase, device_txn_id, result, error}]" }, "rollback_plan": {}, "approved_by": { "type": "string", "maxLength": 200 }, "approved_at": { "type": "string", "format": "date-time", "nullable": true }, "started_at": { "type": "string", "format": "date-time", "nullable": true }, "finished_at": { "type": "string", "format": "date-time", "nullable": true }, "error": { "type": "string" }, "request": { "type": "integer" }, "workflow_run": { "type": "integer", "nullable": true } }, "required": [ "id", "request", "state" ] }, "StatusDf8Enum": { "enum": [ "pending_snow", "pending_approval", "approved", "rejected", "executing", "complete", "failed" ], "type": "string", "description": "* `pending_snow` - Creating SNOW CHG\n* `pending_approval` - Awaiting Approval\n* `approved` - Approved\n* `rejected` - Rejected\n* `executing` - Executing\n* `complete` - Complete\n* `failed` - Failed" }, "PaginatedSegmentationPolicyList": { "type": "object", "required": [ "count", "results" ], "properties": { "count": { "type": "integer", "example": 123 }, "next": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=4" }, "previous": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=2" }, "results": { "type": "array", "items": { "$ref": "#/components/schemas/SegmentationPolicy" } } } }, "AccessRequestList": { "type": "object", "properties": { "id": { "type": "integer", "readOnly": true }, "demo": { "type": "boolean", "description": "If True, pipeline runs in demo mode \u2014 no real device API calls are made." }, "state": { "$ref": "#/components/schemas/State589Enum" }, "external_ref": { "type": "string", "description": "ServiceNow CHG number or sys_id", "maxLength": 100 }, "sources_count": { "type": "string", "readOnly": true }, "destinations_count": { "type": "string", "readOnly": true }, "services_count": { "type": "string", "readOnly": true }, "sla_due": { "type": "string", "format": "date-time", "nullable": true }, "created_at": { "type": "string", "format": "date-time", "readOnly": true }, "updated_at": { "type": "string", "format": "date-time", "readOnly": true }, "created_by_name": { "type": "string", "readOnly": true }, "justification": { "type": "string" }, "business_owner": { "type": "string", "maxLength": 200 }, "requested_by": { "type": "string", "maxLength": 200 } }, "required": [ "created_at", "created_by_name", "destinations_count", "id", "justification", "services_count", "sources_count", "updated_at" ] }, "AccessRequestRequest": { "type": "object", "properties": { "demo": { "type": "boolean", "description": "If True, pipeline runs in demo mode \u2014 no real device API calls are made." }, "sources": {}, "destinations": {}, "services": {}, "justification": { "type": "string", "minLength": 1 }, "business_owner": { "type": "string", "maxLength": 200 }, "requested_by": { "type": "string", "maxLength": 200 }, "external_ref": { "type": "string", "description": "ServiceNow CHG number or sys_id", "maxLength": 100 }, "snow_instance": { "type": "integer", "nullable": true }, "sla_due": { "type": "string", "format": "date-time", "nullable": true } }, "required": [ "justification" ] }, "FirewallRuleActionEnum": { "enum": [ "allow", "deny", "drop", "reset", "snat", "dnat" ], "type": "string", "description": "* `allow` - Allow\n* `deny` - Deny\n* `drop` - Drop\n* `reset` - Reset\n* `snat` - SNAT\n* `dnat` - DNAT" }, "RecertReviewEvent": { "type": "object", "properties": { "id": { "type": "integer", "readOnly": true }, "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "transition": { "type": "string", "maxLength": 50 }, "decision": { "type": "string", "maxLength": 50 }, "justification": { "type": "string" }, "findings_snapshot": {}, "created_at": { "type": "string", "format": "date-time", "readOnly": true }, "review": { "type": "integer" }, "actor": { "type": "integer", "nullable": true } }, "required": [ "created_at", "id", "review", "transition" ] }, "AccessRequest": { "type": "object", "properties": { "id": { "type": "integer", "readOnly": true }, "demo": { "type": "boolean", "description": "If True, pipeline runs in demo mode \u2014 no real device API calls are made." }, "state": { "allOf": [ { "$ref": "#/components/schemas/State589Enum" } ], "readOnly": true }, "sources": {}, "destinations": {}, "services": {}, "justification": { "type": "string" }, "business_owner": { "type": "string", "maxLength": 200 }, "requested_by": { "type": "string", "maxLength": 200 }, "external_ref": { "type": "string", "description": "ServiceNow CHG number or sys_id", "maxLength": 100 }, "snow_instance": { "type": "integer", "nullable": true }, "sla_due": { "type": "string", "format": "date-time", "nullable": true }, "created_by": { "type": "integer", "readOnly": true, "nullable": true }, "created_by_name": { "type": "string", "readOnly": true }, "created_at": { "type": "string", "format": "date-time", "readOnly": true }, "updated_at": { "type": "string", "format": "date-time", "readOnly": true }, "path": { "allOf": [ { "$ref": "#/components/schemas/PathComputation" } ], "readOnly": true }, "designs": { "type": "array", "items": { "$ref": "#/components/schemas/ChangeDesign" }, "readOnly": true }, "verifications": { "type": "array", "items": { "$ref": "#/components/schemas/VerificationResult" }, "readOnly": true }, "job": { "allOf": [ { "$ref": "#/components/schemas/ProvisioningJob" } ], "readOnly": true }, "audit_records": { "type": "string", "readOnly": true } }, "required": [ "audit_records", "created_at", "created_by", "created_by_name", "designs", "id", "job", "justification", "path", "state", "updated_at", "verifications" ] }, "ComplianceViolationStatusEnum": { "enum": [ "open", "exception", "resolved" ], "type": "string", "description": "* `open` - Open\n* `exception` - Exception\n* `resolved` - Resolved" }, "CreatedViaEnum": { "enum": [ "versus", "discovered" ], "type": "string", "description": "* `versus` - Versus\n* `discovered` - Discovered" }, "ScopeKindEnum": { "enum": [ "lb", "route", "shared_policy" ], "type": "string", "description": "* `lb` - Load Balancer\n* `route` - Route\n* `shared_policy` - Shared Policy" }, "ComplianceViolation": { "type": "object", "properties": { "id": { "type": "integer", "readOnly": true }, "exceptions": { "type": "array", "items": { "$ref": "#/components/schemas/PolicyException" }, "readOnly": true }, "control_name": { "type": "string", "readOnly": true }, "control_reference": { "type": "string", "readOnly": true }, "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "rule_uid": { "type": "string", "maxLength": 200 }, "src_zone": { "type": "string", "maxLength": 100 }, "dst_zone": { "type": "string", "maxLength": 100 }, "detected_at": { "type": "string", "format": "date-time", "readOnly": true }, "last_seen": { "type": "string", "format": "date-time", "readOnly": true }, "status": { "$ref": "#/components/schemas/ComplianceViolationStatusEnum" }, "evidence": {}, "control": { "type": "integer" }, "device": { "type": "integer", "nullable": true } }, "required": [ "control", "control_name", "control_reference", "detected_at", "exceptions", "id", "last_seen" ] }, "FirewallAuditFinding": { "type": "object", "properties": { "id": { "type": "integer", "readOnly": true }, "rule_name_resolved": { "type": "string", "readOnly": true }, "requirement": { "type": "string", "maxLength": 100 }, "severity": { "$ref": "#/components/schemas/Severity0d8Enum" }, "check_name": { "type": "string", "maxLength": 200 }, "rule_name": { "type": "string", "maxLength": 300 }, "description": { "type": "string" }, "remediation": { "type": "string" }, "audit_run": { "type": "integer" }, "rule_ref": { "type": "integer", "nullable": true } }, "required": [ "audit_run", "check_name", "description", "id", "requirement", "rule_name_resolved", "severity" ] }, "ZonePolicyCellRequest": { "type": "object", "properties": { "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "src_zone": { "type": "string", "minLength": 1, "maxLength": 100 }, "dst_zone": { "type": "string", "minLength": 1, "maxLength": 100 }, "stance": { "$ref": "#/components/schemas/StanceEnum" }, "allowed_services": {}, "conditions": {}, "policy": { "type": "integer" }, "steward": { "type": "integer", "nullable": true } }, "required": [ "dst_zone", "policy", "src_zone" ] }, "ChangeDesign": { "type": "object", "properties": { "id": { "type": "integer", "readOnly": true }, "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "pep_id": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648 }, "pep_name": { "type": "string", "maxLength": 300 }, "outcome": { "$ref": "#/components/schemas/OutcomeEnum" }, "candidate_rule": {}, "covered_by_rule_id": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648, "nullable": true }, "covered_by_rule_name": { "type": "string", "maxLength": 300 }, "designed_at": { "type": "string", "format": "date-time", "readOnly": true }, "request": { "type": "integer" } }, "required": [ "designed_at", "id", "outcome", "pep_id", "pep_name", "request" ] }, "PaginatedZonePolicyCellList": { "type": "object", "required": [ "count", "results" ], "properties": { "count": { "type": "integer", "example": 123 }, "next": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=4" }, "previous": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=2" }, "results": { "type": "array", "items": { "$ref": "#/components/schemas/ZonePolicyCell" } } } }, "ComplianceControl": { "type": "object", "properties": { "id": { "type": "integer", "readOnly": true }, "violation_count": { "type": "string", "readOnly": true }, "open_violation_count": { "type": "string", "readOnly": true }, "control_id": { "type": "string", "maxLength": 100 }, "framework": { "$ref": "#/components/schemas/FrameworkEnum" }, "reference": { "type": "string", "maxLength": 200 }, "name": { "type": "string", "maxLength": 300 }, "description": { "type": "string" }, "check_type": { "$ref": "#/components/schemas/CheckTypeEnum" }, "predicate": {}, "severity": { "$ref": "#/components/schemas/Severity0d8Enum" }, "remediation_hint": { "type": "string" }, "enabled": { "type": "boolean" }, "is_builtin": { "type": "boolean" } }, "required": [ "check_type", "control_id", "framework", "id", "name", "open_violation_count", "reference", "violation_count" ] }, "PaginatedRuleUsageStateList": { "type": "object", "required": [ "count", "results" ], "properties": { "count": { "type": "integer", "example": 123 }, "next": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=4" }, "previous": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=2" }, "results": { "type": "array", "items": { "$ref": "#/components/schemas/RuleUsageState" } } } }, "SegmentationPolicyStatusEnum": { "enum": [ "draft", "active", "archived" ], "type": "string", "description": "* `draft` - Draft\n* `active` - Active\n* `archived` - Archived" }, "WafException": { "type": "object", "properties": { "id": { "type": "integer", "readOnly": true }, "virtual_server": { "type": "integer" }, "virtual_server_name": { "type": "string", "readOnly": true }, "waf_policy_name": { "type": "string", "readOnly": true }, "match_type": { "$ref": "#/components/schemas/MatchTypeEnum" }, "match_value": { "type": "string", "default": "" }, "reason": { "type": "string" }, "status": { "allOf": [ { "$ref": "#/components/schemas/WafExceptionStatusEnum" } ], "readOnly": true }, "error": { "type": "string", "readOnly": true }, "requested_by": { "type": "string", "maxLength": 150 }, "created_at": { "type": "string", "format": "date-time", "readOnly": true }, "applied_at": { "type": "string", "format": "date-time", "readOnly": true, "nullable": true }, "snow_change_number": { "type": "string", "readOnly": true }, "scope_kind": { "$ref": "#/components/schemas/ScopeKindEnum" }, "route_ref": { "type": "string", "maxLength": 200 }, "rule_name": { "type": "string", "maxLength": 200 }, "match_domain_kind": { "$ref": "#/components/schemas/MatchDomainKindEnum" }, "match_domain": { "type": "string", "maxLength": 300 }, "match_path_kind": { "$ref": "#/components/schemas/MatchPathKindEnum" }, "match_path": { "type": "string", "maxLength": 500 }, "match_methods": {}, "exclusion_kind": { "$ref": "#/components/schemas/ExclusionKindEnum" }, "signatures": {}, "attack_types": {}, "violations": {}, "bot_names": {}, "source_kind": { "$ref": "#/components/schemas/SourceKindEnum" }, "source_event": { "readOnly": true }, "risk_tier": { "allOf": [ { "$ref": "#/components/schemas/RiskTierEnum" } ], "readOnly": true }, "expires_at": { "type": "string", "format": "date-time", "nullable": true }, "placement": { "type": "string", "maxLength": 100 }, "applied_rule_json": { "readOnly": true }, "hit_stats": { "readOnly": true } }, "required": [ "applied_at", "applied_rule_json", "created_at", "error", "exclusion_kind", "hit_stats", "id", "reason", "risk_tier", "snow_change_number", "source_event", "status", "virtual_server", "virtual_server_name", "waf_policy_name" ] }, "SourceKindEnum": { "enum": [ "manual", "security_event" ], "type": "string", "description": "* `manual` - Manual\n* `security_event` - Security Event" }, "CheckTypeEnum": { "enum": [ "rule_predicate", "zone_matrix", "device_config", "process" ], "type": "string", "description": "* `rule_predicate` - Rule Predicate\n* `zone_matrix` - Zone Matrix\n* `device_config` - Device Config\n* `process` - Process" }, "FirewallObjectRequest": { "type": "object", "properties": { "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "vsys": { "type": "string", "maxLength": 50 }, "object_type": { "$ref": "#/components/schemas/FirewallObjectObjectTypeEnum" }, "name": { "type": "string", "minLength": 1, "maxLength": 300 }, "value": { "type": "string" }, "members": {}, "description": { "type": "string" }, "tags": {}, "raw_data": {}, "device": { "type": "integer" } }, "required": [ "device", "name", "object_type", "vsys" ] }, "PaginatedRuleFindingList": { "type": "object", "required": [ "count", "results" ], "properties": { "count": { "type": "integer", "example": 123 }, "next": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=4" }, "previous": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=2" }, "results": { "type": "array", "items": { "$ref": "#/components/schemas/RuleFinding" } } } }, "ProvisioningJobStateEnum": { "enum": [ "DESIGNED", "VERIFIED", "APPROVED", "PROVISIONING", "COMMITTING", "REALIZING", "COMPLETED", "FAILED", "ROLLING_BACK", "ROLLED_BACK" ], "type": "string", "description": "* `DESIGNED` - Designed\n* `VERIFIED` - Verified\n* `APPROVED` - Approved\n* `PROVISIONING` - Provisioning\n* `COMMITTING` - Committing\n* `REALIZING` - Realizing\n* `COMPLETED` - Completed\n* `FAILED` - Failed\n* `ROLLING_BACK` - Rolling Back\n* `ROLLED_BACK` - Rolled Back" }, "WafRequestRequest": { "type": "object", "properties": { "timestamp": { "type": "string", "format": "date-time" }, "source_ip": { "type": "string", "nullable": true, "minLength": 1 }, "uri": { "type": "string" }, "violation_types": {}, "severity": { "type": "string", "minLength": 1, "maxLength": 20 }, "enforced": { "type": "boolean" }, "country": { "type": "string", "maxLength": 100 }, "device": { "type": "integer" }, "virtual_server": { "type": "integer", "nullable": true } }, "required": [ "device", "timestamp" ] }, "WafExceptionRequest": { "type": "object", "properties": { "virtual_server": { "type": "integer" }, "match_type": { "$ref": "#/components/schemas/MatchTypeEnum" }, "match_value": { "type": "string", "default": "" }, "reason": { "type": "string", "minLength": 1 }, "requested_by": { "type": "string", "maxLength": 150 }, "scope_kind": { "$ref": "#/components/schemas/ScopeKindEnum" }, "route_ref": { "type": "string", "maxLength": 200 }, "rule_name": { "type": "string", "maxLength": 200 }, "match_domain_kind": { "$ref": "#/components/schemas/MatchDomainKindEnum" }, "match_domain": { "type": "string", "maxLength": 300 }, "match_path_kind": { "$ref": "#/components/schemas/MatchPathKindEnum" }, "match_path": { "type": "string", "maxLength": 500 }, "match_methods": {}, "exclusion_kind": { "$ref": "#/components/schemas/ExclusionKindEnum" }, "signatures": {}, "attack_types": {}, "violations": {}, "bot_names": {}, "source_kind": { "$ref": "#/components/schemas/SourceKindEnum" }, "expires_at": { "type": "string", "format": "date-time", "nullable": true }, "placement": { "type": "string", "minLength": 1, "maxLength": 100 }, "acknowledge_shadowing": { "type": "boolean", "writeOnly": true, "default": false } }, "required": [ "exclusion_kind", "reason", "virtual_server" ] }, "PaginatedWafExceptionList": { "type": "object", "required": [ "count", "results" ], "properties": { "count": { "type": "integer", "example": 123 }, "next": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=4" }, "previous": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=2" }, "results": { "type": "array", "items": { "$ref": "#/components/schemas/WafException" } } } }, "PatchedWafRequestRequest": { "type": "object", "properties": { "timestamp": { "type": "string", "format": "date-time" }, "source_ip": { "type": "string", "nullable": true, "minLength": 1 }, "uri": { "type": "string" }, "violation_types": {}, "severity": { "type": "string", "minLength": 1, "maxLength": 20 }, "enforced": { "type": "boolean" }, "country": { "type": "string", "maxLength": 100 }, "device": { "type": "integer" }, "virtual_server": { "type": "integer", "nullable": true } } }, "FirewallObject": { "type": "object", "properties": { "id": { "type": "integer", "readOnly": true }, "device_name": { "type": "string", "readOnly": true }, "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "vsys": { "type": "string", "maxLength": 50 }, "object_type": { "$ref": "#/components/schemas/FirewallObjectObjectTypeEnum" }, "name": { "type": "string", "maxLength": 300 }, "value": { "type": "string" }, "members": {}, "description": { "type": "string" }, "tags": {}, "raw_data": {}, "created_at": { "type": "string", "format": "date-time", "readOnly": true }, "device": { "type": "integer" } }, "required": [ "created_at", "device", "device_name", "id", "name", "object_type", "vsys" ] }, "FirewallObjectObjectTypeEnum": { "enum": [ "address", "address_group", "service", "service_group", "application", "tag", "external_dyn" ], "type": "string", "description": "* `address` - Address\n* `address_group` - Address Group\n* `service` - Service\n* `service_group` - Service Group\n* `application` - Application\n* `tag` - Tag\n* `external_dyn` - External Dynamic List" }, "AuditTypeEnum": { "enum": [ "pci_dss_v4" ], "type": "string", "description": "* `pci_dss_v4` - PCI DSS v4.0" }, "PolicyException": { "type": "object", "properties": { "id": { "type": "integer", "readOnly": true }, "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "justification": { "type": "string" }, "expires_at": { "type": "string", "format": "date-time" }, "ticket_ref": { "type": "string", "maxLength": 200 }, "created_at": { "type": "string", "format": "date-time", "readOnly": true }, "is_active": { "type": "boolean" }, "violation": { "type": "integer" }, "approved_by": { "type": "integer", "nullable": true } }, "required": [ "created_at", "expires_at", "id", "justification", "violation" ] }, "RecertReviewTriggerEnum": { "enum": [ "scheduled", "usage_based", "compliance", "manual" ], "type": "string", "description": "* `scheduled` - Scheduled\n* `usage_based` - Usage Based\n* `compliance` - Compliance Violation\n* `manual` - Manual" }, "PatchedComplianceViolationRequest": { "type": "object", "properties": { "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "rule_uid": { "type": "string", "maxLength": 200 }, "src_zone": { "type": "string", "maxLength": 100 }, "dst_zone": { "type": "string", "maxLength": 100 }, "status": { "$ref": "#/components/schemas/ComplianceViolationStatusEnum" }, "evidence": {}, "control": { "type": "integer" }, "device": { "type": "integer", "nullable": true } } }, "PatchedZonePolicyCellRequest": { "type": "object", "properties": { "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "src_zone": { "type": "string", "minLength": 1, "maxLength": 100 }, "dst_zone": { "type": "string", "minLength": 1, "maxLength": 100 }, "stance": { "$ref": "#/components/schemas/StanceEnum" }, "allowed_services": {}, "conditions": {}, "policy": { "type": "integer" }, "steward": { "type": "integer", "nullable": true } } }, "MatchPathKindEnum": { "enum": [ "any", "exact", "prefix", "regex" ], "type": "string", "description": "* `any` - Any\n* `exact` - Exact\n* `prefix` - Prefix\n* `regex` - Regex" }, "PaginatedFirewallObjectList": { "type": "object", "required": [ "count", "results" ], "properties": { "count": { "type": "integer", "example": 123 }, "next": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=4" }, "previous": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=2" }, "results": { "type": "array", "items": { "$ref": "#/components/schemas/FirewallObject" } } } }, "RecertReviewStatusEnum": { "enum": [ "open", "assigned", "certified", "modify_requested", "decertified", "closed" ], "type": "string", "description": "* `open` - Open\n* `assigned` - Assigned\n* `certified` - Certified\n* `modify_requested` - Modify Requested\n* `decertified` - Decertified\n* `closed` - Closed" }, "FirewallRule": { "type": "object", "properties": { "id": { "type": "integer", "readOnly": true }, "device_name": { "type": "string", "readOnly": true }, "rule_set_name": { "type": "string", "readOnly": true }, "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "name": { "type": "string", "maxLength": 300 }, "sequence": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648 }, "action": { "$ref": "#/components/schemas/FirewallRuleActionEnum" }, "enabled": { "type": "boolean" }, "src_zones": {}, "dst_zones": {}, "src_addresses": {}, "dst_addresses": {}, "services": {}, "applications": {}, "log_setting": { "type": "string", "maxLength": 200 }, "description": { "type": "string" }, "tags": {}, "raw_data": {}, "created_at": { "type": "string", "format": "date-time", "readOnly": true }, "hit_count": { "type": "integer", "maximum": 2147483647, "minimum": 0 }, "last_hit": { "type": "string", "format": "date-time", "nullable": true }, "rule_set": { "type": "integer" }, "device": { "type": "integer" } }, "required": [ "created_at", "device", "device_name", "id", "name", "rule_set", "rule_set_name" ] }, "FirewallRuleSet": { "type": "object", "properties": { "id": { "type": "integer", "readOnly": true }, "device_name": { "type": "string", "readOnly": true }, "rule_count": { "type": "string", "readOnly": true }, "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "name": { "type": "string", "maxLength": 200 }, "rule_type": { "type": "string", "maxLength": 50 }, "vsys": { "type": "string", "maxLength": 50 }, "managed_device": { "type": "string", "maxLength": 200 }, "created_at": { "type": "string", "format": "date-time", "readOnly": true }, "device": { "type": "integer" } }, "required": [ "created_at", "device", "device_name", "id", "name", "rule_count", "vsys" ] }, "PatchedSegmentationPolicyRequest": { "type": "object", "properties": { "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "name": { "type": "string", "minLength": 1, "maxLength": 200 }, "status": { "$ref": "#/components/schemas/SegmentationPolicyStatusEnum" }, "description": { "type": "string" }, "created_by": { "type": "integer", "nullable": true } } }, "PatchedNatRuleRequest": { "type": "object", "properties": { "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "name": { "type": "string", "minLength": 1, "maxLength": 300 }, "sequence": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648 }, "nat_type": { "$ref": "#/components/schemas/NatTypeEnum" }, "src_zones": {}, "dst_zones": {}, "src_addresses": {}, "dst_addresses": {}, "translated_src": { "type": "string", "maxLength": 300 }, "translated_dst": { "type": "string", "maxLength": 300 }, "translated_port": { "type": "string", "maxLength": 50 }, "enabled": { "type": "boolean" }, "description": { "type": "string" }, "raw_data": {}, "device": { "type": "integer" }, "rule_set": { "type": "integer", "nullable": true } } }, "PatchedFirewallObjectRequest": { "type": "object", "properties": { "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "vsys": { "type": "string", "maxLength": 50 }, "object_type": { "$ref": "#/components/schemas/FirewallObjectObjectTypeEnum" }, "name": { "type": "string", "minLength": 1, "maxLength": 300 }, "value": { "type": "string" }, "members": {}, "description": { "type": "string" }, "tags": {}, "raw_data": {}, "device": { "type": "integer" } } }, "PatchedPolicyExceptionRequest": { "type": "object", "properties": { "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "justification": { "type": "string", "minLength": 1 }, "expires_at": { "type": "string", "format": "date-time" }, "ticket_ref": { "type": "string", "maxLength": 200 }, "is_active": { "type": "boolean" }, "violation": { "type": "integer" }, "approved_by": { "type": "integer", "nullable": true } } }, "PaginatedWafRequestList": { "type": "object", "required": [ "count", "results" ], "properties": { "count": { "type": "integer", "example": 123 }, "next": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=4" }, "previous": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=2" }, "results": { "type": "array", "items": { "$ref": "#/components/schemas/WafRequest" } } } }, "RuleFindingStatusEnum": { "enum": [ "open", "acknowledged", "resolved", "suppressed" ], "type": "string", "description": "* `open` - Open\n* `acknowledged` - Acknowledged\n* `resolved` - Resolved\n* `suppressed` - Suppressed" }, "PatchedAccessRequestRequest": { "type": "object", "properties": { "demo": { "type": "boolean", "description": "If True, pipeline runs in demo mode \u2014 no real device API calls are made." }, "sources": {}, "destinations": {}, "services": {}, "justification": { "type": "string", "minLength": 1 }, "business_owner": { "type": "string", "maxLength": 200 }, "requested_by": { "type": "string", "maxLength": 200 }, "external_ref": { "type": "string", "description": "ServiceNow CHG number or sys_id", "maxLength": 100 }, "snow_instance": { "type": "integer", "nullable": true }, "sla_due": { "type": "string", "format": "date-time", "nullable": true } } }, "RuleMeta": { "type": "object", "properties": { "id": { "type": "integer", "readOnly": true }, "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "business_justification": { "type": "string" }, "ticket_ref": { "type": "string", "maxLength": 200 }, "created_via": { "$ref": "#/components/schemas/CreatedViaEnum" }, "expires_at": { "type": "string", "format": "date-time", "nullable": true }, "last_certified_at": { "type": "string", "format": "date-time", "readOnly": true, "nullable": true }, "certification_status": { "allOf": [ { "$ref": "#/components/schemas/CertificationStatusEnum" } ], "readOnly": true }, "suggested_owner_confidence": { "type": "number", "format": "double" }, "rule": { "type": "integer" }, "owner": { "type": "integer", "nullable": true }, "last_certified_by": { "type": "integer", "readOnly": true, "nullable": true }, "suggested_owner": { "type": "integer", "nullable": true } }, "required": [ "certification_status", "id", "last_certified_at", "last_certified_by", "rule" ] }, "OutcomeEnum": { "enum": [ "ALREADY_PERMITTED", "NEW_RULE", "MODIFY_OBJECT", "NO_ACTION" ], "type": "string", "description": "* `ALREADY_PERMITTED` - Already Permitted\n* `NEW_RULE` - New Rule\n* `MODIFY_OBJECT` - Modify Object\n* `NO_ACTION` - No Action" }, "StanceEnum": { "enum": [ "allow_all", "deny_all", "restricted" ], "type": "string", "description": "* `allow_all` - Allow All\n* `deny_all` - Deny All\n* `restricted` - Restricted" } } } }