openapi: 3.0.0
info:
  title: Advanced Settings
  description: Conditional Access Policy Advanced Settings API for ManageEngine ID360
  version: 1.0.0
servers:
  - url: 'https://id360.manageengine.com/idp/v1'
    description: 'API Endpoint'
tags:
  - name: cap-advanced-setting
    description: Conditional Access Policy Advanced Settings Endpoints
paths:

  /protection/conditional-access-policies/{id}/advanced-settings:
    get:
      tags:
        - cap-advanced-setting
      summary: Get Advanced Settings
      description: >
        Retrieve the advanced settings of a specific conditional access policy by ID.
        <br>
        <strong>Note:</strong> This API is currently internal
      parameters:
        - $ref: '#/components/parameters/acceptHeader'
        - $ref: '#/components/parameters/policyId'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/advancedSettingsResource'
        '404':
          description: 'Not Found'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/policyNotFound'
        '401':
          description: 'Unauthorized'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/unauthorized'
        '500':
          description: 'Internal Server Error'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/serverError'
      security:
        - Zoho_Auth:
            - id360.conditional_access_policy.read
            - id360.conditional_access_policy.all
    patch:
      tags:
        - conditional-access-policy
      summary: Update Advanced Settings
      description: >
        Update the advanced settings of a specific conditional access policy by ID.
        <strong>Note:</strong> This API is currently internal
      parameters:
        - $ref: '#/components/parameters/acceptHeader'
        - $ref: '#/components/parameters/policyId'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/advancedSettingsResource'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/advancedSettingsResource'
        '404':
          description: 'Not Found'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/policyNotFound'
        '401':
          description: 'Unauthorized'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/unauthorized'
        '500':
          description: 'Internal Server Error'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/serverError'
      security:
        - Zoho_Auth:
            - id360.conditional_access_policy.update
            - id360.conditional_access_policy.all'

components:
  parameters:
    acceptHeader:
      name: Accept
      in: header
      schema:
        type: string
      description: 'Accept header for the API'
      required: false
      example: 'application/json'
    policyId:
      in: path
      name: id
      required: true
      description: The ID of the conditional access policy.
      example: 2000000000001
      schema:
        type: integer
  schemas:
    # Conditional Access Policy Schemas
    gendoc-attributes-schema:
      type: object
      $ref: '#/components/schemas/advancedSettingsResource'

    # Conditional Access Policy Advanced settings
    advancedSettingsResource:
      type: object
      description: Advanced settings for conditional access policies.
      properties:
        is_captcha_enabled:
          type: boolean
          description: Indicates if CAPTCHA is enabled for the policy.
          example: true
        captcha_frequency_type:
          type: string
          description: Type of CAPTCHA frequency.
          enum:
            - always
            - after_failed_attempts
          example: always
        captcha_failed_attempts_threshold:
          type: integer
          description: Number of failed attempts before CAPTCHA is triggered.
          example: 3
        is_backup_codes_enabled:
          type: boolean
          description: Indicates if backup codes are enabled for the policy.
          example: false
        emailaddress_selection_mode:
          type: string
          description: Mode for selecting email addresses.
          enum:
            - primary
            - select
            - input
          example: primary
        mobileno_selection_mode:
          type: string
          description: Mode for selecting SMS numbers.
          enum:
            - primary
            - select
            - input
          example: select
        endpoint_settings:
          type: array
          description: List of endpoint settings for the conditional access policy.
          items:
            $ref: '#/components/schemas/endpointSetting'
    endpointSetting:
      type: object
      description: Configuration for endpoints in conditional access policies.
      properties:
        endpoint:
          type: string
          description: Endpoint for which the policy is applicable.
          enum:
            - ComputerDevices
            - NPS
            - IIS
            - SSOApplications
            - IdentityServer
          example: 'ComputerDevices'
        type:
          type: string
          description: >
            Type of the endpoint.
            <br>
            <ul>
              <li>
                ComputerDevices : 
                  <ul>
                    <li>ComputerDevices</li>
                  </ul>
              </li>
              <li>
                NPS : 
                  <ul>
                    <li>NPS_VPN</li>
                  </ul>
              </li>
              <li>
                IIS : 
                  <ul>
                    <li>IIS</li>
                  </ul>
              </li>
              <li>
                SSOApplications : 
                  <ul>
                    <li>SSOApplications</li>
                  </ul>
              </li>
              <li>
                IdentityServer : 
                  <ul>
                    <li>Login</li>
                    <li>SensitiveActions</li>
                  </ul>
              </li>
            </ul>
          example: 'ComputerDevices'
        advanced_settings:
          $ref: '#/components/schemas/endPointAdvancedSettings'

    endPointAdvancedSettings:
      type: object
      description: Advanced settings for the endpoint type.
      properties:
        mfa_timeout:
          type: integer
          description: Timeout for authentication completion in minutes.
          example: 5
        mfa_unenrolled_action:
          type: string
          description: Allow/Deny access partially enrolled users.
          enum:
            - allow
            - deny
          example: allow
        mfa_trust:
          $ref: '#/components/schemas/mfaTrust'
        radius_response_config:
          type: object
          description: Configuration for RADIUS response attributes. Only applicable for NPS.
          properties:
            is_enabled:
              type: boolean
              description: Indicates if RADIUS response attributes are enabled.
              example: true
            vendor_id:
              type: string
              description: >
                The unique number that denotes your VPN provider.
                <br>
                <strong>Note:</strong> In the case of Fortigate, the Vendor ID is 12356. Refer to your VPN provider's documentation to get the Vendor ID.
              example: '12356'
            attributes_list:
              type: array
              description: List of RADIUS attributes to be included in the response.
              items:
                type: object
                properties:
                  type:
                    type: string
                    description: Type of the RADIUS attribute (vendor or standard).
                    enum:
                      - vendor
                      - standard
                    example: vendor
                  number:
                    type: integer
                    description: Number of the RADIUS attribute.
                    example: 12
                  data_type:
                    type: string
                    description: Data type of the RADIUS attribute.
                    enum:
                      - string
                      - integer
                      - enum
                      - ipv4address
                      - ipv6address
                    example: string
                  value:
                    type: string
                    description: Value of the RADIUS attribute.
                    example: '12'
        notification_template_id:
          type: integer
          description: Unique identifier for the notification template.
          example: 200000012544
          writeOnly: true
        notification_template:
          type: object
          properties:
            id:
              type: integer
              description: Unique identifier for the notification template.
              example: 200000012544
            name:
              type: string
              description: Name of the notification template.
              example: 'Email Verification'
          readOnly: true

    mfaTrust:
      type: object
      description: Configuration for periodic MFA prompts.
      properties:
        is_enabled:
          type: boolean
          description: Indicates if periodic MFA prompts are enabled.
          example: true
        initiator_type:
          type: string
          description: Type of initiator for the periodic MFA prompts.
          enum:
            - user
            - admin
          example: user
        duration:
          type: object
          properties:
            value:
              type: integer
              description: Value of the trust duration.
              example: 30
            unit:
              type: string
              description: Unit of the trust duration.
              enum:
                - minutes
                - hours
                - days
              example: minutes

    policyNotFound:
      type: object
      properties:
        error:
          type: object
          properties:
            code:
              type: string
              example: '****'
            title:
              type: string
              example: 'Policy Not Found'
            detail:
              type: string
              example: 'The specified conditional access policy does not exist.'
    unauthorized:
      type: object
      properties:
        error:
          type: object
          properties:
            code:
              type: string
              example: '00000101'
            title:
              type: string
              example: 'Unauthorized'
            detail:
              type: string
              example: 'The OAuth token is invalid.'
    serverError:
      type: object
      properties:
        error:
          type: object
          properties:
            code:
              type: string
              example: '00000000'
            title:
              type: string
              example: 'Internal Server Error'
            detail:
              type: string
              example: 'An unexpected internal error has occurred on the server. Please try again later.'
  securitySchemes:
    Zoho_Auth:
      type: oauth2
      x-authorization-example: 'Zoho-oauthtoken 1000.41d9f2cfbd1b7a8f9e314b7aff7bc2d1.8fcc9810810a216793f385b9dd6e125f'
      flows:
        authorizationCode:
          authorizationUrl: 'https://accounts.zoho.com/oauth/v2/auth'
          tokenUrl: 'https://accounts.zoho.com/oauth/v2/token'
          scopes:
            id360.conditional_access_policy.read: 'Read access for management actions'
            id360.conditional_access_policy.write: 'Write access for management actions'
            id360.conditional_access_policy.create: 'Create access for management actions'
            id360.conditional_access_policy.delete: 'Delete access for management actions'
            id360.conditional_access_policy.update: 'Update access for management actions'
            id360.conditional_access_policy.all: 'All access for management actions'