---
url: "https://dev.developer-internal.sanofi.com/apis/plta-permissions-api-cbz/versions/88cdfef8-3b56-44ca-883d-5b15378e5a3a"
---

OpenAPI specification document.

```json
{"components":{"responses":{"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/BadRequestError"}}},"description":"Bad Request"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}},"description":"Unauthorized"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}},"description":"Forbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}},"description":"Not Found"},"409":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConflictError"}}},"description":"Conflict"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/InternalServerError"}}},"description":"Internal Server Error"},"503":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ServiceUnavailableError"}}},"description":"Service Unavailable","headers":{"retry-after":{"description":"Indicates how long the client should wait before making a follow-up request, in seconds","schema":{"example":60,"type":"integer"}}}}},"schemas":{"AccessGrant":{"description":"An access right (an action/resource pair) attached to a role. Every member of the role inherits it. The action and resource must be within the role's declared scope.","properties":{"accessGrantId":{"description":"The unique identifier of the access grant, mostly for deletion purpose.","format":"uuid","readOnly":true,"type":"string"},"actionName":{"description":"Name of the action.","examples":["read_narrative"],"type":"string"},"resourceName":{"description":"Name of the resource.","examples":["compound_1245"],"type":"string"},"roleName":{"description":"The name of the role this grant is attached to, as given in the path.","readOnly":true,"type":"string"}},"required":["actionName","resourceName"],"type":"object"},"AccessRight":{"description":"the combinaison of a profile and a resource (which can be a top resource in a hierarchy or a base resource).","properties":{"accessRightId":{"description":"the unique identifier of the access right, mostly for deletion purpose.","format":"uuid","readOnly":true,"type":"string"},"actionName":{"description":"Name of the action.","examples":["read_narrative","write_compound"],"type":"string"},"resourceName":{"description":"Name of the resource.","examples":["compound_1245"],"type":"string"},"userId":{"description":"The id of the user, as stored in IDP. For Sanofi internal user, it would be the oid (Unique identifier of the user in Azure AD)","type":"string"}},"required":["userId","resourceName","actionName"],"type":"object"},"Action":{"description":"A possible action that can be used on a resource","properties":{"actionName":{"description":"The name of the action","examples":["read_narrative","send_email","write_compound"],"type":"string"},"children":{"description":"If this action has any children (such as read_narrative being the child of write_narrative), it will be included here.","items":{"description":"the name of the action children","type":"string"},"readOnly":true,"type":"array"}},"required":["actionName"],"type":"object"},"AdminGrant":{"description":"An admin right (an operation, with optional action/resource restrictions) attached to a role. Every member of the role inherits it. The restrictions must be within the role's declared scope. The caller must already hold an admin right covering the exact operation and restrictions being granted.","properties":{"actionRestriction":{"description":"Name of the action that will restrict the action usable in this operation to a specific hierarchy, within the role's scope.","examples":["write_narrative","read_compound"],"type":"string"},"adminGrantId":{"description":"The unique identifier of the admin grant, mostly for deletion purpose.","format":"uuid","readOnly":true,"type":"string"},"operationName":{"description":"Name of the operation.","examples":["manageActions","manageResources","manageAccessRights"],"type":"string"},"resourceRestriction":{"description":"Name of the resource that will restrict the resource usable in this operation to a specific hierarchy, within the role's scope.","examples":["compound_1245","study_1245"],"type":"string"},"roleName":{"description":"The name of the role this grant is attached to, as given in the path.","readOnly":true,"type":"string"}},"required":["operationName"],"type":"object"},"AdminRight":{"description":"the combination of a user and an administrative operation (such as creating a new action or resource).","properties":{"actionRestriction":{"description":"Name of the action that will restrict the action usable in an operation to a specific hierarchy. If defined, an administrator performing an operation related to an action will need to have this action name either as a direct parent or as an ancestor of the parent of the action he is using. If not defined, the administrator will be able to use any action.","examples":["write_narrative","read_compound"],"type":"string"},"adminRightId":{"description":"the unique identifier of the admin right, mostly for deletion purpose.","format":"uuid","readOnly":true,"type":"string"},"operationName":{"description":"Name of the operation.","examples":["manageAdminRights","manageActions","manageResources"],"type":"string"},"operationRestrictions":{"items":{"description":"Name of an allowed operation. Values are operation names, typically using the same naming convention as operationName (for example: manageAdminRights, manageActions, manageResources). If this array is defined, a user having a manageAdminRights will only be able to create a new admin right with the operations listed here. If not defined, the user will be able to create a new admin right with any operation. The OpenAPI schema does not formally restrict these values; any applicable validation is enforced by the server.\n","type":"string"},"type":"array"},"resourceRestriction":{"description":"Name of the resource that will restrict the resource usable in an operation to a specific hierarchy. If defined, an administrator performing an operation related to a resource will need to have this resource name either as a direct parent or as an ancestor of the parent of the resource he is using. If not defined, the administrator will be able to use any resource.","examples":["compound_1245","study_1245"],"type":"string"},"scope":{"description":"Scope of the admin right. If defined, the name of the action or resource will need to start by this scope as prefix (exemple-> \"clinshow:write_narrative\", \"dpt:read_compound\", \"platform:manage_admin_rights\"). If not defined, the admin right will be usable in any scope.","examples":["clinshow","dpt","platform"],"type":"string"},"userId":{"description":"The id of the user, as stored in IDP. For Sanofi internal user, it would be the oid (Unique identifier of the user in Azure AD)","type":"string"}},"required":["userId","operationName"],"type":"object"},"BadRequestDetails":{"properties":{"detail":{"description":"Error detail","example":"Planet area must be a valid number","type":"string"},"pointer":{"description":"Pointer to the field that has the error","example":"#/planet/area","type":"string"},"rejectedValue":{"description":"The value that was rejected","example":"NaN","type":"string"}},"required":["detail","pointer"],"type":"object"},"BadRequestError":{"properties":{"debugId":{"description":"A unique request identifier for correlation purposes.","example":"00-0af7651916cd43dd8448eb211c80319c-00f067aa0ba902b7-01","type":"string"},"detail":{"description":"Error detail","type":"string"},"errors":{"description":"A list of errors that occurred","items":{"$ref":"#/components/schemas/BadRequestDetails"},"type":"array"},"instance":{"default":"unknown","description":"URI that identifies the specific occurrence of the problem","example":"https://api.dev.accelerator.sanofi/planets/v1/planets/","type":"string"},"status":{"description":"HTTP status code","enum":[400],"type":"number"},"title":{"description":"Human-readable identifier","type":"string"},"type":{"description":"URI that identifies the type of error that occurred","example":"https://backstage.prod.accelerator.sanofi/docs/default/component/sanofi-accelerator-api-rules/errors-bad-request","type":"string"}},"required":["type","title","status","debugId","detail"],"type":"object"},"ConflictError":{"description":"An error that occurs when a request conflicts with the current state of the server, usually when creating a resource that already exists","properties":{"debugId":{"description":"A unique request identifier for correlation purposes.","example":"00-0af7651916cd43dd8448eb211c80319c-00f067aa0ba902b7-01","type":"string"},"detail":{"description":"Error detail","type":"string"},"status":{"description":"HTTP status code","enum":[409],"type":"number"},"title":{"description":"Human-readable identifier","enum":["Conflict"],"type":"string"},"type":{"description":"URI that identifies the type of error that occurred","example":"https://backstage.prod.accelerator.sanofi/catalog/planet-example-api/default/api/planet-example-api/components#ConflictError","type":"string"}},"required":["type","title","status","debugId","detail"],"type":"object"},"ForbiddenError":{"properties":{"debugId":{"description":"A unique request identifier for correlation purposes.","example":"00-0af7651916cd43dd8448eb211c80319c-00f067aa0ba902b7-01","type":"string"},"detail":{"description":"Error detail","enum":["You don't have the permission to access this resource"],"type":"string"},"status":{"description":"HTTP status code","enum":[403],"type":"number"},"title":{"description":"Human-readable identifier","enum":["Forbidden"],"type":"string"},"type":{"description":"URI that identifies the type of error that occurred","example":"https://backstage.prod.accelerator.sanofi/docs/default/component/sanofi-accelerator-api-rules/errors-forbidden","type":"string"}},"required":["type","title","status","debugId","detail"],"type":"object"},"HealthCheck":{"description":"see the healthCheck spec","properties":{"status":{"enum":["OK","WARNING","DOWN"],"type":"string"}},"required":["status"],"type":"object"},"InternalServerError":{"description":"Object describing the error format expected in API responses. Based on [RFC 9457](https://datatracker.ietf.org/doc/html/rfc9457)","properties":{"debugId":{"description":"A unique request identifier for correlation purposes. [Trace Context RFC](https://www.w3.org/TR/trace-context/)","example":"00-0af7651916cd43dd8448eb211c80319c-00f067aa0ba902b7-01","type":"string"},"detail":{"description":"More information about the specific problem, and if it's appropriate also steps to correct it. For example information about a form validation problem","example":"The service is currently unavailable due to an unexpected error","type":"string"},"status":{"description":"HTTP status code","example":500,"type":"number"},"title":{"description":"Human-readable identifier, usually the same type field should have the same title field","example":"Internal Server Error","type":"string"},"type":{"description":"URI that identifies the type of error that occured","example":"https://backstage.prod.accelerator.sanofi/docs/default/component/sanofi-accelerator-api-rules/errors-internal/","type":"string"}},"required":["type","title","status","debugId","detail"],"type":"object"},"NotFoundError":{"properties":{"debugId":{"description":"A unique request identifier for correlation purposes.","example":"00-0af7651916cd43dd8448eb211c80319c-00f067aa0ba902b7-01","type":"string"},"detail":{"description":"Error detail","type":"string"},"status":{"description":"HTTP status code","enum":[404],"type":"number"},"title":{"description":"Human-readable identifier","enum":["Not Found"],"type":"string"},"type":{"description":"URI that identifies the type of error that occurred","example":"https://backstage.prod.accelerator.sanofi/docs/default/component/sanofi-accelerator-api-rules/errors-not-found","type":"string"}},"required":["type","title","status","debugId","detail"],"type":"object"},"Permission":{"description":"the combination of a specific action with a specific resource for a given user. It is denormalized from an AccessRight to include all action and resource hierarchy.","properties":{"actionName":{"description":"Name of the action.","examples":["read_narrative","write_compound"],"type":"string"},"resourceName":{"description":"Name of the resource.","examples":["compound_1245"],"type":"string"},"userId":{"description":"The id of the user, as stored in IDP. For Sanofi internal user, it would be the oid (Unique identifier of the user in Azure AD)","type":"string"}},"required":["resourceName","actionName"],"type":"object"},"PermissionCheck":{"properties":{"actionName":{"description":"The action that can be performed on the resource","example":"read","type":"string"},"resourceName":{"description":"Unique identifier of the resource","example":"document_123","type":"string"}},"required":["actionName","resourceName"],"type":"object"},"Resource":{"description":"Represent a resource,","properties":{"children":{"description":"If this resource has any children (such as Clinical Studies for Compounds), they will be described here.","items":{"description":"the name of the resource children","type":"string"},"readOnly":true,"type":"array"},"resourceName":{"description":"The business identifier of the resource (such as a CSA for a analysis period, etc)","type":"string"}},"required":["resourceName"],"type":"object"},"Role":{"description":"A named bundle of access and admin grants, scoped to an action and a resource. All of a role's grants are always contained within this scope.","properties":{"description":{"description":"A human-readable description of the role's purpose.","type":"string"},"roleName":{"description":"The business identifier of the role.","examples":["clintrials:study-reader"],"type":"string"},"scopeAction":{"description":"The action (with its hierarchy) that bounds this role's access and admin grants. Immutable once the role is created.","examples":["read"],"type":"string"},"scopeResource":{"description":"The resource (with its hierarchy) that bounds this role's access and admin grants. Immutable once the role is created.","examples":["clintrials"],"type":"string"}},"required":["roleName","scopeAction","scopeResource"],"type":"object"},"RoleDetails":{"allOf":[{"$ref":"#/components/schemas/Role"},{"properties":{"accessGrants":{"description":"The access grants attached to this role.","items":{"$ref":"#/components/schemas/AccessGrant"},"readOnly":true,"type":"array"},"adminGrants":{"description":"The admin grants attached to this role.","items":{"$ref":"#/components/schemas/AdminGrant"},"readOnly":true,"type":"array"},"members":{"description":"The users attached to this role.","items":{"$ref":"#/components/schemas/RoleMember"},"readOnly":true,"type":"array"}},"type":"object"}],"description":"A role, along with its access grants, admin grants, and members."},"RoleMember":{"description":"A user attached to a role, inheriting all of its access and admin grants.","properties":{"attachedAt":{"description":"When the user was attached to the role.","format":"date-time","readOnly":true,"type":"string"},"attachedBy":{"description":"The id of the user (oid or username) who performed the attach, for audit purposes.","readOnly":true,"type":"string"},"roleName":{"description":"The name of the role, as given in the path.","readOnly":true,"type":"string"},"userId":{"description":"The id of the user, as stored in IDP. For Sanofi internal user, it would be the oid (Unique identifier of the user in Azure AD)","readOnly":true,"type":"string"}},"readOnly":true,"required":["roleName","userId","attachedAt","attachedBy"],"type":"object"},"ServiceUnavailableError":{"description":"The service is temporarily unavailable, often due to maintenance or overload. The client should retry the request after the time indicated in the retry-after header.","properties":{"debugId":{"description":"A unique request identifier for correlation purposes. [Trace Context RFC](https://www.w3.org/TR/trace-context/)","example":"00-0af7651916cd43dd8448eb211c80319c-00f067aa0ba902b7-01","type":"string"},"details":{"description":"More information about the specific problem","type":"object"},"status":{"description":"HTTP status code","enum":[503],"type":"number"},"title":{"description":"Human-readable identifier","example":"Service Unavailable","type":"string"},"type":{"description":"URI that identifies the type of error that occurred","example":"https://backstage.prod.accelerator.sanofi/docs/default/component/sanofi-accelerator-api-rules/errors-service-unavailable","type":"string"}},"required":["type","title","status","debugId","details"],"type":"object"},"SourcedAccessRight":{"description":"An access right, tagged with where it comes from - held directly by the user, or inherited through membership of a role.","properties":{"actionName":{"description":"Name of the action.","examples":["read_narrative","write_compound"],"type":"string"},"resourceName":{"description":"Name of the resource.","examples":["compound_1245"],"type":"string"},"source":{"description":"Where this access right comes from. \"DIRECT\" if held directly by the user, or \"ROLE#<roleName>\" if inherited through membership of that role.","examples":["DIRECT","ROLE#clintrials:study-reader"],"readOnly":true,"type":"string"},"userId":{"description":"The id of the user, as stored in IDP. For Sanofi internal user, it would be the oid (Unique identifier of the user in Azure AD). Always equal to the userId path parameter.","readOnly":true,"type":"string"}},"required":["actionName","resourceName","userId","source"],"type":"object"},"SourcedAdminRight":{"description":"An admin right, tagged with where it comes from - held directly by the user, or inherited through membership of a role.","properties":{"actionRestriction":{"description":"Name of the action that restricts the action usable in this operation to a specific hierarchy. Absent if the operation is not restricted to a specific action.","examples":["write_narrative","read_compound"],"type":"string"},"adminRightId":{"description":"The unique identifier of the underlying admin right, for use with DELETE /adminRights/{adminRightId}. Only present when source is \"DIRECT\" - a role-derived grant is deleted through DELETE /roles/{roleName}/adminGrants/{adminGrantId} instead, which is a different id.","format":"uuid","readOnly":true,"type":"string"},"operationName":{"description":"Name of the operation.","examples":["manageActions","manageResources","manageAccessRights","manageRoles"],"type":"string"},"resourceRestriction":{"description":"Name of the resource that restricts the resource usable in this operation to a specific hierarchy. Absent if the operation is not restricted to a specific resource.","examples":["compound_1245","study_1245"],"type":"string"},"source":{"description":"Where this admin right comes from. \"DIRECT\" if held directly by the user, or \"ROLE#<roleName>\" if inherited through membership of that role.","examples":["DIRECT","ROLE#clintrials:study-reader"],"readOnly":true,"type":"string"},"userId":{"description":"The id of the user, as stored in IDP. For Sanofi internal user, it would be the oid (Unique identifier of the user in Azure AD). Always equal to the userId path parameter.","readOnly":true,"type":"string"}},"required":["operationName","userId","source"],"type":"object"},"UnauthorizedError":{"properties":{"debugId":{"description":"A unique request identifier for correlation purposes.","example":"00-0af7651916cd43dd8448eb211c80319c-00f067aa0ba902b7-01","type":"string"},"detail":{"description":"Error detail","enum":["You are not authorized to access this resource"],"type":"string"},"status":{"description":"HTTP status code","enum":[401],"type":"number"},"title":{"description":"Human-readable identifier","enum":["Unauthorized"],"type":"string"},"type":{"description":"URI that identifies the type of error that occurred","example":"https://backstage.prod.accelerator.sanofi/docs/default/component/sanofi-accelerator-api-rules/errors-unauthorized","type":"string"}},"required":["type","title","status","debugId","detail"],"type":"object"}},"securitySchemes":{"oauth":{"bearerFormat":"JWT","scheme":"bearer","type":"http"}}},"info":{"contact":{"email":"platform-apis@sanofi.com"},"description":"The REST/JSON API for Permission Administration API. It allows to to manage users, actions, resources and permissions for other systems","title":"Permission Administration API","version":"1.5.0","x-accelerator-cors":true},"openapi":"3.1.0","paths":{"/accessRights":{"get":{"description":"Allows the retrieval of all available access rights across all users, filtered by actionName and resourceName.","operationId":"retrieveAllAccessRights","parameters":[{"description":"the name of the action. Will return all access rights containing this action name.","in":"query","name":"actionName","required":false,"schema":{"type":"string"}},{"description":"the name of the resource. Will return all access rights containing this resource name.","in":"query","name":"resourceName","required":false,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/AccessRight"},"type":"array"}}},"description":"Success"},"204":{"description":"Empty"},"400":{"$ref":"#/components/responses/400"},"401":{"$ref":"#/components/responses/401"},"403":{"$ref":"#/components/responses/403"},"404":{"$ref":"#/components/responses/404"},"500":{"$ref":"#/components/responses/500"}},"summary":"Retrieve a list of access rights","tags":["Access Rights"]},"post":{"description":"Assign an access right (a combination of action hierarchy and resource) to a user","operationId":"CreateAccessRight","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccessRight"}}},"required":true},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccessRight"}}},"description":"Created"},"400":{"$ref":"#/components/responses/400"},"401":{"$ref":"#/components/responses/401"},"403":{"$ref":"#/components/responses/403"},"404":{"$ref":"#/components/responses/404"},"409":{"$ref":"#/components/responses/409"},"500":{"$ref":"#/components/responses/500"}},"summary":"Assign an access right to a user","tags":["Access Rights"]}},"/accessRights/{accessRightId}":{"delete":{"description":"Delete an access right in the permission application.","operationId":"deleteAccessRight","responses":{"204":{"description":"Success"},"401":{"$ref":"#/components/responses/401"},"403":{"$ref":"#/components/responses/403"},"404":{"$ref":"#/components/responses/404"},"500":{"$ref":"#/components/responses/500"}},"summary":"Delete an access right","tags":["Access Rights"]},"parameters":[{"description":"the unique identifier of the access right.","in":"path","name":"accessRightId","required":true,"schema":{"format":"uuid","type":"string"}}]},"/actions":{"get":{"description":"Allows the retrieval of all available actions, with filter by name.","operationId":"retrieveActions","parameters":[{"description":"the name of the action to be returned. Will return all actions whose name contains this parameter.","in":"query","name":"actionName","required":false,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/Action"},"type":"array"}}},"description":"Success"},"204":{"description":"Empty"},"401":{"$ref":"#/components/responses/401"},"403":{"$ref":"#/components/responses/403"},"500":{"$ref":"#/components/responses/500"}},"summary":"Retrieve a list of actions","tags":["Actions"]},"post":{"description":"Create an action in the permission application. It allows to create a single action.","operationId":"createAction","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Action"}}},"required":true},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Action"}}},"description":"Created"},"400":{"$ref":"#/components/responses/400"},"401":{"$ref":"#/components/responses/401"},"403":{"$ref":"#/components/responses/403"},"409":{"$ref":"#/components/responses/409"},"500":{"$ref":"#/components/responses/500"}},"summary":"Create an action in the permission application","tags":["Actions"]}},"/actions/{actionName}":{"delete":{"description":"Delete an action in the permission application. Rejected if the action is in use by an AccessRight, an AccessGrant, an AdminGrant, or is a role's scope.","operationId":"deleteAction","responses":{"204":{"description":"Deleted"},"401":{"$ref":"#/components/responses/401"},"403":{"$ref":"#/components/responses/403"},"404":{"$ref":"#/components/responses/404"},"409":{"$ref":"#/components/responses/409"},"500":{"$ref":"#/components/responses/500"}},"summary":"Delete an action","tags":["Actions"]},"get":{"description":"Retrieve an action - compared to the list one, it also retrieves the children of this action.","operationId":"retrieveAction","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Action"}}},"description":"Success"},"400":{"$ref":"#/components/responses/400"},"401":{"$ref":"#/components/responses/401"},"403":{"$ref":"#/components/responses/403"},"404":{"$ref":"#/components/responses/404"},"500":{"$ref":"#/components/responses/500"}},"summary":"Retrieve an action with its children.","tags":["Actions"]},"parameters":[{"description":"The name of the action to be retrieved or deleted","in":"path","name":"actionName","required":true,"schema":{"type":"string"}}]},"/actions/{actionName}/children":{"parameters":[{"description":"The name of the parent action","in":"path","name":"actionName","required":true,"schema":{"type":"string"}}],"post":{"description":"Create a new action and immediately link it as a child of the specified parent action. This operation combines action creation and hierarchy establishment in a single step.","operationId":"createActionChild","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Action"}}},"required":true},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Action"}}},"description":"Created"},"400":{"$ref":"#/components/responses/400"},"401":{"$ref":"#/components/responses/401"},"403":{"$ref":"#/components/responses/403"},"404":{"$ref":"#/components/responses/404"},"409":{"$ref":"#/components/responses/409"},"500":{"$ref":"#/components/responses/500"}},"summary":"Create an action as child of another action","tags":["Actions"]}},"/actions/{actionName}/children/{childName}":{"delete":{"description":"This operation allows the deletion of a link between two actions once they have been created. Only the link is destroyed, the actions themselves remain available. Rejected if the change would take a role's access or admin grants outside of that role's declared scope.","operationId":"deleteActionHierarchy","responses":{"204":{"description":"Success"},"401":{"$ref":"#/components/responses/401"},"403":{"$ref":"#/components/responses/403"},"404":{"$ref":"#/components/responses/404"},"409":{"$ref":"#/components/responses/409"},"500":{"$ref":"#/components/responses/500"},"503":{"$ref":"#/components/responses/503"}},"summary":"Delete a link between a parent and a child action","tags":["Actions"]},"parameters":[{"description":"the name of the action.","in":"path","name":"actionName","required":true,"schema":{"type":"string"}},{"description":"the name of the child action","in":"path","name":"childName","required":true,"schema":{"type":"string"}}],"put":{"description":"This operation allows the creation of hierarchy between two actions once they have been created.","operationId":"createActionHierarchy","responses":{"204":{"description":"Success"},"401":{"$ref":"#/components/responses/401"},"403":{"$ref":"#/components/responses/403"},"404":{"$ref":"#/components/responses/404"},"409":{"$ref":"#/components/responses/409"},"500":{"$ref":"#/components/responses/500"},"503":{"$ref":"#/components/responses/503"}},"summary":"Create a link between a parent and a child action","tags":["Actions"]}},"/adminRights":{"get":{"description":"Allows the retrieval of all available admin rights across all users.","operationId":"retrieveAllAdminRights","responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/AdminRight"},"type":"array"}}},"description":"Success"},"204":{"description":"Empty"},"401":{"$ref":"#/components/responses/401"},"403":{"$ref":"#/components/responses/403"},"500":{"$ref":"#/components/responses/500"}},"summary":"Retrieve a list of admin rights","tags":["Admin Rights"]},"post":{"description":"Creates an admin right in the permission application, which promotes a user to admin by granting them administrative rights.","operationId":"createAdminRight","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AdminRight"}}},"required":true},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AdminRight"}}},"description":"Created"},"400":{"$ref":"#/components/responses/400"},"401":{"$ref":"#/components/responses/401"},"403":{"$ref":"#/components/responses/403"},"409":{"$ref":"#/components/responses/409"},"500":{"$ref":"#/components/responses/500"}},"summary":"Create an admin right in the permission application","tags":["Admin Rights"]}},"/adminRights/{adminRightId}":{"delete":{"description":"Delete an admin right in the permission application.","operationId":"deleteAdminRight","responses":{"204":{"description":"Success"},"401":{"$ref":"#/components/responses/401"},"403":{"$ref":"#/components/responses/403"},"404":{"$ref":"#/components/responses/404"},"500":{"$ref":"#/components/responses/500"}},"summary":"Delete an admin right","tags":["Admin Rights"]},"parameters":[{"description":"the unique identifier of the admin right.","in":"path","name":"adminRightId","required":true,"schema":{"format":"uuid","type":"string"}}]},"/healthCheck":{"get":{"description":"Check the health status of the API and return the status of the service Ok, Warning or Down","operationId":"applicationHealthCheck","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/HealthCheck"}}},"description":"Success"},"500":{"$ref":"#/components/responses/500"}},"security":[],"summary":"Return the API status, this implements healthCheck spec","tags":["Health Check"]}},"/permissions":{"get":{"description":"Retrieve the permissions.","operationId":"retrievePermissions","responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/Permission"},"type":"array"}}},"description":"Success"},"204":{"description":"Empty"},"401":{"$ref":"#/components/responses/401"},"403":{"$ref":"#/components/responses/403"},"404":{"$ref":"#/components/responses/404"},"500":{"$ref":"#/components/responses/500"}},"summary":"Retrieve all the permissions. Can be filtered by userId.","tags":["Permissions"]},"parameters":[{"description":"The id of the user, as stored in IDP. For Sanofi internal user, it would be the oid (Unique identifier of the user in Azure AD)","in":"query","name":"userId","required":false,"schema":{"type":"string"}}]},"/permissions/checks":{"post":{"description":"This operation receives a specific action and a list of resources, and returns a subset of resources on which the user can perform this action. The user is identified by its token.","operationId":"permissionsCheck","requestBody":{"content":{"application/json":{"schema":{"example":[{"actionName":"read","resourceName":"document123"},{"actionName":"write","resourceName":"document789"}],"items":{"$ref":"#/components/schemas/PermissionCheck"},"type":"array"}}},"required":true},"responses":{"200":{"content":{"application/json":{"schema":{"example":[{"actionName":"read","hasAccess":true,"resourceName":"document123"},{"actionName":"write","hasAccess":false,"resourceName":"document789"}],"items":{"allOf":[{"$ref":"#/components/schemas/Permission"},{"properties":{"hasAccess":{"description":"indicate whether the user can use the action on the resource","readOnly":true,"type":"boolean"}},"required":["hasAccess"],"type":"object"}],"type":"object"},"type":"array"}}},"description":"Return the list of resources on which the user can execute the action"},"400":{"$ref":"#/components/responses/400"},"401":{"$ref":"#/components/responses/401"},"500":{"$ref":"#/components/responses/500"}},"summary":"Check if the user has the right to perform the action on the resource","tags":["Permissions"]}},"/resources":{"get":{"description":"Allows the retrieval of a list of resources, following various criteria.","operationId":"retrieveResources","parameters":[{"description":"Only resources whose resourceName are partially matched by this parameters will be returned","in":"query","name":"resourceName","required":false,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/Resource"},"type":"array"}}},"description":"Success"},"204":{"description":"Empty"},"401":{"$ref":"#/components/responses/401"},"403":{"$ref":"#/components/responses/403"},"500":{"$ref":"#/components/responses/500"}},"summary":"Retrieve a list of resources","tags":["Resources"]},"post":{"description":"Create a resource in the permission application. It allows to create a single resource.","operationId":"createResource","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Resource"}}},"required":true},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Resource"}}},"description":"Created"},"400":{"$ref":"#/components/responses/400"},"401":{"$ref":"#/components/responses/401"},"403":{"$ref":"#/components/responses/403"},"409":{"$ref":"#/components/responses/409"},"500":{"$ref":"#/components/responses/500"}},"summary":"Create a resource in the permission application","tags":["Resources"]}},"/resources/{resourceName}":{"delete":{"description":"Delete a resource in the permission application. Rejected if the resource is in use by an AccessRight, an AccessGrant, an AdminGrant, or is a role's scope.","operationId":"deleteResource","responses":{"204":{"description":"Deleted"},"401":{"$ref":"#/components/responses/401"},"403":{"$ref":"#/components/responses/403"},"404":{"$ref":"#/components/responses/404"},"409":{"$ref":"#/components/responses/409"},"500":{"$ref":"#/components/responses/500"}},"summary":"Delete a resource","tags":["Resources"]},"get":{"description":"Retrieve a resource by its id, including the children","operationId":"retrieveResource","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Resource"}}},"description":"Success"},"204":{"description":"Empty"},"401":{"$ref":"#/components/responses/401"},"403":{"$ref":"#/components/responses/403"},"500":{"$ref":"#/components/responses/500"}},"summary":"Retrieve a specific resource","tags":["Resources"]},"parameters":[{"description":"The name of the resource","in":"path","name":"resourceName","required":true,"schema":{"type":"string"}}]},"/resources/{resourceName}/children":{"parameters":[{"description":"The name of the parent resource","in":"path","name":"resourceName","required":true,"schema":{"type":"string"}}],"post":{"description":"Create a new resource and immediately link it as a child of the specified parent resource. This operation combines resource creation and hierarchy establishment in a single step.","operationId":"createResourceChild","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Resource"}}},"required":true},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Resource"}}},"description":"Created"},"400":{"$ref":"#/components/responses/400"},"401":{"$ref":"#/components/responses/401"},"403":{"$ref":"#/components/responses/403"},"404":{"$ref":"#/components/responses/404"},"409":{"$ref":"#/components/responses/409"},"500":{"$ref":"#/components/responses/500"}},"summary":"Create a resource as child of another resource","tags":["Resources"]}},"/resources/{resourceName}/children/{childName}":{"delete":{"description":"Delete a link between a parent and a child resource. Only the link is destroyed, both resources are still available. Rejected if the change would take a role's access or admin grants outside of that role's declared scope.","operationId":"deleteResourceLink","responses":{"204":{"description":"Deleted"},"401":{"$ref":"#/components/responses/401"},"403":{"$ref":"#/components/responses/403"},"404":{"$ref":"#/components/responses/404"},"409":{"$ref":"#/components/responses/409"},"500":{"$ref":"#/components/responses/500"},"503":{"$ref":"#/components/responses/503"}},"summary":"Delete a link between a parent and a child resource","tags":["Resources"]},"parameters":[{"description":"The name of the parent resource","in":"path","name":"resourceName","required":true,"schema":{"type":"string"}},{"description":"The name of the child resource","in":"path","name":"childName","required":true,"schema":{"type":"string"}}],"put":{"description":"Create a link between a parent and a child resource. The child resource is added to the parent resource.","operationId":"createResourceLink","responses":{"204":{"description":"Created"},"401":{"$ref":"#/components/responses/401"},"403":{"$ref":"#/components/responses/403"},"404":{"$ref":"#/components/responses/404"},"409":{"$ref":"#/components/responses/409"},"500":{"$ref":"#/components/responses/500"},"503":{"$ref":"#/components/responses/503"}},"summary":"Create a link between a parent and a child resource","tags":["Resources"]}},"/roles":{"get":{"description":"Allows the retrieval of all roles. Requires an unrestricted manageRoles right; the list is not scoped to the caller. Access grants, admin grants, and members are not returned here.","operationId":"retrieveRoles","responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/Role"},"type":"array"}}},"description":"Success"},"204":{"description":"Empty"},"401":{"$ref":"#/components/responses/401"},"403":{"$ref":"#/components/responses/403"},"500":{"$ref":"#/components/responses/500"}},"summary":"Retrieve a list of roles","tags":["Roles"]},"post":{"description":"Create a role scoped to an action and a resource. The caller needs manageRoles over the requested scope. A role's access and admin grants are always contained within this scope.","operationId":"createRole","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Role"}}},"required":true},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Role"}}},"description":"Created"},"400":{"$ref":"#/components/responses/400"},"401":{"$ref":"#/components/responses/401"},"403":{"$ref":"#/components/responses/403"},"409":{"$ref":"#/components/responses/409"},"500":{"$ref":"#/components/responses/500"}},"summary":"Create a role","tags":["Roles"]}},"/roles/{roleName}":{"delete":{"description":"Delete a role. Rejected if the role still has access grants, admin grants, or members attached.","operationId":"deleteRole","responses":{"204":{"description":"Deleted"},"400":{"$ref":"#/components/responses/400"},"401":{"$ref":"#/components/responses/401"},"403":{"$ref":"#/components/responses/403"},"404":{"$ref":"#/components/responses/404"},"500":{"$ref":"#/components/responses/500"}},"summary":"Delete a role","tags":["Roles"]},"get":{"description":"Retrieve a role by its name, including its access grants, admin grants, and members.","operationId":"retrieveRole","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RoleDetails"}}},"description":"Success"},"401":{"$ref":"#/components/responses/401"},"403":{"$ref":"#/components/responses/403"},"404":{"$ref":"#/components/responses/404"},"500":{"$ref":"#/components/responses/500"}},"summary":"Retrieve a role","tags":["Roles"]},"parameters":[{"description":"The name of the role","in":"path","name":"roleName","required":true,"schema":{"type":"string"}}],"patch":{"description":"Update a role's description. The role's name and scope (scopeAction, scopeResource) are immutable once created.","operationId":"updateRole","requestBody":{"content":{"application/json":{"schema":{"properties":{"description":{"type":"string"}},"required":["description"],"type":"object"}}},"required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RoleDetails"}}},"description":"Success"},"400":{"$ref":"#/components/responses/400"},"401":{"$ref":"#/components/responses/401"},"403":{"$ref":"#/components/responses/403"},"404":{"$ref":"#/components/responses/404"},"500":{"$ref":"#/components/responses/500"}},"summary":"Update a role's description","tags":["Roles"]}},"/roles/{roleName}/accessGrants":{"parameters":[{"description":"The name of the role","in":"path","name":"roleName","required":true,"schema":{"type":"string"}}],"post":{"description":"Add an access grant (an action/resource pair) to a role. The caller needs manageRoles over the role's scope, and manageAccessRights over the exact action/resource pair being granted. The action and resource must be within the role's declared scope.","operationId":"addAccessGrant","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccessGrant"}}},"required":true},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccessGrant"}}},"description":"Created"},"400":{"$ref":"#/components/responses/400"},"401":{"$ref":"#/components/responses/401"},"403":{"$ref":"#/components/responses/403"},"404":{"$ref":"#/components/responses/404"},"409":{"$ref":"#/components/responses/409"},"500":{"$ref":"#/components/responses/500"}},"summary":"Add an access grant to a role","tags":["Roles"]}},"/roles/{roleName}/accessGrants/{accessGrantId}":{"delete":{"description":"Remove an access grant from a role by its id. The caller needs manageRoles over the role's scope, and manageAccessRights over the grant's action/resource pair.","operationId":"removeAccessGrant","responses":{"204":{"description":"Deleted"},"401":{"$ref":"#/components/responses/401"},"403":{"$ref":"#/components/responses/403"},"404":{"$ref":"#/components/responses/404"},"500":{"$ref":"#/components/responses/500"}},"summary":"Remove an access grant from a role","tags":["Roles"]},"parameters":[{"description":"The name of the role","in":"path","name":"roleName","required":true,"schema":{"type":"string"}},{"description":"The unique identifier of the access grant","in":"path","name":"accessGrantId","required":true,"schema":{"format":"uuid","type":"string"}}]},"/roles/{roleName}/adminGrants":{"parameters":[{"description":"The name of the role","in":"path","name":"roleName","required":true,"schema":{"type":"string"}}],"post":{"description":"Add an admin grant to a role. The caller needs manageRoles over the role's scope, and must already hold an admin right covering the exact operation and restrictions being granted. The action and resource restrictions must be within the role's declared scope. manageRoles and manageMigrations cannot be granted through a role.","operationId":"addAdminGrant","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AdminGrant"}}},"required":true},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AdminGrant"}}},"description":"Created"},"400":{"$ref":"#/components/responses/400"},"401":{"$ref":"#/components/responses/401"},"403":{"$ref":"#/components/responses/403"},"404":{"$ref":"#/components/responses/404"},"409":{"$ref":"#/components/responses/409"},"500":{"$ref":"#/components/responses/500"}},"summary":"Add an admin grant to a role","tags":["Roles"]}},"/roles/{roleName}/adminGrants/{adminGrantId}":{"delete":{"description":"Remove an admin grant from a role by its id. The caller needs manageRoles over the role's scope, and the grant's own operation over its restrictions.","operationId":"removeAdminGrant","responses":{"204":{"description":"Deleted"},"401":{"$ref":"#/components/responses/401"},"403":{"$ref":"#/components/responses/403"},"404":{"$ref":"#/components/responses/404"},"500":{"$ref":"#/components/responses/500"}},"summary":"Remove an admin grant from a role","tags":["Roles"]},"parameters":[{"description":"The name of the role","in":"path","name":"roleName","required":true,"schema":{"type":"string"}},{"description":"The unique identifier of the admin grant","in":"path","name":"adminGrantId","required":true,"schema":{"format":"uuid","type":"string"}}]},"/roles/{roleName}/members":{"get":{"description":"Retrieve the users attached to a role.","operationId":"retrieveRoleMembers","responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/RoleMember"},"type":"array"}}},"description":"Success"},"204":{"description":"Empty"},"401":{"$ref":"#/components/responses/401"},"403":{"$ref":"#/components/responses/403"},"404":{"$ref":"#/components/responses/404"},"500":{"$ref":"#/components/responses/500"}},"summary":"Retrieve a role's members","tags":["Roles"]},"parameters":[{"description":"The name of the role","in":"path","name":"roleName","required":true,"schema":{"type":"string"}}]},"/roles/{roleName}/members/{userId}":{"delete":{"description":"Detaches a user from a role. The caller needs manageRoles over the role's scope.","operationId":"removeRoleMember","responses":{"204":{"description":"Deleted"},"401":{"$ref":"#/components/responses/401"},"403":{"$ref":"#/components/responses/403"},"404":{"$ref":"#/components/responses/404"},"500":{"$ref":"#/components/responses/500"}},"summary":"Detach a user from a role","tags":["Roles"]},"parameters":[{"description":"The name of the role","in":"path","name":"roleName","required":true,"schema":{"type":"string"}},{"description":"The id of the user, as stored in IDP. For Sanofi internal user, it would be the oid (Unique identifier of the user in Azure AD)","in":"path","name":"userId","required":true,"schema":{"type":"string"}}],"put":{"description":"Attaches a user to a role, granting them all of its access and admin grants. The caller needs manageRoles over the role's scope. Idempotent - attaching a user already in the role is a no-op.","operationId":"addRoleMember","responses":{"204":{"description":"No Content"},"400":{"$ref":"#/components/responses/400"},"401":{"$ref":"#/components/responses/401"},"403":{"$ref":"#/components/responses/403"},"404":{"$ref":"#/components/responses/404"},"500":{"$ref":"#/components/responses/500"}},"summary":"Attach a user to a role","tags":["Roles"]}},"/users/{userId}/accessRights":{"get":{"description":"Retrieve the access rights of a user, held either directly or through role membership. An access right is a combination of an Action (with its hierarchy) and a Resource.","operationId":"retrieveUserAccessRights","responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/SourcedAccessRight"},"type":"array"}}},"description":"Success"},"204":{"description":"Empty"},"401":{"$ref":"#/components/responses/401"},"403":{"$ref":"#/components/responses/403"},"404":{"$ref":"#/components/responses/404"},"500":{"$ref":"#/components/responses/500"}},"summary":"Retrieve the access rights of a user","tags":["Access Rights"]},"parameters":[{"description":"The id of the user, as stored in IDP. For Sanofi internal user, it would be the oid (Unique identifier of the user in Azure AD)","in":"path","name":"userId","required":true,"schema":{"type":"string"}}]},"/users/{userId}/adminRights":{"get":{"description":"Allows the retrieval of all available admin rights of a specific user, held either directly or through role membership.","operationId":"retrieveAdminRights","responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/SourcedAdminRight"},"type":"array"}}},"description":"Success"},"204":{"description":"Empty"},"401":{"$ref":"#/components/responses/401"},"403":{"$ref":"#/components/responses/403"},"500":{"$ref":"#/components/responses/500"}},"summary":"Retrieve a list of admin rights","tags":["Admin Rights"]},"parameters":[{"description":"The ID of the user, as stored in IDP. For Sanofi internal users, it would be the oid (Unique identifier of the user in Azure AD)","in":"path","name":"userId","required":true,"schema":{"type":"string"}}]},"/users/{userId}/roles":{"get":{"description":"Retrieve the roles a user is a member of. Callable by manageRoles holders (unrestricted) or by the user themselves.","operationId":"retrieveUserRoles","responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/Role"},"type":"array"}}},"description":"Success"},"204":{"description":"Empty"},"401":{"$ref":"#/components/responses/401"},"403":{"$ref":"#/components/responses/403"},"404":{"$ref":"#/components/responses/404"},"500":{"$ref":"#/components/responses/500"}},"summary":"Retrieve the roles a user belongs to","tags":["Roles"]},"parameters":[{"description":"The id of the user (oid or preferred_username in JWT).","in":"path","name":"userId","required":true,"schema":{"type":"string"}}]}},"security":[{"oauth":[]}],"servers":[{"url":"https://dev.api.sanofi.com/permissions"}],"tags":[{"description":"Endpoint defined to check health status of the API","name":"Health Check"},{"description":"Endpoints related to action management","name":"Actions"},{"description":"Endpoints related to resource management","name":"Resources"},{"description":"Endpoints related to user profiles management","name":"Access Rights"},{"description":"Endpoints related to permissions management","name":"Permissions"},{"description":"Endpoints related to administration rights management","name":"Admin Rights"},{"description":"Endpoints related to role management, including a role's access grants, admin grants, and membership","name":"Roles"}]}
```