RoleManagementPolicy.json

{
  "swagger": "2.0",
  "info": {
    "title": "AuthorizationManagementClient",
    "version": "2020-10-01-preview",
    "description": "Role based access control provides you a way to apply granular level policy administration down to individual resources or resource groups. These operations enable you to manage role assignments. A role assignment grants access to Azure Active Directory users."
  },
  "host": "management.azure.com",
  "schemes": [
    "https"
  ],
  "consumes": [
    "application/json"
  ],
  "produces": [
    "application/json"
  ],
  "security": [
    {
      "azure_auth": [
        "user_impersonation"
      ]
    }
  ],
  "securityDefinitions": {
    "azure_auth": {
      "type": "oauth2",
      "authorizationUrl": "https://login.microsoftonline.com/common/oauth2/authorize",
      "flow": "implicit",
      "description": "Azure Active Directory OAuth2 Flow",
      "scopes": {
        "user_impersonation": "impersonate your user account"
      }
    }
  },
  "paths": {
    "/{scope}/providers/Microsoft.Authorization/roleManagementPolicies/{roleManagementPolicyName}": {
      "get": {
        "tags": [
          "roleManagementPolicies"
        ],
        "operationId": "RoleManagementPolicies_Get",
        "description": "Get the specified role management policy for a resource scope",
        "parameters": [
          {
            "name": "scope",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The scope of the role management policy.",
            "x-ms-skip-url-encoding": true
          },
          {
            "name": "roleManagementPolicyName",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name (guid) of the role management policy to get."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "OK - Returns information about the role management policy.",
            "schema": {
              "$ref": "#/definitions/RoleManagementPolicy"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "x-ms-examples": {
          "GetRoleManagementPolicyByName": {
            "$ref": "./examples/GetRoleManagementPolicyByName.json"
          }
        }
      },
      "patch": {
        "tags": [
          "roleManagementPolicies"
        ],
        "operationId": "RoleManagementPolicies_Update",
        "description": "Update a role management policy",
        "parameters": [
          {
            "name": "scope",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The scope of the role management policy to upsert.",
            "x-ms-skip-url-encoding": true
          },
          {
            "name": "roleManagementPolicyName",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name (guid) of the role management policy to upsert."
          },
          {
            "name": "parameters",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/RoleManagementPolicy"
            },
            "description": "Parameters for the role management policy."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "Ok - Returns the updated policy.",
            "schema": {
              "$ref": "#/definitions/RoleManagementPolicy"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "x-ms-examples": {
          "PatchRoleManagementPolicy": {
            "$ref": "./examples/PatchRoleManagementPolicy.json"
          },
          "PatchPartialRoleManagementPolicy": {
            "$ref": "./examples/PatchPartialRoleManagementPolicy.json"
          }
        }
      },
      "delete": {
        "tags": [
          "roleManagementPolicies"
        ],
        "operationId": "RoleManagementPolicies_Delete",
        "description": "Delete a role management policy",
        "parameters": [
          {
            "name": "scope",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The scope of the role management policy to upsert.",
            "x-ms-skip-url-encoding": true
          },
          {
            "name": "roleManagementPolicyName",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name (guid) of the role management policy to upsert."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "OK - Successfully deleted the policy."
          },
          "204": {
            "description": "NoContent - policy does not exists."
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "x-ms-examples": {
          "DeleteRoleManagementPolicy": {
            "$ref": "./examples/DeleteRoleManagementPolicy.json"
          }
        }
      }
    },
    "/{scope}/providers/Microsoft.Authorization/roleManagementPolicies": {
      "get": {
        "tags": [
          "roleManagementPolicies"
        ],
        "operationId": "RoleManagementPolicies_ListForScope",
        "description": "Gets role management policies for a resource scope.",
        "parameters": [
          {
            "name": "scope",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The scope of the role management policy.",
            "x-ms-skip-url-encoding": true
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "OK - Returns an array of role management policies.",
            "schema": {
              "$ref": "#/definitions/RoleManagementPolicyListResult"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        },
        "x-ms-examples": {
          "GetRoleManagementPolicyByRoleDefinitionFilter": {
            "$ref": "./examples/GetRoleManagementPolicyByScope.json"
          }
        }
      }
    }
  },
  "definitions": {
    "RoleManagementPolicyProperties": {
      "properties": {
        "scope": {
          "type": "string",
          "description": "The role management policy scope."
        },
        "displayName": {
          "type": "string",
          "description": "The role management policy display name."
        },
        "description": {
          "type": "string",
          "description": "The role management policy description."
        },
        "isOrganizationDefault": {
          "type": "boolean",
          "description": "The role management policy is default policy."
        },
        "lastModifiedBy": {
          "$ref": "#/definitions/Principal"
        },
        "lastModifiedDateTime": {
          "type": "string",
          "readOnly": true,
          "format": "date-time",
          "description": "The last modified date time."
        },
        "rules": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/RoleManagementPolicyRule"
          },
          "description": "The rule applied to the policy."
        },
        "effectiveRules": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/RoleManagementPolicyRule"
          },
          "readOnly": true,
          "description": "The readonly computed rule applied to the policy."
        },
        "policyProperties": {
          "readOnly": true,
          "type": "object",
          "description": "Additional properties of scope",
          "$ref": "#/definitions/PolicyProperties"
        }
      },
      "description": "Role management policy properties with scope."
    },
    "RoleManagementPolicy": {
      "properties": {
        "id": {
          "type": "string",
          "readOnly": true,
          "description": "The role management policy Id."
        },
        "name": {
          "type": "string",
          "readOnly": true,
          "description": "The role management policy name."
        },
        "type": {
          "type": "string",
          "readOnly": true,
          "description": "The role management policy type."
        },
        "properties": {
          "x-ms-client-flatten": true,
          "$ref": "#/definitions/RoleManagementPolicyProperties",
          "description": "Role management policy properties."
        }
      },
      "description": "Role management policy"
    },
    "RoleManagementPolicyListResult": {
      "properties": {
        "value": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/RoleManagementPolicy"
          },
          "description": "Role management policy list."
        },
        "nextLink": {
          "type": "string",
          "description": "The URL to use for getting the next set of results."
        }
      },
      "description": "Role management policy list operation result."
    },
    "RoleManagementPolicyRule": {
      "description": "The role management policy rule.",
      "type": "object",
      "required": [
        "ruleType"
      ],
      "discriminator": "ruleType",
      "properties": {
        "id": {
          "type": "string",
          "description": "The id of the rule."
        },
        "ruleType": {
          "description": "The type of rule",
          "$ref": "#/definitions/RoleManagementPolicyRuleType"
        },
        "target": {
          "$ref": "#/definitions/RoleManagementPolicyRuleTarget",
          "description": "The target of the current rule."
        }
      }
    },
    "RoleManagementPolicyApprovalRule": {
      "description": "The role management policy rule.",
      "allOf": [
        {
          "$ref": "#/definitions/RoleManagementPolicyRule"
        }
      ],
      "type": "object",
      "properties": {
        "setting": {
          "$ref": "#/definitions/ApprovalSettings",
          "description": "The approval setting"
        }
      }
    },
    "ApprovalSettings": {
      "description": "The approval settings.",
      "type": "object",
      "properties": {
        "isApprovalRequired": {
          "type": "boolean",
          "description": "Determine whether approval is required or not."
        },
        "isApprovalRequiredForExtension": {
          "type": "boolean",
          "description": "Determine whether approval is required for assignment extension."
        },
        "isRequestorJustificationRequired": {
          "type": "boolean",
          "description": "Determine whether requestor justification required."
        },
        "approvalMode": {
          "type": "string",
          "description": "The type of rule",
          "enum": [
            "SingleStage",
            "Serial",
            "Parallel",
            "NoApproval"
          ],
          "x-ms-enum": {
            "name": "ApprovalMode",
            "modelAsString": true
          }
        },
        "approvalStages": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/ApprovalStage"
          },
          "description": "The approval stages of the request."
        }
      }
    },
    "ApprovalStage": {
      "description": "The approval stage.",
      "type": "object",
      "properties": {
        "approvalStageTimeOutInDays": {
          "type": "integer",
          "format": "int32",
          "description": "The time in days when approval request would be timed out."
        },
        "isApproverJustificationRequired": {
          "type": "boolean",
          "description": "Determine whether approver need to provide justification for his decision."
        },
        "escalationTimeInMinutes": {
          "type": "integer",
          "format": "int32",
          "description": "The time in minutes when the approval request would be escalated if the primary approver does not approves."
        },
        "primaryApprovers": {
          "type": "array",
          "description": "The primary approver of the request.",
          "items": {
            "$ref": "#/definitions/UserSet"
          }
        },
        "isEscalationEnabled": {
          "type": "boolean",
          "description": "The value determine whether escalation feature is enabled."
        },
        "escalationApprovers": {
          "type": "array",
          "description": "The escalation approver of the request.",
          "items": {
            "$ref": "#/definitions/UserSet"
          }
        }
      }
    },
    "UserSet": {
      "description": "The detail of a user.",
      "type": "object",
      "properties": {
        "userType": {
          "type": "string",
          "description": "The type of user.",
          "enum": [
            "User",
            "Group"
          ],
          "x-ms-enum": {
            "name": "UserType",
            "modelAsString": true
          }
        },
        "isBackup": {
          "type": "boolean",
          "description": "The value indicating whether the user is a backup fallback approver"
        },
        "id": {
          "type": "string",
          "description": "The object id of the user."
        },
        "description": {
          "type": "string",
          "description": "The description of the user."
        }
      }
    },
    "RoleManagementPolicyAuthenticationContextRule": {
      "description": "The role management policy rule.",
      "allOf": [
        {
          "$ref": "#/definitions/RoleManagementPolicyRule"
        }
      ],
      "type": "object",
      "properties": {
        "isEnabled": {
          "type": "boolean",
          "description": "The value indicating if rule is enabled."
        },
        "claimValue": {
          "type": "string",
          "description": "The claim value."
        }
      }
    },
    "RoleManagementPolicyEnablementRule": {
      "description": "The role management policy rule.",
      "allOf": [
        {
          "$ref": "#/definitions/RoleManagementPolicyRule"
        }
      ],
      "type": "object",
      "properties": {
        "enabledRules": {
          "type": "array",
          "items": {
            "type": "string",
            "description": "The type of enable rules",
            "enum": [
              "MultiFactorAuthentication",
              "Justification",
              "Ticketing"
            ],
            "x-ms-enum": {
              "name": "EnablementRules",
              "modelAsString": true
            }
          },
          "description": "The list of enabled rules."
        }
      }
    },
    "RoleManagementPolicyExpirationRule": {
      "description": "The role management policy rule.",
      "allOf": [
        {
          "$ref": "#/definitions/RoleManagementPolicyRule"
        }
      ],
      "type": "object",
      "properties": {
        "isExpirationRequired": {
          "type": "boolean",
          "description": "The value indicating whether expiration is required."
        },
        "maximumDuration": {
          "type": "string",
          "description": "The maximum duration of expiration in timespan."
        }
      }
    },
    "RoleManagementPolicyNotificationRule": {
      "description": "The role management policy rule.",
      "allOf": [
        {
          "$ref": "#/definitions/RoleManagementPolicyRule"
        }
      ],
      "type": "object",
      "properties": {
        "notificationType": {
          "type": "string",
          "description": "The type of notification.",
          "enum": [
            "Email"
          ],
          "x-ms-enum": {
            "name": "NotificationDeliveryMechanism",
            "modelAsString": true
          }
        },
        "notificationLevel": {
          "type": "string",
          "description": "The notification level.",
          "enum": [
            "None",
            "Critical",
            "All"
          ],
          "x-ms-enum": {
            "name": "NotificationLevel",
            "modelAsString": true
          }
        },
        "recipientType": {
          "type": "string",
          "description": "The recipient type.",
          "enum": [
            "Requestor",
            "Approver",
            "Admin"
          ],
          "x-ms-enum": {
            "name": "RecipientType",
            "modelAsString": true
          }
        },
        "notificationRecipients": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "The list notification recipients."
        },
        "isDefaultRecipientsEnabled": {
          "type": "boolean",
          "description": "Its value determine if the notification need to be sent to the recipient type specified in policy rule."
        }
      }
    },
    "RoleManagementPolicyRuleTarget": {
      "description": "The role management policy rule target.",
      "type": "object",
      "properties": {
        "caller": {
          "type": "string",
          "description": "The caller of the setting."
        },
        "operations": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "The type of operation."
        },
        "level": {
          "type": "string",
          "description": "The assignment level to which it is applied."
        },
        "targetObjects": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "The list of target objects."
        },
        "inheritableSettings": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "The list of inheritable settings."
        },
        "enforcedSettings": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "The list of enforced settings."
        }
      }
    },
    "RoleManagementPolicyRuleType": {
      "type": "string",
      "description": "The type of rule",
      "enum": [
        "RoleManagementPolicyApprovalRule",
        "RoleManagementPolicyAuthenticationContextRule",
        "RoleManagementPolicyEnablementRule",
        "RoleManagementPolicyExpirationRule",
        "RoleManagementPolicyNotificationRule"
      ],
      "x-ms-enum": {
        "name": "RoleManagementPolicyRuleType",
        "modelAsString": true
      }
    },
    "PolicyProperties": {
      "properties": {
        "scope": {
          "type": "object",
          "description": "Details of the resource scope",
          "readOnly": true,
          "properties": {
            "id": {
              "type": "string",
              "description": "Scope id of the resource"
            },
            "displayName": {
              "type": "string",
              "description": "Display name of the resource"
            },
            "type": {
              "type": "string",
              "description": "Type of the resource"
            }
          }
        }
      }
    },
    "Principal": {
      "readOnly": true,
      "type": "object",
      "description": "The name of the entity last modified it",
      "properties": {
        "id": {
          "type": "string",
          "description": "The id of the principal made changes"
        },
        "displayName": {
          "type": "string",
          "description": "The name of the principal made changes"
        },
        "type": {
          "type": "string",
          "description": "Type of principal such as user , group etc"
        },
        "email": {
          "type": "string",
          "description": "Email of principal"
        }
      }
    },
    "CloudError": {
      "x-ms-external": true,
      "properties": {
        "error": {
          "$ref": "#/definitions/CloudErrorBody"
        }
      },
      "description": "An error response from the service."
    },
    "CloudErrorBody": {
      "x-ms-external": true,
      "properties": {
        "code": {
          "type": "string",
          "description": "An identifier for the error. Codes are invariant and are intended to be consumed programmatically."
        },
        "message": {
          "type": "string",
          "description": "A message describing the error, intended to be suitable for display in a user interface."
        }
      },
      "description": "An error response from the service."
    }
  },
  "parameters": {
    "ApiVersionParameter": {
      "name": "api-version",
      "in": "query",
      "required": true,
      "type": "string",
      "description": "The API version to use for this operation."
    }
  }
}