threshold/internal/proto/local/controller/api/services/v1/account_service.proto

syntax = "proto3";

package controller.api.services.v1;

option go_package = "github.com/hashicorp/boundary/internal/gen/controller/api/services;services";

import "protoc-gen-openapiv2/options/annotations.proto";
import "google/api/annotations.proto";
import "google/protobuf/field_mask.proto";
import "google/protobuf/wrappers.proto";
import "controller/api/resources/accounts/v1/account.proto";

service AccountService {

  // GetAccount returns a stored Account if present. The provided request must
  // include the scope for the group being retrieved. If any of those ids are
  // missing, malformed or reference a non existing resource an error is
  // returned.
  rpc GetAccount(GetAccountRequest) returns (GetAccountResponse) {
    option (google.api.http) = {
        get: "/v1/accounts/{id}"
        response_body: "item"
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Gets a single Account"
    };
  }

  // ListAccounts returns a list of stored accounts which exist inside the
  // auth method referenced inside the request. The request must include the
  // auth method for the account being retrieved. If the auth method is missing,
  // malformed, or references a non-existing auth method, an error is returned.
  rpc ListAccounts(ListAccountsRequest) returns (ListAccountsResponse) {
    option (google.api.http) = {
      get: "/v1/accounts"
     };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Lists all accounts in a specific auth method."
    };
  }

  // CreateAccount creates and stores an account in boundary. The provided
  // request must include the auth method id in which the account will be created.
  // If the auth method id is missing, malformed or references a non existing
  // auth method, an error is returned. If a name is provided that is in
  // use in another account in the same auth method, an error is returned.
  rpc CreateAccount(CreateAccountRequest) returns (CreateAccountResponse) {
    option (google.api.http) = {
      post: "/v1/accounts"
      body: "item"
      response_body: "item"
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Creates a single account in the provided auth method."
    };
  }

  // UpdateAccount updates an existing account in boundary. The provided account
  // must not have any read only fields set. The update mask must be included in
  // the request and contain at least 1 mutable field. To unset a field's value,
  // include the field in the update mask and don't set it in the provided
  // account. An error is returned if either the auth method or account ids are
  // missing or reference a non-existing resource. An error is also returned if the
  // request attempts to update the name to one that is already in use in this
  // auth method.
  rpc UpdateAccount(UpdateAccountRequest) returns (UpdateAccountResponse) {
    option (google.api.http) = {
      patch: "/v1/accounts/{id}"
      body: "item"
      response_body: "item"
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Updates an account."
    };
  }

  // DeleteAccount removes an account from Boundary. If the provided auth mehtod
  // or account ids are malformed or not provided an error is returned. No error is
  // returned if either ids reference resources that do not exist as the
  // response itself specifies if the resource existed before the DeleteAccount
  // request was received.
  rpc DeleteAccount(DeleteAccountRequest) returns (DeleteAccountResponse) {
    option (google.api.http) = {
      delete: "/v1/accounts/{id}"
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Deletes an account."
    };
  }

  // SetPassword sets the account's password to the one provided in the
  // request. This method is intended for administration purpose and as such
  // does not require the old password.
  rpc SetPassword(SetPasswordRequest) returns (SetPasswordResponse) {
    option (google.api.http) = {
      post: "/v1/accounts/{id}:set-password"
      body: "*"
      response_body: "item"
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Sets the password for the provided account."
    };
  }

  // ChangePassword changes the account's password to the one provided in the
  // request. This method is intended for end users and requires the existing
  // password to be provided for authentication purposes.
  rpc ChangePassword(ChangePasswordRequest) returns (ChangePasswordResponse) {
    option (google.api.http) = {
      post: "/v1/accounts/{id}:change-password"
      body: "*"
      response_body: "item"
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Sets the password for the provided account."
    };
  }
}

message GetAccountRequest {
  string id = 1;
  string view = 2;
}

message GetAccountResponse {
  resources.accounts.v1.Account item = 1;
}

message ListAccountsRequest {
  string auth_method_id = 1;
  string view = 2;
}

message ListAccountsResponse {
  repeated resources.accounts.v1.Account items = 1;
}

message CreateAccountRequest {
  resources.accounts.v1.Account item = 2;
}

message CreateAccountResponse {
  string uri = 1;
  resources.accounts.v1.Account item = 2;
}

message UpdateAccountRequest {
  string id = 1;
  resources.accounts.v1.Account item = 2;
  google.protobuf.FieldMask update_mask = 3;
}

message UpdateAccountResponse {
  resources.accounts.v1.Account item = 1;
}

message DeleteAccountRequest {
  string id = 1;
}

message DeleteAccountResponse {}

message SetPasswordRequest {
  string id = 1;
  uint32 version = 2;
  string password = 3;
}

message SetPasswordResponse {
  resources.accounts.v1.Account item = 1;
}

message ChangePasswordRequest {
  string id = 1;
  uint32 version = 2;
  string current_password = 3 [json_name="current_password"];
  string new_password = 4 [json_name="new_password"];
}

message ChangePasswordResponse {
  resources.accounts.v1.Account item = 1;
}