osctrl-api.yaml

openapi: 3.0.1
servers:
  - url: "{server}/api/v1"
    variables:
      server:
        default: https://osctrl.net
info:
  title: osctrl-api
  description: "This the API for osctrl, a fast and efficient osquery management solution."
  version: 0.4.1
externalDocs:
  description: osctrl documentation
  url: https://osctrl.net
tags:
  - name: nodes
    description: Enrolled nodes in osctrl
    externalDocs:
      description: osctrl nodes
      url: https://github.com/jmpsec/osctrl/tree/master/nodes
  - name: queries
    description: On-demand queries in osctrl
    externalDocs:
      description: on-demand queries
      url: https://github.com/jmpsec/osctrl/tree/master/queries
  - name: carves
    description: File carves in osctrl
    externalDocs:
      description: osctrl file carves
      url: https://github.com/jmpsec/osctrl/tree/master/carves
  - name: users
    description: Existing users in osctrl
    externalDocs:
      description: osctrl users
      url: https://github.com/jmpsec/osctrl/tree/master/users
  - name: platforms
    description: Platforms of enrolled nodes in osctrl
    externalDocs:
      description: osctrl platforms
      url: https://github.com/jmpsec/osctrl/tree/master/queries
  - name: environments
    description: Environments within osctrl
    externalDocs:
      description: osctrl environments
      url: https://github.com/jmpsec/osctrl/tree/master/environments
  - name: tags
    description: Tags for enrolled nodes in osctrl
    externalDocs:
      description: osctrl tags
      url: https://github.com/jmpsec/osctrl/tree/master/tags
  - name: settings
    description: Settings for all osctrl components
    externalDocs:
      description: osctrl settings
      url: https://github.com/jmpsec/osctrl/tree/master/settings
paths:
  /nodes/{env}/all:
    get:
      tags:
        - nodes
      summary: Get all the nodes by environment
      description: Returns all the enrolled nodes by environment
      operationId: AllNodesHandler
      parameters:
        - name: env
          in: path
          description: Name or UUID of the requested osctrl environment
          required: true
          schema:
            type: string
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/OsqueryNode"
        400:
          description: bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        403:
          description: no access
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        404:
          description: no nodes
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        500:
          description: error getting nodes
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
      security:
        - Authorization:
            - admin
  /nodes/{env}/active:
    get:
      tags:
        - nodes
      summary: Get all the active nodes by environment
      description: Returns all the enrolled active nodes by environment
      operationId: ActiveNodesHandler
      parameters:
        - name: env
          in: path
          description: Name or UUID of the requested osctrl environment
          required: true
          schema:
            type: string
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/OsqueryNode"
        400:
          description: bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        403:
          description: no access
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        404:
          description: no nodes
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        500:
          description: error getting nodes
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
      security:
        - Authorization:
            - admin
  /nodes/{env}/inactive:
    get:
      tags:
        - nodes
      summary: Get all the inactive nodes by environment
      description: Returns all the enrolled inactive nodes by environment
      operationId: InactiveNodesHandler
      parameters:
        - name: env
          in: path
          description: Name or UUID of the requested osctrl environment
          required: true
          schema:
            type: string
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/OsqueryNode"
        400:
          description: bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        403:
          description: no access
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        404:
          description: no nodes
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        500:
          description: error getting nodes
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
      security:
        - Authorization:
            - admin
  /nodes/node/{identifier}:
    get:
      tags:
        - nodes
      summary: Get a single node by identifier
      description: Returns a single enrolled node by identifier (UUID, hostname or localname)
      operationId: NodeHandler
      parameters:
        - name: identifier
          in: path
          description: Identifier of the requested enrolled node (UUID, hostname or localname)
          required: true
          schema:
            type: string
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/OsqueryNode"
        400:
          description: bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        403:
          description: no access
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        404:
          description: node not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        500:
          description: error getting node
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
      security:
        - Authorization:
            - read
  /nodes/{env}/delete:
    post:
      tags:
        - nodes
      summary: Delete node
      description: Deletes an enrolled node by identifier (UUID, hostname or localname)
      operationId: DeleteNodeHandler
      parameters:
        - name: env
          in: path
          description: Name or UUID of the requested osctrl environment
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ApiNodeGenericRequest"
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiGenericResponse"
        400:
          description: bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        403:
          description: no access
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        404:
          description: no nodes
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        500:
          description: error deleting node
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
      security:
        - Authorization:
            - admin
  /queries/{env}:
    get:
      tags:
        - queries
      summary: Get all on-demand queries
      description: Returns all on-demand queries by environment
      operationId: AllQueriesShowHandler
      parameters:
        - name: env
          in: path
          description: Name or UUID of the requested osctrl environment
          required: true
          schema:
            type: string
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/DistributedQuery"
        400:
          description: bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        403:
          description: no access
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        404:
          description: no queries
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        500:
          description: error getting queries
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
      security:
        - Authorization:
            - query
    post:
      tags:
        - queries
      summary: Run new query
      description: Creates a new on-demand query to run
      operationId: QueriesRunHandler
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ApiDistributedQueryRequest"
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiQueriesResponse"
        400:
          description: bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        403:
          description: no access
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        404:
          description: no queries
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        500:
          description: error getting queries
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
      security:
        - Authorization:
            - query
  /queries/{env}/list/{target}:
    get:
      tags:
        - queries
      summary: Get on-demand queries
      description: Returns all on-demand queries by target and environment
      operationId: QueryListHandler
      parameters:
        - name: env
          in: path
          description: Name or UUID of the requested osctrl environment
          required: true
          schema:
            type: string
        - name: target
          in: path
          description: Query target to retrieve (all, all-full, active, hidden-active, completed, expired, saved, hidden-completed, deleted, hidden)
          required: true
          schema:
            type: string
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/DistributedQuery"
        400:
          description: bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        403:
          description: no access
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        404:
          description: no queries
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        500:
          description: error getting queries
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
      security:
        - Authorization:
            - query
  /queries/{env}/{name}:
    get:
      tags:
        - queries
      summary: Get on-demand query
      description: Returns the requested on-demand query by name and environment
      operationId: QueryShowHandler
      parameters:
        - name: env
          in: path
          description: Name or UUID of the requested osctrl environment
          required: true
          schema:
            type: string
        - name: name
          in: path
          description: Name of the requested on-demand query
          required: true
          schema:
            type: string
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/DistributedQuery"
        400:
          description: bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        403:
          description: no access
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        404:
          description: query not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        500:
          description: error getting query
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
      security:
        - Authorization:
            - query
  /queries/{env}/results/{name}:
    get:
      tags:
        - queries
      summary: Get on-demand query results
      description: Returns the requested on-demand query results by name and environment
      operationId: QueryResultsHandler
      parameters:
        - name: env
          in: path
          description: Name or UUID of the requested osctrl environment
          required: true
          schema:
            type: string
        - name: name
          in: path
          description: Name of the requested on-demand query
          required: true
          schema:
            type: string
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/APIQueryData"
        403:
          description: no access
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        404:
          description: query not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        500:
          description: error getting results
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
      security:
        - Authorization:
            - query
  /queries/{env}/{action}/{name}:
    post:
      tags:
        - queries
      summary: Execute action on on-demand query
      description: Executes an action (delete/expire) in the on-demand query by name and environment
      operationId: QueriesActionHandler
      parameters:
        - name: env
          in: path
          description: Name or UUID of the requested osctrl environment
          required: true
          schema:
            type: string
        - name: action
          in: path
          description: Action to execute (delete, expire)
          required: true
          schema:
            type: string
        - name: name
          in: path
          description: Name of the requested on-demand query
          required: true
          schema:
            type: string
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiGenericResponse"
        400:
          description: bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        403:
          description: no access
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        404:
          description: no queries
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        500:
          description: error getting queries
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
      security:
        - Authorization:
            - admin
  /all-queries/{env}:
    get:
      tags:
        - queries
      summary: Get all on-demand queries
      description: Returns all on-demand queries by environment
      operationId: AllQueriesShowHandler
      parameters:
        - name: env
          in: path
          description: Name or UUID of the requested osctrl environment to get queries
          required: true
          schema:
            type: string
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/DistributedQuery"
        403:
          description: no access
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        404:
          description: no queries
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        500:
          description: error getting queries
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
      security:
        - Authorization:
            - query
  /carves/{env}:
    get:
      tags:
        - carves
      summary: Get file carves
      description: Returns all file carves by environment
      operationId: CarvesShowHandler
      parameters:
        - name: env
          in: path
          description: Name or UUID of the requested osctrl environment to get carves
          required: true
          schema:
            type: string
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/CarvedFile"
        403:
          description: no access
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        404:
          description: no carves
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        500:
          description: error getting carves
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
      security:
        - Authorization:
            - carve
    post:
      tags:
        - queries
      summary: Run new file carve
      description: Creates a new file carve to run
      operationId: CarveListHandler
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ApiDistributedCarveRequest"
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiQueriesResponse"
        403:
          description: no access
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        404:
          description: no queries
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        500:
          description: error getting queries
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
      security:
        - Authorization:
            - carve
  /carves/{env}/list:
    get:
      tags:
        - carves
      summary: Get file carves
      description: Returns all file carves by target and environment
      operationId: CarveListHandler
      parameters:
        - name: env
          in: path
          description: Name or UUID of the requested osctrl environment
          required: true
          schema:
            type: string
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/CarvedFile"
        400:
          description: bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        403:
          description: no access
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        404:
          description: no queries
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        500:
          description: error getting queries
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
      security:
        - Authorization:
            - carve
  /carves/{env}/queries/{target}:
    get:
      tags:
        - carves
      summary: Get file carves queries
      description: Returns all file carves queries by target and environment
      operationId: CarveQueriesHandler
      parameters:
        - name: env
          in: path
          description: Name or UUID of the requested osctrl environment
          required: true
          schema:
            type: string
        - name: target
          in: path
          description: Carve target to retrieve (all, all-full, active, hidden-active, completed, expired, saved, hidden-completed, deleted, hidden)
          required: true
          schema:
            type: string
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/DistributedQuery"
        400:
          description: bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        403:
          description: no access
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        404:
          description: no queries
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        500:
          description: error getting queries
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
      security:
        - Authorization:
            - carve
  /carves/{env}/{name}:
    get:
      tags:
        - carves
      summary: Get a file carve
      description: Returns a file carve by environment and name
      operationId: CarveShowHandler
      parameters:
        - name: env
          in: path
          description: Name or UUID of the requested osctrl environment to get carves
          required: true
          schema:
            type: string
        - name: name
          in: path
          description: Name of the requested file carve
          required: true
          schema:
            type: string
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/CarvedFile"
        403:
          description: no access
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        404:
          description: no carves
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        500:
          description: error getting carve
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
      security:
        - Authorization:
            - carve
  /carves/{env}/{action}/{name}:
    post:
      tags:
        - carves
      summary: Execute action on file carve
      description: Executes an action (delete/expire) in the file carve by name and environment
      operationId: CarvesActionHandler
      parameters:
        - name: env
          in: path
          description: Name or UUID of the requested osctrl environment
          required: true
          schema:
            type: string
        - name: action
          in: path
          description: Action to execute (delete, expire)
          required: true
          schema:
            type: string
        - name: name
          in: path
          description: Name of the requested file carve
          required: true
          schema:
            type: string
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiGenericResponse"
        400:
          description: bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        403:
          description: no access
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        404:
          description: no queries
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        500:
          description: error getting queries
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
      security:
        - Authorization:
            - admin
  /users:
    get:
      tags:
        - users
      summary: Get users
      description: Returns all users in osctrl
      operationId: UsersHandler
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/AdminUser"
        403:
          description: no access
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        404:
          description: no users
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        500:
          description: error getting users
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
      security:
        - Authorization:
            - admin
  /users/{username}:
    get:
      tags:
        - users
      summary: Get a user
      description: Returns a single users in osctrl by username
      operationId: UserHandler
      parameters:
        - name: username
          in: path
          description: Username of the requested user
          required: true
          schema:
            type: string
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                type: object
                items:
                  $ref: "#/components/schemas/AdminUser"
        403:
          description: no access
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        404:
          description: no users
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        500:
          description: error getting users
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
      security:
        - Authorization:
            - admin
  /platforms:
    get:
      tags:
        - platforms
      summary: Get platforms
      description: Returns all platforms of enrolled nodes in osctrl
      operationId: PlatformsHandler
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                type: array
                items:
                  type: string
        403:
          description: no access
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        500:
          description: error getting platforms
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
      security:
        - Authorization:
            - admin
  /platforms/{env}:
    get:
      tags:
        - platforms
      summary: Get platforms
      description: Returns all platforms of enrolled nodes in osctrl by environment
      operationId: PlatformsEnvHandler
      parameters:
        - name: env
          in: path
          description: Name or UUID of the requested osctrl environment to get platforms
          required: true
          schema:
            type: string
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                type: array
                items:
                  type: string
        403:
          description: no access
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        404:
          description: no platforms
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        500:
          description: error getting platforms
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
      security:
        - Authorization:
            - admin
  /environments:
    get:
      tags:
        - environments
      summary: Get environments
      description: Returns all osctrl environments to enroll nodes
      operationId: EnvironmentsHandler
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/TLSEnvironment"
        403:
          description: no access
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        404:
          description: no environments
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        500:
          description: error getting environments
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
      security:
        - Authorization:
            - read
  /environments/{env}:
    get:
      tags:
        - environments
      summary: Get environment
      description: Returns the requested osctrl environment to enroll nodes
      operationId: EnvironmentHandler
      parameters:
        - name: env
          in: path
          description: Name or UUID of the requested osctrl environment
          required: true
          schema:
            type: string
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/TLSEnvironment"
        403:
          description: no access
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        500:
          description: error getting environment
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
      security:
        - Authorization:
            - read
  /environments/{env}/enroll/{target}:
    get:
      tags:
        - environments
      summary: Get enroll values for an environment
      description: Returns each of the node enrollment values (secret, certificate, flags, one-liner) for the requested osctrl environment
      operationId: EnvEnrollHandler
      parameters:
        - name: env
          in: path
          description: Name or UUID of the requested osctrl environment
          required: true
          schema:
            type: string
        - name: target
          in: path
          description: Target to retrieve (secret, cert, flags, enroll.sh, enroll.ps1)
          required: true
          schema:
            type: string
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/ApiDataResponse"
        400:
          description: bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        403:
          description: no access
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        404:
          description: no environments
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        500:
          description: error getting environments
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
      security:
        - Authorization:
            - read
    post:
      tags:
        - environments
      summary: Get enroll values for an environment
      description: Returns each of the node enrollment values (secret, certificate, flags, one-liner) for the requested osctrl environment
      operationId: EnvEnrollActionsHandler
      parameters:
        - name: env
          in: path
          description: Name or UUID of the requested osctrl environment
          required: true
          schema:
            type: string
        - name: target
          in: path
          description: Target to retrieve (secret, cert, flags, enroll.sh, enroll.ps1)
          required: true
          schema:
            type: string
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/ApiDataResponse"
        400:
          description: bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        403:
          description: no access
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        404:
          description: no environments
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        500:
          description: error getting environments
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
      security:
        - Authorization:
            - read
  /environments/{env}/enroll/{action}:
    post:
      tags:
        - environments
      summary: Perform enroll actions for an environment
      description: Executes an action (extend/rotate/expire/notexpire) in the enrollment URL for the requested osctrl environment
      operationId: EnvEnrollActionsHandler
      parameters:
        - name: env
          in: path
          description: Name or UUID of the requested osctrl environment
          required: true
          schema:
            type: string
        - name: action
          in: path
          description: Action to execute (extend, rotate, expire, notexpire)
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ApiActionsRequest"
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/ApiDataResponse"
        400:
          description: bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        403:
          description: no access
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        404:
          description: no environments
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        500:
          description: error getting environments
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
      security:
        - Authorization:
            - admin
  /environments/{env}/remove/{target}:
    get:
      tags:
        - environments
      summary: Get remove values for an environment
      description: Returns each of the node removal values (one-liner shell or powershell) for the requested osctrl environment
      operationId: EnvironmentHandler
      parameters:
        - name: env
          in: path
          description: Name or UUID of the requested osctrl environment
          required: true
          schema:
            type: string
        - name: target
          in: path
          description: Target to retrieve (remove.sh, remove.ps1)
          required: true
          schema:
            type: string
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/ApiDataResponse"
        400:
          description: bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        403:
          description: no access
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        404:
          description: no environments
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        500:
          description: error getting environments
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
      security:
        - Authorization:
            - read
  /environments/{env}/remove/{action}:
    post:
      tags:
        - environments
      summary: Perform remove actions for an environment
      description: Executes an action (extend/rotate/expire/notexpire) in the remove URL for the requested osctrl environment
      operationId: EnvRemoveActionsHandler
      parameters:
        - name: env
          in: path
          description: Name or UUID of the requested osctrl environment
          required: true
          schema:
            type: string
        - name: action
          in: path
          description: Action to execute (extend, rotate, expire, notexpire)
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ApiActionsRequest"
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/ApiDataResponse"
        400:
          description: bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        403:
          description: no access
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        404:
          description: no environments
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        500:
          description: error getting environments
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
      security:
        - Authorization:
            - admin
  /tags:
    get:
      tags:
        - tags
      summary: Get tags
      description: Returns all osctrl tags for enrolled nodes
      operationId: AllTagsHandler
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/AdminTag"
        403:
          description: no access
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        500:
          description: error getting tags
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
      security:
        - Authorization:
            - admin
  /tags/{env}:
    get:
      tags:
        - tags
      summary: Get tags
      description: Returns all osctrl tags for enrolled nodes by environment
      operationId: TagsEnvHandler
      parameters:
        - name: env
          in: path
          description: Name or UUID of the requested osctrl environment to get platforms
          required: true
          schema:
            type: string
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                type: array
                items:
                  type: string
        400:
          description: bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        403:
          description: no access
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        404:
          description: no tags
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        500:
          description: error getting tags
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
      security:
        - Authorization:
            - admin
  /settings:
    get:
      tags:
        - settings
      summary: Get settings
      description: Returns all osctrl services settings
      operationId: SettingsHandler
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/SettingValue"
        403:
          description: no access
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        500:
          description: error getting settings
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
      security:
        - Authorization:
            - admin
  /settings/{service}:
    get:
      tags:
        - settings
      summary: Get settings
      description: Returns all osctrl settings per service
      operationId: SettingsServiceHandler
      parameters:
        - name: service
          in: path
          description: Name of the service to retrieve settings, including JSON
          required: true
          schema:
            type: string
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/SettingValue"
        400:
          description: bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        403:
          description: no access
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        500:
          description: error getting settings
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
      security:
        - Authorization:
            - admin
  /settings/{service}/{env}:
    get:
      tags:
        - settings
      summary: Get settings
      description: Returns all osctrl settings per service and environment
      operationId: SettingsServiceHandler
      parameters:
        - name: service
          in: path
          description: Name of the service to retrieve settings, including JSON
          required: true
          schema:
            type: string
        - name: env
          in: path
          description: Name or UUID of the requested osctrl environment to get settings
          required: true
          schema:
            type: string
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/SettingValue"
        400:
          description: bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        403:
          description: no access
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        500:
          description: error getting settings
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
      security:
        - Authorization:
            - admin
  /settings/{service}/json:
    get:
      tags:
        - settings
      summary: Get JSON settings
      description: Returns JSON osctrl settings per service
      operationId: SettingsServiceJSONHandler
      parameters:
        - name: service
          in: path
          description: Name of the service to retrieve JSON only settings
          required: true
          schema:
            type: string
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/SettingValue"
        403:
          description: no access
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        500:
          description: error getting settings
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
      security:
        - Authorization:
            - admin
  /settings/{service}/json/{env}:
    get:
      tags:
        - settings
      summary: Get JSON settings
      description: Returns JSON osctrl settings per service
      operationId: SettingsServiceEnvJSONHandler
      parameters:
        - name: service
          in: path
          description: Name of the service to retrieve JSON only settings
          required: true
          schema:
            type: string
        - name: env
          in: path
          description: Name or UUID of the requested osctrl environment to get JSON settings
          required: true
          schema:
            type: string
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/SettingValue"
        400:
          description: bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        403:
          description: no access
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
        500:
          description: error getting settings
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiErrorResponse"
      security:
        - Authorization:
            - admin
components:
  schemas:
    OsqueryNode:
      type: object
      properties:
        ID:
          type: integer
          format: int32
        CreatedAt:
          type: string
          format: date-time
        UpdatedAt:
          type: string
          format: date-time
        DeletedAt:
          type: string
          format: date-time
        NodeKey:
          type: string
        UUID:
          type: string
        Platform:
          type: string
        PlatformVersion:
          type: string
        OsqueryVersion:
          type: string
        Hostname:
          type: string
        Localname:
          type: string
        IPAddress:
          type: string
        Username:
          type: string
        OsqueryUser:
          type: string
        Environment:
          type: string
        CPU:
          type: string
        Memory:
          type: string
        HardwareSerial:
          type: string
        DaemonHash:
          type: string
        ConfigHash:
          type: string
        BytesReceived:
          type: integer
          format: int32
        RawEnrollment:
          type: string
        LastStatus:
          type: string
          format: date-time
        LastResult:
          type: string
          format: date-time
        LastConfig:
          type: string
          format: date-time
        LastQueryRead:
          type: string
          format: date-time
        LastQueryWrite:
          type: string
          format: date-time
        UserID:
          type: integer
          format: int32
        EnvironmentID:
          type: integer
          format: int32
        ExtraData:
          type: string
    ApiNodeGenericRequest:
      type: object
      properties:
        uuid:
          type: string
    DistributedQuery:
      type: object
      properties:
        ID:
          type: integer
          format: int32
        CreatedAt:
          type: string
          format: date-time
        UpdatedAt:
          type: string
          format: date-time
        DeletedAt:
          type: string
          format: date-time
        Name:
          type: string
        Creator:
          type: string
        Query:
          type: string
        Expected:
          type: integer
          format: int32
        Executions:
          type: integer
          format: int32
        Errors:
          type: integer
          format: int32
        Active:
          type: boolean
        Hidden:
          type: boolean
        Protected:
          type: boolean
        Completed:
          type: boolean
        Deleted:
          type: boolean
        Type:
          type: string
        Path:
          type: string
        EnvironmentID:
          type: integer
          format: int32
        ExtraData:
          type: string
    ApiDistributedQueryRequest:
      type: object
      properties:
        uuid:
          type: string
        query:
          type: string
        hidden:
          type: boolean
    DistributedQueryRequest:
      type: object
      properties:
        environment_list:
          type: array
          items:
            type: string
        platform_list:
          type: array
          items:
            type: string
        uuid_list:
          type: array
          items:
            type: string
        host_list:
          type: array
          items:
            type: string
        query:
          type: string
    ApiQueriesResponse:
      type: object
      properties:
        query_name:
          type: string
    ApiErrorResponse:
      type: object
      properties:
        error:
          type: string
    APIQueryData:
      type: object
    CarvedFile:
      type: object
      properties:
        ID:
          type: integer
          format: int32
        CreatedAt:
          type: string
          format: date-time
        UpdatedAt:
          type: string
          format: date-time
        DeletedAt:
          type: string
          format: date-time
        CarveID:
          type: string
        RequestID:
          type: string
        SessionID:
          type: string
        QueryName:
          type: string
        UUID:
          type: string
        NodeID:
          type: integer
          format: int32
        Environment:
          type: string
        Path:
          type: string
        CarveSize:
          type: integer
          format: int32
        BlockSize:
          type: integer
          format: int32
        TotalBlocks:
          type: integer
          format: int32
        CompletedBlocks:
          type: integer
          format: int32
        Status:
          type: string
        CompletedAt:
          type: string
          format: date-time
        Carver:
          type: string
        Archived:
          type: boolean
        ArchivePath:
          type: string
        EnvironmentID:
          type: integer
          format: int32
    AdminUser:
      type: object
      properties:
        ID:
          type: integer
          format: int32
        CreatedAt:
          type: string
          format: date-time
        UpdatedAt:
          type: string
          format: date-time
        DeletedAt:
          type: string
          format: date-time
        Username:
          type: string
        Email:
          type: string
        Fullname:
          type: string
        PassHash:
          type: string
        APIToken:
          type: string
        TokenExpire:
          type: string
          format: date-time
        Admin:
          type: boolean
        UUID:
          type: string
        CSRFToken:
          type: string
        LastIPAddress:
          type: string
        LastUserAgent:
          type: string
        LastAccess:
          type: string
          format: date-time
        LastTokenUse:
          type: string
          format: date-time
        EnvironmentID:
          type: integer
          format: int32
    TLSEnvironment:
      type: object
      properties:
        ID:
          type: integer
          format: int32
        CreatedAt:
          type: string
          format: date-time
        UpdatedAt:
          type: string
          format: date-time
        DeletedAt:
          type: string
          format: date-time
        Name:
          type: string
        Hostname:
          type: string
        Secret:
          type: string
        EnrollSecretPath:
          type: string
        EnrollExpire:
          type: string
          format: date-time
        RemoveSecretPath:
          type: string
        RemoveExpire:
          type: string
          format: date-time
        Type:
          type: string
        DebPackage:
          type: string
        RpmPackage:
          type: string
        MsiPackage:
          type: string
        PkgPackage:
          type: string
        DebugHTTP:
          type: boolean
        Icon:
          type: string
        Options:
          type: string
        Schedule:
          type: string
        Packs:
          type: string
        Decorators:
          type: string
        ATC:
          type: string
        Configuration:
          type: string
        Flags:
          type: string
        Certificate:
          type: string
        ConfigTLS:
          type: boolean
        ConfigInterval:
          type: integer
          format: int32
        LoggingTLS:
          type: boolean
        LogInterval:
          type: integer
          format: int32
        QueryTLS:
          type: boolean
        QueryInterval:
          type: integer
          format: int32
        CarvesTLS:
          type: boolean
        EnrollPath:
          type: string
        LogPath:
          type: string
        ConfigPath:
          type: string
        QueryReadPath:
          type: string
        QueryWritePath:
          type: string
        CarverInitPath:
          type: string
        CarverBlockPath:
          type: string
        AcceptEnrolls:
          type: boolean
        UserID:
          type: integer
          format: int32
    AdminTag:
      type: object
      properties:
        ID:
          type: integer
          format: int32
        CreatedAt:
          type: string
          format: date-time
        UpdatedAt:
          type: string
          format: date-time
        DeletedAt:
          type: string
          format: date-time
        Name:
          type: string
        Description:
          type: string
        Color:
          type: string
        Icon:
          type: string
        CreatedBy:
          type: string
    SettingValue:
      type: object
      properties:
        ID:
          type: integer
          format: int32
        CreatedAt:
          type: string
          format: date-time
        UpdatedAt:
          type: string
          format: date-time
        DeletedAt:
          type: string
          format: date-time
        Name:
          type: string
        Service:
          type: string
        EnvironmentID:
          type: integer
          format: int32
        JSON:
          type: boolean
        Type:
          type: string
        String:
          type: string
        Boolean:
          type: boolean
        Integer:
          type: integer
          format: int64
        Info:
          type: string
    ApiActionsRequest:
      type: object
      properties:
        Certificate:
          type: string
        MacPkgURL:
          type: string
        MsiPkgURL:
          type: string
        RpmPkgURL:
          type: string
        DebPkgURL:
          type: string
  securitySchemes:
    Authorization:
      type: http
      scheme: bearer
      bearerFormat: JWT