Skip to main content
logoTetrate Service BridgeVersion: next

Teams Service

Service to manage Users and Teams in TSB

Teams​

The Teams service provides methods to manage the Users and Teams that exist in an Organization.

Users and Teams are periodically synchronized from the Identity Provider (IdP) configured for the Organization, but TSB allows creating local teams to provide extended flexibility in how Users and Teams are grouped, and to provide a comprehensive way of creating more fine-grained access control policies.

CreateUser​

GetUser​

UpdateUser​

ListUsers​

DeleteUser​

GenerateTokens​

CreateTeam​

GetTeam​

UpdateTeam​

ListTeams​

DeleteTeam​

CreateServiceAccount​

GetServiceAccount​

GetServiceAccountJWKS​

UpdateServiceAccount​

ListServiceAccounts​

DeleteServiceAccount​

GenerateServiceAccountKey​

AddServiceAccountKey​

DeleteServiceAccountKey​

AddServiceAccountKeyRequest​

Request to add a client-generated public key to the Service Account.

FieldDescriptionValidation Rule

fqn

string
REQUIRED
Fully-qualified name of the Service Account.

string = {
  min_len: 1
}

publicKey

string
REQUIRED
The RSA public key to add, encoded as a JSON Web Key. See: https://datatracker.ietf.org/doc/html/rfc7517 The key must have a kid, which becomes the ID of the key-pair and must be unique within the Service Account. Tokens created from this key must contain the same key ID in order for TSB to validate them. It is limited to 128 letters, digits and the characters -, . and _. If set, the alg field must be the one TSB verifies it with: RS256 for RSA keys, and the algorithm of the curve for ECDSA keys. Private keys are rejected, TSB only ever stores the public part of a key-pair.

string = {
  min_len: 1
}

CreateServiceAccountRequest​

Request to create a ServiceAccount.

FieldDescriptionValidation Rule

parent

string
REQUIRED
Parent resource where the User will be created.

string = {
  min_len: 1
}

name

string
REQUIRED
The short name for the resource to be created.

string = {
  min_len: 1
  max_len: 63
  pattern: ^[a-z0-9]([a-z0-9-]*[a-z0-9])?$
}

serviceAccount

tetrateio.api.tsb.v2.ServiceAccount
REQUIRED
Details of the Service Account to be created.

message = {
  required: true
}

keyEncoding

tetrateio.api.tsb.v2.ServiceAccount.KeyPair.Encoding
The format in which the generated key pairs will be returned. If not set keys are returned in PEM format.

–

publicKey

string
Public key to create the Service Account with, encoded as a JSON Web Key, for clients that want to bring their own keys. It has the same requirements as the key given to AddServiceAccountKey: it must be a public key with a kid, and the matching private key is never sent to TSB. When this is set TSB does not generate a key pair for the Service Account, so no private key is returned.

–

CreateTeamRequest​

Request to create a Team.

FieldDescriptionValidation Rule

parent

string
REQUIRED
Parent resource where the Team will be created.

string = {
  min_len: 1
}

name

string
REQUIRED
The short name for the resource to be created.

string = {
  min_len: 1
}

team

tetrateio.api.tsb.v2.Team
REQUIRED
Details of the Team to be created.

message = {
  required: true
}

CreateUserRequest​

Request to create a User.

FieldDescriptionValidation Rule

parent

string
REQUIRED
Parent resource where the User will be created.

string = {
  min_len: 1
}

name

string
REQUIRED
The short name for the resource to be created.

string = {
  min_len: 1
}

user

tetrateio.api.tsb.v2.User
REQUIRED
Details of the User to be created.

message = {
  required: true
}

DeleteServiceAccountKeyRequest​

Delete a key-pair associated with the Service Account.

FieldDescriptionValidation Rule

fqn

string
REQUIRED
Fully-qualified name of the Service Account.

string = {
  min_len: 1
}

id

string
REQUIRED
ID of the key-pair to delete.

string = {
  min_len: 1
}

DeleteServiceAccountRequest​

Request to delete a ServiceAccount.

FieldDescriptionValidation Rule

fqn

string
REQUIRED
Fully-qualified name of the Service Account.

string = {
  min_len: 1
}

DeleteTeamRequest​

Request to delete a Team.

FieldDescriptionValidation Rule

fqn

string
REQUIRED
Fully-qualified name of the Team.

string = {
  min_len: 1
}

DeleteUserRequest​

Request to delete a User.

FieldDescriptionValidation Rule

fqn

string
REQUIRED
Fully-qualified name of the User.

string = {
  min_len: 1
}

GenerateServiceAccountKeyRequest​

Request to generate a new key-pair for the Service Account.

FieldDescriptionValidation Rule

fqn

string
REQUIRED
Fully-qualified name of the Service Account.

string = {
  min_len: 1
}

keyEncoding

tetrateio.api.tsb.v2.ServiceAccount.KeyPair.Encoding
The format in which the key pairs will be returned. If not set keys are returned in PEM format.

–

GetServiceAccountJWKSRequest​

Request to retrieve all the public keys under a service account.

FieldDescriptionValidation Rule

fqn

string
REQUIRED
Fully-qualified name of the service account.

string = {
  min_len: 1
}

GetServiceAccountRequest​

Request to retrieve a Service Account.

FieldDescriptionValidation Rule

fqn

string
REQUIRED
Fully-qualified name of the Service Account.

string = {
  min_len: 1
}

keyEncoding

tetrateio.api.tsb.v2.ServiceAccount.KeyPair.Encoding
The format in which the key pairs will be returned. If not set keys are returned in PEM format.

–

GetTeamRequest​

Request to retrieve a Team.

FieldDescriptionValidation Rule

fqn

string
REQUIRED
Fully-qualified name of the Team.

string = {
  min_len: 1
}

GetUserRequest​

Request to retrieve a User.

FieldDescriptionValidation Rule

fqn

string
REQUIRED
Fully-qualified name of the User.

string = {
  min_len: 1
}

JWKS​

JSON Web Key Set. Refer to https://datatracker.ietf.org/doc/html/rfc7517

FieldDescriptionValidation Rule

keys

List of tetrateio.api.tsb.v2.JWKS.JWK
List of public JWKs

–

JWK​

JSON Web Key. Refer to https://datatracker.ietf.org/doc/html/rfc7517

FieldDescriptionValidation Rule

alg

string
The specific cryptographic algorithm used with the key.

–

kty

string
The family of cryptographic algorithms used with the key.

–

use

string
How the key was meant to be used; sig represents the signature.

–

n

string oneof _n
The modulus for the RSA public key. Only present in RSA keys.

–

e

string oneof _e
The exponent for the RSA public key. Only present in RSA keys.

–

kid

string
The unique identifier for the key.

–

crv

string oneof _crv
The curve the elliptic curve public key belongs to. Only present in elliptic curve keys.

–

x

string oneof _x
The x coordinate of the elliptic curve public key. Only present in elliptic curve keys.

–

y

string oneof _y
The y coordinate of the elliptic curve public key. Only present in elliptic curve keys.

–

ListServiceAccountsRequest​

Request to list Service Accounts.

FieldDescriptionValidation Rule

parent

string
REQUIRED
Parent resource to list Users from.

string = {
  min_len: 1
}

keyEncoding

tetrateio.api.tsb.v2.ServiceAccount.KeyPair.Encoding
The format in which the key pairs for each key will be returned. If not set keys are returned in PEM format.

–

ListServiceAccountsResponse​

List of existing Service Accounts.

FieldDescriptionValidation Rule

serviceAccounts

List of tetrateio.api.tsb.v2.ServiceAccount

–

ListTeamsRequest​

Request to list Teams.

FieldDescriptionValidation Rule

parent

string
REQUIRED
Parent resource to list Teams from.

string = {
  min_len: 1
}

pageSize

int32
Optional. Maximum number of items to return in one page. If zero and page_token is also empty, the response contains the complete, unpaginated list (the behavior prior to pagination support). Values above 1000 are rejected with INVALID_ARGUMENT naming the maximum, rather than being clamped to it — a clamped caller receives a smaller page than it asked for with nothing saying so. A non-empty page_token with a zero page_size uses a default page size of 50. Prefer setting page_size explicitly on every request of a walk: sending only the token falls back to that default rather than reusing the previous page's size. Negative values, and values between 1 and 9, are rejected with INVALID_ARGUMENT — small pages are disproportionately expensive to serve, so request at least 10 items per page.

–

pageToken

string
Optional. Opaque continuation token from a previous response's next_page_token. Tokens are bound to the query that issued them: replaying a token with a different parent or against a different List method is rejected with INVALID_ARGUMENT. A token confers no authority of its own: parent is validated on every request, so a resume whose parent no longer exists is rejected with NOT_FOUND rather than returning an empty page.

–

ListTeamsResponse​

List of existing teams.

FieldDescriptionValidation Rule

teams

List of tetrateio.api.tsb.v2.Team

–

nextPageToken

string
Opaque token for the next page. Empty when there are no further pages — this is the only end-of-list signal: a page may contain fewer items than page_size (even zero) while more pages remain. Item order is unspecified and not a stable contract.

–

totalSize

int32
Total number of items under parent that match this request and the caller is permitted to see, counted after permission filtering. Set on every response, paged or not, so a client never has to branch on whether it paginated to learn the count.

Exact on an unpaged response, where it is simply the number of items returned. On a paged response it is an UPPER BOUND: it counts authorized entries before they are loaded, so it can exceed what a full walk ultimately yields if an item is present in the authorization graph but absent from the store.

A zero always means the result is empty. This field is set on every response, so a zero never means the server declined to compute a total.

–

ListUsersRequest​

Request to list Users.

FieldDescriptionValidation Rule

parent

string
REQUIRED
Parent resource to list Users from.

string = {
  min_len: 1
}

pageSize

int32
Optional. Maximum number of items to return in one page. If zero and page_token is also empty, the response contains the complete, unpaginated list (the behavior prior to pagination support). Values above 1000 are rejected with INVALID_ARGUMENT naming the maximum, rather than being clamped to it — a clamped caller receives a smaller page than it asked for with nothing saying so. A non-empty page_token with a zero page_size uses a default page size of 50. Prefer setting page_size explicitly on every request of a walk: sending only the token falls back to that default rather than reusing the previous page's size. Negative values, and values between 1 and 9, are rejected with INVALID_ARGUMENT — small pages are disproportionately expensive to serve, so request at least 10 items per page.

–

pageToken

string
Optional. Opaque continuation token from a previous response's next_page_token. Tokens are bound to the query that issued them: replaying a token with a different parent or against a different List method is rejected with INVALID_ARGUMENT. A token confers no authority of its own: parent is validated on every request, so a resume whose parent no longer exists is rejected with NOT_FOUND rather than returning an empty page.

–

ListUsersResponse​

List of existing Users.

FieldDescriptionValidation Rule

users

List of tetrateio.api.tsb.v2.User

–

nextPageToken

string
Opaque token for the next page. Empty when there are no further pages — this is the only end-of-list signal: a page may contain fewer items than page_size (even zero) while more pages remain. Item order is unspecified and not a stable contract.

–

totalSize

int32
Total number of items under parent that match this request and the caller is permitted to see, counted after permission filtering. Set on every response, paged or not, so a client never has to branch on whether it paginated to learn the count.

Exact on an unpaged response, where it is simply the number of items returned. On a paged response it is an UPPER BOUND: it counts authorized entries before they are loaded, so it can exceed what a full walk ultimately yields if an item is present in the authorization graph but absent from the store.

A zero always means the result is empty. This field is set on every response, so a zero never means the server declined to compute a total.

–

TokenResponse​

Contains a pair of tokens for a user that can be used to authenticate against TSB.

FieldDescriptionValidation Rule

accessToken

string
Bearer access token that can be used to access TSB. This token is usually short-lived. The refresh token, when present, can be used to obtain a new access token when it expires.

–

refreshToken

string
Refresh token that can be used to obtain a new Bearer access token. This token is usually long-lived and should be stored securely.

–