openapi: 3.1.0
info:
  title: Lakekeeper＋ Management API
  description: Lakekeeper is a rust-native Apache Iceberg REST Catalog implementation. The Management API provides endpoints to manage the server, projects, warehouses, users, and roles. If Authorization is enabled, permissions can also be managed. An interactive Swagger-UI for the specific Lakekeeper Version and configuration running is available at `/swagger-ui/#/` of Lakekeeper (by default [http://localhost:8181/swagger-ui/#/](http://localhost:8181/swagger-ui/#/)).
  license:
    name: Vakamo Enterprise License
  version: 0.0.0
servers:
  - url: '{scheme}://{host}{basePath}'
    description: Lakekeeper Management API
    variables:
      basePath:
        default: ''
        description: Optional path prefix (starting with '/') to be prepended to all routes
      host:
        default: localhost
        description: The host (and optional port) for the specified server
      scheme:
        default: https
        description: The scheme of the URI, either http or https
paths:
  /management/v1/action/batch-check:
    post:
      tags:
        - authorization
      summary: Batch Check Catalog Actions
      description: |-
        Performs authorization checks for multiple catalog actions in a single request.
        This endpoint allows checking permissions across different resource types (servers, projects,
        warehouses, namespaces, tables, and views) efficiently.

        The endpoint supports:
        - Checking actions for different identities (users or roles)
        - Mixing different resource types in a single batch
        - Optional error-on-not-found behavior (default: treat missing resources as denied)

        Each check in the request can optionally override the identity being checked.
        If no identity is specified, the current user's identity is used.
      operationId: batch_check_actions
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CatalogActionsBatchCheckRequest'
        required: true
      responses:
        '200':
          description: Batch check results
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CatalogActionsBatchCheckResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/bootstrap:
    post:
      tags:
        - server
      summary: Bootstrap
      description: |-
        Initializes the Lakekeeper server and sets the initial administrator account.
        This operation can only be performed once.
      operationId: bootstrap
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/BootstrapRequest'
        required: true
      responses:
        '204':
          description: Server bootstrapped successfully
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
        '500':
          description: InternalError
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/endpoint-statistics:
    post:
      tags:
        - project
      summary: Get API Statistics
      description: |-
        Retrieves detailed endpoint call statistics for your project, allowing you to monitor API usage patterns,
        track frequency of operations, and analyze response codes.

        ## Data Collection

        The statistics include:
        - Endpoint paths and HTTP methods
        - Response status codes
        - Call counts per endpoint
        - Warehouse context (when applicable)
        - Timestamps of activity

        ## Time Aggregation

        Statistics are aggregated hourly. Within each hour window:
        - An initial entry is created on the first API call
        - Subsequent calls update the existing hourly entry
        - Each hour boundary creates a new aggregation bucket
        - Hours with no API activity have no entries (gaps in data)

        ## Response Format

        The response includes timestamp buckets (in UTC) and corresponding endpoint metrics,
        allowing for time-series analysis of API usage patterns.

        Example:
        - 00:00:00-00:16:32: no activity
            - `timestamps: []`
        - 00:16:32: warehouse created:
            - `{timestamps: ["01:00:00"], called_endpoints: [[{"count": 1, "http_route": "POST /management/v1/warehouse", "status_code": 201, "warehouse_id": null, "warehouse_name": null, "created_at": "00:16:32", "updated_at": null}]]}`
        - 00:30:00: table created:
            - `timestamps: ["01:00:00"], called_endpoints: [[{"count": 1, "http_route": "POST /management/v1/warehouse", "status_code": 201, "warehouse_id": null, "warehouse_name": null, "created_at": "00:16:32", "updated_at": null}, {"count": 1, "http_route": "POST /catalog/v1/{prefix}/namespaces/{namespace}/tables", "status_code": 201, "warehouse_id": "ff17f1d0-90ad-4e7d-bf02-be718b78c2ee", "warehouse_name": "staging", "created_at": "00:30:00", "updated_at": null}]]`
        - 00:45:00: table created:
            - `timestamps: ["01:00:00"], called_endpoints: [[{"count": 1, "http_route": "POST /management/v1/warehouse", "status_code": 201, "warehouse_id": null, "warehouse_name": null, "created_at": "00:16:32", "updated_at": null}, {"count": 1, "http_route": "POST /catalog/v1/{prefix}/namespaces/{namespace}/tables", "status_code": 201, "warehouse_id": "ff17f1d0-90ad-4e7d-bf02-be718b78c2ee", "warehouse_name": "staging", "created_at": "00:30:00", "updated_at": "00:45:00"}]]`
        - 01:00:36: table deleted:
            - `timestamps: ["01:00:00","02:00:00"], called_endpoints: [[{"count": 1, "http_route": "POST /management/v1/warehouse", "status_code": 201, "warehouse_id": null, "warehouse_name": null, "created_at": "00:16:32", "updated_at": null},{"count": 1, "http_route": "POST /catalog/v1/{prefix}/namespaces/{namespace}/tables", "status_code": 201, "warehouse_id": "ff17f1d0-90ad-4e7d-bf02-be718b78c2ee", "warehouse_name": "staging", "created_at": "00:30:00", "updated_at": "00:45:00"}],[{"count": 1, "http_route": "DELETE /catalog/v1/{prefix}/namespaces/{namespace}/tables/{table}", "status_code": 200, "warehouse_id": "ff17f1d0-90ad-4e7d-bf02-be718b78c2ee", "warehouse_name": "staging", "created_at": "01:00:36", "updated_at": "null"}]]`
      operationId: get_endpoint_statistics
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GetEndpointStatisticsRequest'
        required: true
      responses:
        '200':
          description: Endpoint statistics
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EndpointStatisticsResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/info:
    get:
      tags:
        - server
      summary: Get Server Info
      description: Returns basic information about the server configuration and status.
      operationId: get_server_info
      responses:
        '200':
          description: Server info
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServerInfo'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
        '500':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/permissions/cedar/entity-sources:
    get:
      tags:
        - permissions-cedar
      summary: Get information about active cedar entity sources
      operationId: list_cedar_entity_sources
      responses:
        '200':
          description: Active cedar entity sources
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListCedarEntitySourcesResponse'
  /management/v1/permissions/cedar/policy-list:
    post:
      tags:
        - permissions-cedar
      summary: Get active Cedar policies
      operationId: list_cedar_policies
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ListCedarPoliciesQuery'
        required: true
      responses:
        '200':
          description: Active policies that match the query
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetCedarPoliciesResponse'
  /management/v1/permissions/cedar/policy-sources:
    get:
      tags:
        - permissions-cedar
      summary: Get information about active cedar policy sources
      operationId: list_cedar_policy_sources
      responses:
        '200':
          description: Active cedar policy sources
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListCedarPolicySourcesResponse'
  /management/v1/permissions/cedar/resolve-entities:
    post:
      tags:
        - permissions-cedar
      summary: |-
        Resolve Cedar entities for a given resource, returning the full entity
        hierarchy that would be used in an authorization decision.
      description: |-
        Follows the `emit_authz` pattern: event context is built upfront, and ALL
        fallible work runs inside a single async block whose `Result` is passed to
        `emit_authz`. Every failure — catalog errors, role-lookup failures,
        authorization denials — is audited.

        Authorization gate: `IntrospectAuthorization` on the target resource, checked
        via the upstream `require_*_action` / `load_and_authorize_*` helpers (parallel
        fetches, TOCTOU-safe cache refresh, canonical error handling).
      operationId: resolve_cedar_entities
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ResolveCedarEntitiesRequest'
        required: true
      responses:
        '200':
          description: Resolved Cedar entities
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResolveCedarEntitiesResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/permissions/cedar/schema:
    get:
      tags:
        - permissions-cedar
      summary: Get the currently active Cedar schema.
      operationId: get_cedar_schema
      responses:
        '200':
          description: Currently active cedar schema
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetCedarSchemaResponse'
  /management/v1/permissions/check:
    post:
      tags:
        - permissions-openfga
      summary: Check if a specific action is allowed on the given object
      operationId: check
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CheckRequest'
        required: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CheckResponse'
  /management/v1/permissions/namespace/{namespace_id}:
    get:
      tags:
        - permissions-openfga
      summary: Get Authorization properties of a namespace
      operationId: get_namespace_by_id
      parameters:
        - name: namespace_id
          in: path
          description: Namespace ID
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetNamespaceAuthPropertiesResponse'
  /management/v1/permissions/namespace/{namespace_id}/access:
    get:
      tags:
        - permissions-openfga
      summary: Get my access to a namespace
      description: |-
        **Deprecated:** Use `/management/v1/permissions/namespace/{namespace_id}/authorizer-actions` for Authorizer permissions
        or `/management/v1/warehouse/{warehouse_id}/namespace/{namespace_id}/actions` for Catalog permissions instead.
      operationId: get_namespace_access_by_id
      parameters:
        - name: principalUser
          in: query
          description: |-
            The user to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
        - name: principalRole
          in: query
          description: |-
            The role to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
            format: uuid
        - name: namespace_id
          in: path
          description: Namespace ID
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: Server Relations
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetNamespaceAccessResponse'
      deprecated: true
  /management/v1/permissions/namespace/{namespace_id}/assignments:
    get:
      tags:
        - permissions-openfga
      summary: Get user and role assignments for a namespace
      operationId: get_namespace_assignments_by_id
      parameters:
        - name: relations
          in: query
          description: Relations to be loaded. If not specified, all relations are returned.
          required: false
          schema:
            type: array
            items:
              $ref: '#/components/schemas/NamespaceRelation'
        - name: namespace_id
          in: path
          description: Namespace ID
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetNamespaceAssignmentsResponse'
    post:
      tags:
        - permissions-openfga
      summary: Update permissions for a namespace
      operationId: update_namespace_assignments_by_id
      parameters:
        - name: namespace_id
          in: path
          description: Namespace ID
          required: true
          schema:
            type: string
            format: uuid
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateNamespaceAssignmentsRequest'
        required: true
      responses:
        '204':
          description: Permissions updated successfully
  /management/v1/permissions/namespace/{namespace_id}/authorizer-actions:
    get:
      tags:
        - permissions-openfga
      summary: Get allowed Authorizer actions on a namespace
      description: |-
        Returns Authorizer permissions (OpenFGA relations) for the specified namespace.
        For Catalog permissions, use `/management/v1/warehouse/{warehouse_id}/namespace/{namespace_id}/actions` instead.
      operationId: get_authorizer_namespace_actions
      parameters:
        - name: principalUser
          in: query
          description: |-
            The user to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
        - name: principalRole
          in: query
          description: |-
            The role to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
            format: uuid
        - name: namespace_id
          in: path
          description: Namespace ID
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: Namespace Authorizer Actions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetOpenFGANamespaceActionsResponse'
  /management/v1/permissions/namespace/{namespace_id}/managed-access:
    post:
      tags:
        - permissions-openfga
      summary: Set managed access property of a namespace
      operationId: set_namespace_managed_access
      parameters:
        - name: namespace_id
          in: path
          description: Namespace ID
          required: true
          schema:
            type: string
            format: uuid
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SetManagedAccessRequest'
        required: true
      responses:
        '200':
          description: ''
  /management/v1/permissions/project/access:
    get:
      tags:
        - permissions-openfga
      summary: Get my access to the default project
      description: |-
        **Deprecated:** Use `/management/v1/permissions/project/authorizer-actions` for Authorizer permissions
        or `/management/v1/project/actions` for Catalog permissions instead.
      operationId: get_project_access
      parameters:
        - name: principalUser
          in: query
          description: |-
            The user to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
        - name: principalRole
          in: query
          description: |-
            The role to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: Server Relations
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetProjectAccessResponse'
      deprecated: true
  /management/v1/permissions/project/assignments:
    get:
      tags:
        - permissions-openfga
      summary: Get user and role assignments of a project
      operationId: get_project_assignments
      parameters:
        - name: relations
          in: query
          description: Relations to be loaded. If not specified, all relations are returned.
          required: false
          schema:
            type: array
            items:
              $ref: '#/components/schemas/ProjectRelation'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetProjectAssignmentsResponse'
    post:
      tags:
        - permissions-openfga
      summary: Update permissions for the default project
      operationId: update_project_assignments
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateProjectAssignmentsRequest'
        required: true
      responses:
        '204':
          description: Permissions updated successfully
  /management/v1/permissions/project/authorizer-actions:
    get:
      tags:
        - permissions-openfga
      summary: Get allowed Authorizer actions on the default project
      description: |-
        Returns Authorizer permissions (OpenFGA relations) for the default project.
        For Catalog permissions, use `/management/v1/project/actions` instead.
      operationId: get_authorizer_project_actions
      parameters:
        - name: principalUser
          in: query
          description: |-
            The user to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
        - name: principalRole
          in: query
          description: |-
            The role to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
            format: uuid
        - name: x-project-id
          in: header
          description: Optional project ID
          required: false
          schema:
            type:
              - string
              - 'null'
      responses:
        '200':
          description: Project Authorizer Actions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetOpenFGAProjectActionsResponse'
  /management/v1/permissions/project/{project_id}/access:
    get:
      tags:
        - permissions-openfga
      summary: Get my access to a project
      description: |-
        **Deprecated:** Use `/management/v1/permissions/project/authorizer-actions` for Authorizer permissions
        or `/management/v1/project/actions` for Catalog permissions instead.
      operationId: get_project_access_by_id
      parameters:
        - name: principalUser
          in: query
          description: |-
            The user to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
        - name: principalRole
          in: query
          description: |-
            The role to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
            format: uuid
        - name: project_id
          in: path
          description: Project ID (optional; falls back to the default project if not provided)
          required: true
          schema:
            type:
              - string
              - 'null'
      responses:
        '200':
          description: Server Relations
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetProjectAccessResponse'
      deprecated: true
  /management/v1/permissions/project/{project_id}/assignments:
    get:
      tags:
        - permissions-openfga
      summary: Get user and role assignments to a project
      description: '**Deprecated:** Use `/management/v1/permissions/project/assignments` instead.'
      operationId: get_project_assignments_by_id
      parameters:
        - name: relations
          in: query
          description: Relations to be loaded. If not specified, all relations are returned.
          required: false
          schema:
            type: array
            items:
              $ref: '#/components/schemas/ProjectRelation'
        - name: project_id
          in: path
          description: Project ID (optional; falls back to the default project if not provided)
          required: true
          schema:
            type:
              - string
              - 'null'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetProjectAssignmentsResponse'
      deprecated: true
    post:
      tags:
        - permissions-openfga
      summary: Update permissions for a project
      operationId: update_project_assignments_by_id
      parameters:
        - name: project_id
          in: path
          description: Project ID (optional; falls back to the default project if not provided)
          required: true
          schema:
            type:
              - string
              - 'null'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateProjectAssignmentsRequest'
        required: true
      responses:
        '204':
          description: Permissions updated successfully
  /management/v1/permissions/role/{role_id}/access:
    get:
      tags:
        - permissions-openfga
      summary: Get my access to a role
      description: |-
        **Deprecated:** Use `/management/v1/permissions/role/{role_id}/authorizer-actions` for Authorizer permissions
        or `/management/v1/role/{role_id}/actions` for Catalog permissions instead.
      operationId: get_role_access_by_id
      parameters:
        - name: role_id
          in: path
          description: Role ID
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetRoleAccessResponse'
      deprecated: true
  /management/v1/permissions/role/{role_id}/assignments:
    get:
      tags:
        - permissions-openfga
      summary: Get user and role assignments of a role
      operationId: get_role_assignments_by_id
      parameters:
        - name: relations
          in: query
          description: Relations to be loaded. If not specified, all relations are returned.
          required: false
          schema:
            type: array
            items:
              $ref: '#/components/schemas/RoleRelation'
        - name: role_id
          in: path
          description: Role ID
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetRoleAssignmentsResponse'
    post:
      tags:
        - permissions-openfga
      operationId: update_role_assignments_by_id
      parameters:
        - name: role_id
          in: path
          description: Role ID
          required: true
          schema:
            type: string
            format: uuid
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateRoleAssignmentsRequest'
        required: true
      responses:
        '204':
          description: Permissions updated successfully
  /management/v1/permissions/role/{role_id}/authorizer-actions:
    get:
      tags:
        - permissions-openfga
      summary: Get allowed Authorizer actions on a role
      description: |-
        Returns Authorizer permissions (OpenFGA relations) for the specified role.
        For Catalog permissions, use `/management/v1/role/{role_id}/actions` instead.
      operationId: get_authorizer_role_actions
      parameters:
        - name: principalUser
          in: query
          description: |-
            The user to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
        - name: principalRole
          in: query
          description: |-
            The role to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
            format: uuid
        - name: role_id
          in: path
          description: Role ID
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetOpenFGARoleActionsResponse'
  /management/v1/permissions/server/access:
    get:
      tags:
        - permissions-openfga
      summary: Get my access to the server
      description: |-
        **Deprecated:** Use `/management/v1/permissions/server/authorizer-actions` for Authorizer permissions
        or `/management/v1/server/actions` for Catalog permissions instead.
      operationId: get_server_access
      parameters:
        - name: principalUser
          in: query
          description: |-
            The user to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
        - name: principalRole
          in: query
          description: |-
            The role to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: Server Access
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetServerAccessResponse'
      deprecated: true
  /management/v1/permissions/server/assignments:
    get:
      tags:
        - permissions-openfga
      summary: Get user and role assignments of the server
      operationId: get_server_assignments
      parameters:
        - name: relations
          in: query
          description: Relations to be loaded. If not specified, all relations are returned.
          required: false
          schema:
            type: array
            items:
              $ref: '#/components/schemas/ServerRelation'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetServerAssignmentsResponse'
    post:
      tags:
        - permissions-openfga
      summary: Update permissions for this server
      operationId: update_server_assignments
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateServerAssignmentsRequest'
        required: true
      responses:
        '204':
          description: Permissions updated successfully
  /management/v1/permissions/server/authorizer-actions:
    get:
      tags:
        - permissions-openfga
      summary: Get allowed Authorizer actions on the server
      description: |-
        Returns Authorizer permissions (OpenFGA relations) for the server.
        For Catalog permissions, use `/management/v1/server/actions` instead.
      operationId: get_authorizer_server_actions
      parameters:
        - name: principalUser
          in: query
          description: |-
            The user to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
        - name: principalRole
          in: query
          description: |-
            The role to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: Server Access
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetOpenFGAServerActionsResponse'
  /management/v1/permissions/warehouse/{warehouse_id}:
    get:
      tags:
        - permissions-openfga
      summary: Get Authorization properties of a warehouse
      operationId: get_warehouse_by_id
      parameters:
        - name: warehouse_id
          in: path
          description: Warehouse ID
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetWarehouseAuthPropertiesResponse'
  /management/v1/permissions/warehouse/{warehouse_id}/access:
    get:
      tags:
        - permissions-openfga
      summary: Get my access to a warehouse
      description: |-
        **Deprecated:** Use `/management/v1/permissions/warehouse/{warehouse_id}/authorizer-actions` for Authorizer permissions
        or `/management/v1/warehouse/{warehouse_id}/actions` for Catalog permissions instead.
      operationId: get_warehouse_access_by_id
      parameters:
        - name: principalUser
          in: query
          description: |-
            The user to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
        - name: principalRole
          in: query
          description: |-
            The role to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
            format: uuid
        - name: warehouse_id
          in: path
          description: Warehouse ID
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetWarehouseAccessResponse'
      deprecated: true
  /management/v1/permissions/warehouse/{warehouse_id}/assignments:
    get:
      tags:
        - permissions-openfga
      summary: Get user and role assignments for a warehouse
      operationId: get_warehouse_assignments_by_id
      parameters:
        - name: relations
          in: query
          description: Relations to be loaded. If not specified, all relations are returned.
          required: false
          schema:
            type: array
            items:
              $ref: '#/components/schemas/WarehouseRelation'
        - name: warehouse_id
          in: path
          description: Warehouse ID
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetWarehouseAssignmentsResponse'
    post:
      tags:
        - permissions-openfga
      summary: Update permissions for a warehouse
      operationId: update_warehouse_assignments_by_id
      parameters:
        - name: warehouse_id
          in: path
          description: Warehouse ID
          required: true
          schema:
            type: string
            format: uuid
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateWarehouseAssignmentsRequest'
        required: true
      responses:
        '204':
          description: Permissions updated successfully
  /management/v1/permissions/warehouse/{warehouse_id}/authorizer-actions:
    get:
      tags:
        - permissions-openfga
      summary: Get allowed Authorizer actions on a warehouse
      description: |-
        Returns Authorizer permissions (OpenFGA relations) for the specified warehouse.
        For Catalog permissions, use `/management/v1/warehouse/{warehouse_id}/actions` instead.
      operationId: get_authorizer_warehouse_actions
      parameters:
        - name: principalUser
          in: query
          description: |-
            The user to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
        - name: principalRole
          in: query
          description: |-
            The role to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
            format: uuid
        - name: warehouse_id
          in: path
          description: Warehouse ID
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: Warehouse Authorizer Actions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetOpenFGAWarehouseActionsResponse'
  /management/v1/permissions/warehouse/{warehouse_id}/generic-table/{generic_table_id}/assignments:
    get:
      tags:
        - permissions-openfga
      summary: Get user and role assignments for a generic table
      operationId: get_generic_table_assignments_by_id
      parameters:
        - name: relations
          in: query
          description: Relations to be loaded. If not specified, all relations are returned.
          required: false
          schema:
            type: array
            items:
              $ref: '#/components/schemas/GenericTableRelation'
        - name: warehouse_id
          in: path
          description: Warehouse ID
          required: true
          schema:
            type: string
            format: uuid
        - name: generic_table_id
          in: path
          description: Generic Table ID
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetGenericTableAssignmentsResponse'
    post:
      tags:
        - permissions-openfga
      summary: Update permissions for a generic table
      operationId: update_generic_table_assignments_by_id
      parameters:
        - name: warehouse_id
          in: path
          description: Warehouse ID
          required: true
          schema:
            type: string
            format: uuid
        - name: generic_table_id
          in: path
          description: Generic Table ID
          required: true
          schema:
            type: string
            format: uuid
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateGenericTableAssignmentsRequest'
        required: true
      responses:
        '204':
          description: Permissions updated successfully
  /management/v1/permissions/warehouse/{warehouse_id}/generic-table/{generic_table_id}/authorizer-actions:
    get:
      tags:
        - permissions-openfga
      summary: Get allowed Authorizer actions on a generic table
      description: |-
        Returns Authorizer permissions (OpenFGA relations) for the specified generic table.
        For Catalog permissions, use `/management/v1/warehouse/{warehouse_id}/generic-table/{generic_table_id}/actions` instead.
      operationId: get_authorizer_generic_table_actions
      parameters:
        - name: principalUser
          in: query
          description: |-
            The user to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
        - name: principalRole
          in: query
          description: |-
            The role to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
            format: uuid
        - name: warehouse_id
          in: path
          description: Warehouse ID
          required: true
          schema:
            type: string
            format: uuid
        - name: generic_table_id
          in: path
          description: Generic Table ID
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: Generic Table Authorizer Actions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetOpenFGAGenericTableActionsResponse'
  /management/v1/permissions/warehouse/{warehouse_id}/managed-access:
    post:
      tags:
        - permissions-openfga
      summary: Set managed access property of a warehouse
      operationId: set_warehouse_managed_access
      parameters:
        - name: warehouse_id
          in: path
          description: Warehouse ID
          required: true
          schema:
            type: string
            format: uuid
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SetManagedAccessRequest'
        required: true
      responses:
        '200':
          description: ''
  /management/v1/permissions/warehouse/{warehouse_id}/table/{table_id}/access:
    get:
      tags:
        - permissions-openfga
      summary: Get my access to a table
      description: |-
        **Deprecated:** Use `/management/v1/permissions/warehouse/{warehouse_id}/table/{table_id}/authorizer-actions` for Authorizer permissions
        or `/management/v1/warehouse/{warehouse_id}/table/{table_id}/actions` for Catalog permissions instead.
      operationId: get_table_access_by_id
      parameters:
        - name: principalUser
          in: query
          description: |-
            The user to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
        - name: principalRole
          in: query
          description: |-
            The role to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
            format: uuid
        - name: warehouse_id
          in: path
          description: Warehouse ID
          required: true
          schema:
            type: string
            format: uuid
        - name: table_id
          in: path
          description: Table ID
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: Server Relations
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetTableAccessResponse'
      deprecated: true
  /management/v1/permissions/warehouse/{warehouse_id}/table/{table_id}/assignments:
    get:
      tags:
        - permissions-openfga
      summary: Get user and role assignments for a table
      operationId: get_table_assignments_by_id
      parameters:
        - name: relations
          in: query
          description: Relations to be loaded. If not specified, all relations are returned.
          required: false
          schema:
            type: array
            items:
              $ref: '#/components/schemas/TableRelation'
        - name: warehouse_id
          in: path
          description: Warehouse ID
          required: true
          schema:
            type: string
            format: uuid
        - name: table_id
          in: path
          description: Table ID
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetTableAssignmentsResponse'
    post:
      tags:
        - permissions-openfga
      summary: Update permissions for a table
      operationId: update_table_assignments_by_id
      parameters:
        - name: warehouse_id
          in: path
          description: Warehouse ID
          required: true
          schema:
            type: string
            format: uuid
        - name: table_id
          in: path
          description: Table ID
          required: true
          schema:
            type: string
            format: uuid
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateTableAssignmentsRequest'
        required: true
      responses:
        '204':
          description: Permissions updated successfully
  /management/v1/permissions/warehouse/{warehouse_id}/table/{table_id}/authorizer-actions:
    get:
      tags:
        - permissions-openfga
      summary: Get allowed Authorizer actions on a table
      description: |-
        Returns Authorizer permissions (OpenFGA relations) for the specified table.
        For Catalog permissions, use `/management/v1/warehouse/{warehouse_id}/table/{table_id}/actions` instead.
      operationId: get_authorizer_table_actions
      parameters:
        - name: principalUser
          in: query
          description: |-
            The user to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
        - name: principalRole
          in: query
          description: |-
            The role to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
            format: uuid
        - name: warehouse_id
          in: path
          description: Warehouse ID
          required: true
          schema:
            type: string
            format: uuid
        - name: table_id
          in: path
          description: Table ID
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: Table Authorizer Actions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetOpenFGATableActionsResponse'
  /management/v1/permissions/warehouse/{warehouse_id}/view/{view_id}/access:
    get:
      tags:
        - permissions-openfga
      summary: Get my access to a view
      description: |-
        **Deprecated:** Use `/management/v1/permissions/warehouse/{warehouse_id}/view/{view_id}/authorizer-actions` for Authorizer permissions
        or `/management/v1/warehouse/{warehouse_id}/view/{view_id}/actions` for Catalog permissions instead.
      operationId: get_view_access_by_id
      parameters:
        - name: principalUser
          in: query
          description: |-
            The user to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
        - name: principalRole
          in: query
          description: |-
            The role to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
            format: uuid
        - name: warehouse_id
          in: path
          description: Warehouse ID
          required: true
          schema:
            type: string
            format: uuid
        - name: view_id
          in: path
          description: View ID
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetViewAccessResponse'
      deprecated: true
  /management/v1/permissions/warehouse/{warehouse_id}/view/{view_id}/assignments:
    get:
      tags:
        - permissions-openfga
      summary: Get user and role assignments for a view
      operationId: get_view_assignments_by_id
      parameters:
        - name: relations
          in: query
          description: Relations to be loaded. If not specified, all relations are returned.
          required: false
          schema:
            type: array
            items:
              $ref: '#/components/schemas/ViewRelation'
        - name: warehouse_id
          in: path
          description: Warehouse ID
          required: true
          schema:
            type: string
            format: uuid
        - name: view_id
          in: path
          description: View ID
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetViewAssignmentsResponse'
    post:
      tags:
        - permissions-openfga
      summary: Update permissions for a view
      operationId: update_view_assignments_by_id
      parameters:
        - name: warehouse_id
          in: path
          description: Warehouse ID
          required: true
          schema:
            type: string
            format: uuid
        - name: view_id
          in: path
          description: View ID
          required: true
          schema:
            type: string
            format: uuid
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateViewAssignmentsRequest'
        required: true
      responses:
        '204':
          description: Permissions updated successfully
  /management/v1/permissions/warehouse/{warehouse_id}/view/{view_id}/authorizer-actions:
    get:
      tags:
        - permissions-openfga
      summary: Get allowed Authorizer actions on a view
      description: |-
        Returns Authorizer permissions (OpenFGA relations) for the specified view.
        For Catalog permissions, use `/management/v1/warehouse/{warehouse_id}/view/{view_id}/actions` instead.
      operationId: get_authorizer_view_actions
      parameters:
        - name: principalUser
          in: query
          description: |-
            The user to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
        - name: principalRole
          in: query
          description: |-
            The role to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
            format: uuid
        - name: warehouse_id
          in: path
          description: Warehouse ID
          required: true
          schema:
            type: string
            format: uuid
        - name: view_id
          in: path
          description: View ID
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: View Authorizer Actions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetOpenFGAViewActionsResponse'
  /management/v1/project:
    get:
      tags:
        - project
      summary: Get Project
      description: Retrieves information about the user's default project.
      operationId: get_project
      parameters:
        - name: x-project-id
          in: header
          description: Project ID (optional; falls back to the default project if not provided)
          required: false
          schema:
            type:
              - string
              - 'null'
      responses:
        '200':
          description: Project details
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetProjectResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
    post:
      tags:
        - project
      summary: Create Project
      description: Creates a new project with the specified configuration.
      operationId: create_project
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateProjectRequest'
        required: true
      responses:
        '201':
          description: Project created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateProjectResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
    delete:
      tags:
        - project
      summary: Delete Project
      operationId: delete_project
      parameters:
        - name: x-project-id
          in: header
          description: Project ID (optional; falls back to the default project if not provided)
          required: false
          schema:
            type:
              - string
              - 'null'
      responses:
        '204':
          description: Project deleted successfully
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/project-list:
    get:
      tags:
        - project
      summary: List Projects
      description: Lists all projects that the requesting user has access to.
      operationId: list_projects
      responses:
        '200':
          description: List of projects
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListProjectsResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/project/actions:
    get:
      tags:
        - project
      summary: Get allowed actions for a project
      operationId: get_project_actions
      parameters:
        - name: principalUser
          in: query
          description: |-
            The user to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
        - name: principalRole
          in: query
          description: |-
            The role to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
            format: uuid
        - name: x-project-id
          in: header
          description: Project ID (optional; falls back to the default project if not provided)
          required: false
          schema:
            type:
              - string
              - 'null'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetLakekeeperProjectActionsResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/project/rename:
    post:
      tags:
        - project
      summary: Rename Project
      operationId: rename_project
      parameters:
        - name: x-project-id
          in: header
          description: Project ID (optional; falls back to the default project if not provided)
          required: false
          schema:
            type:
              - string
              - 'null'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RenameProjectRequest'
        required: true
      responses:
        '200':
          description: Project renamed successfully
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/project/task-queue/task_log_cleanup/config:
    get:
      tags:
        - tasks
      summary: Get the configuration for a Project-level Task Queue.
      description: These configurations are global per project and shared across all instances of this kind of task.
      operationId: get_project_task_queue_config_task_log_cleanup
      parameters:
        - name: x-project-id
          in: header
          description: Project ID (optional; falls back to the default project if not provided)
          required: false
          schema:
            type:
              - string
              - 'null'
      responses:
        '200':
          description: ''
          headers:
            x-request-id:
              schema:
                type: string
                format: uuid
              description: Request identifier, add this to your bug reports.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetTaskLogCleanupConfig'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
    post:
      tags:
        - tasks
      summary: Set the configuration for a Project-level Task Queue.
      description: These configurations are global per project and shared across all instances of this kind of task.
      operationId: set_project_task_queue_config_task_log_cleanup
      parameters:
        - name: x-project-id
          in: header
          description: Project ID (optional; falls back to the default project if not provided)
          required: false
          schema:
            type:
              - string
              - 'null'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SetTaskLogCleanupConfig'
        required: true
      responses:
        '204':
          description: Project-level Task queue config set successfully
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/project/task/by-id/{task_id}:
    get:
      tags:
        - tasks
      summary: Get Details about a specific Project-level task by its ID.
      operationId: get_project_task_details
      parameters:
        - name: task_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
        - name: numAttempts
          in: query
          description: 'Number of attempts to retrieve (default: 5)'
          required: false
          schema:
            type:
              - integer
              - 'null'
            format: int32
            default: 5
            minimum: 0
        - name: x-project-id
          in: header
          description: Project ID (optional; falls back to the default project if not provided)
          required: false
          schema:
            type:
              - string
              - 'null'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetProjectTaskDetailsResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/project/task/control:
    post:
      tags:
        - tasks
      summary: Control a set of Project-level tasks by their IDs (e.g., cancel, request stop, run now)
      description: Accepts at most 100 task IDs in one request.
      operationId: control_project_tasks
      parameters:
        - name: x-project-id
          in: header
          description: Project ID (optional; falls back to the default project if not provided)
          required: false
          schema:
            type:
              - string
              - 'null'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ControlTasksRequest'
        required: true
      responses:
        '204':
          description: All requested actions were successful
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/project/task/list:
    post:
      tags:
        - tasks
      summary: List active and historic Project-level tasks.
      operationId: list_project_tasks
      parameters:
        - name: x-project-id
          in: header
          description: Project ID (optional; falls back to the default project if not provided)
          required: false
          schema:
            type:
              - string
              - 'null'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ListProjectTasksRequest'
        required: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListProjectTasksResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/project/{project_id}:
    get:
      tags:
        - project
      summary: Get Project
      operationId: get_project_by_id_deprecated
      parameters:
        - name: project_id
          in: path
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Project details
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetProjectResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
      deprecated: true
    delete:
      tags:
        - project
      summary: Delete Project by ID
      description: Permanently removes a specific project and all its associated resources.
      operationId: delete_project_by_id_deprecated
      parameters:
        - name: project_id
          in: path
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Project deleted successfully
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
      deprecated: true
  /management/v1/project/{project_id}/rename:
    post:
      tags:
        - project
      summary: Rename Project by ID
      description: Updates the name of a specific project.
      operationId: rename_project_by_id_deprecated
      parameters:
        - name: project_id
          in: path
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RenameProjectRequest'
        required: true
      responses:
        '200':
          description: Project renamed successfully
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
      deprecated: true
  /management/v1/role:
    get:
      tags:
        - role
      summary: List Roles
      description: Returns all roles in the project that the current user has access to view.
      operationId: list_roles
      parameters:
        - name: pageToken
          in: query
          description: Next page token
          required: false
          schema:
            type:
              - string
              - 'null'
        - name: pageSize
          in: query
          description: |-
            Signals an upper bound of the number of results that a client will receive.
            Default: 100
          required: false
          schema:
            type:
              - integer
              - 'null'
            format: int64
        - name: projectId
          in: query
          description: |-
            Project ID from which roles should be listed
            Deprecated: Please use the `x-project-id` header instead.
          required: false
          schema:
            type:
              - string
              - 'null'
        - name: roleIds
          in: query
          description: Filter by role IDs
          required: false
          schema:
            type:
              - array
              - 'null'
            items:
              type: string
              format: uuid
        - name: sourceIds
          in: query
          description: Filter by source IDs
          required: false
          schema:
            type:
              - array
              - 'null'
            items:
              type: string
        - name: providerIds
          in: query
          description: Filter by provider IDs
          required: false
          schema:
            type:
              - array
              - 'null'
            items:
              type: string
        - name: x-project-id
          in: header
          description: Project ID (optional; falls back to the default project if not provided)
          required: false
          schema:
            type:
              - string
              - 'null'
      responses:
        '200':
          description: List of roles
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListRolesResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
    post:
      tags:
        - role
      summary: Create Role
      description: Creates a role with the specified name, description, and permissions.
      operationId: create_role
      parameters:
        - name: x-project-id
          in: header
          description: Project ID (optional; falls back to the default project if not provided)
          required: false
          schema:
            type:
              - string
              - 'null'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateRoleRequest'
        required: true
      responses:
        '201':
          description: Role successfully created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Role'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/role/{role_id}:
    get:
      tags:
        - role
      summary: Get Role
      description: Retrieves detailed information about a specific role.
      operationId: get_role
      parameters:
        - name: role_id
          in: path
          description: Role ID
          required: true
          schema:
            type: string
            format: uuid
        - name: x-project-id
          in: header
          description: Project ID (optional; falls back to the default project if not provided)
          required: false
          schema:
            type:
              - string
              - 'null'
      responses:
        '200':
          description: Role details
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Role'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
    post:
      tags:
        - role
      summary: Update Role
      operationId: update_role
      parameters:
        - name: role_id
          in: path
          description: Role ID
          required: true
          schema:
            type: string
            format: uuid
        - name: x-project-id
          in: header
          description: Project ID (optional; falls back to the default project if not provided)
          required: false
          schema:
            type:
              - string
              - 'null'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateRoleRequest'
        required: true
      responses:
        '200':
          description: Role updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Role'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
    delete:
      tags:
        - role
      summary: Delete Role
      description: Permanently removes a role and all its associated permissions.
      operationId: delete_role
      parameters:
        - name: role_id
          in: path
          description: Role ID
          required: true
          schema:
            type: string
            format: uuid
        - name: x-project-id
          in: header
          description: Project ID (optional; falls back to the default project if not provided)
          required: false
          schema:
            type:
              - string
              - 'null'
      responses:
        '204':
          description: Role deleted successfully
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/role/{role_id}/actions:
    get:
      tags:
        - role
      summary: Get allowed actions for a role
      operationId: get_role_actions
      parameters:
        - name: principalUser
          in: query
          description: |-
            The user to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
        - name: principalRole
          in: query
          description: |-
            The role to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
            format: uuid
        - name: role_id
          in: path
          description: Role ID
          required: true
          schema:
            type: string
            format: uuid
        - name: x-project-id
          in: header
          description: Project ID (optional; falls back to the default project if not provided)
          required: false
          schema:
            type:
              - string
              - 'null'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetLakekeeperRoleActionsResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/role/{role_id}/member-of:
    get:
      tags:
        - role
      summary: List Roles a Role Is a Member Of
      description: Lists the roles that the given role is a direct member of, keyset-paginated.
      operationId: list_role_member_of
      parameters:
        - name: pageToken
          in: query
          required: false
          schema:
            type:
              - string
              - 'null'
        - name: pageSize
          in: query
          description: 'Upper bound on the number of results returned. Default: 100.'
          required: false
          schema:
            type:
              - integer
              - 'null'
            format: int64
        - name: role_id
          in: path
          description: Role ID
          required: true
          schema:
            type: string
            format: uuid
        - name: x-project-id
          in: header
          description: Project ID (optional; falls back to the default project if not provided)
          required: false
          schema:
            type:
              - string
              - 'null'
      responses:
        '200':
          description: Roles the role is a member of
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListRoleMembershipsResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/role/{role_id}/member-of/transitive:
    get:
      tags:
        - role
      summary: List Transitive Role Member-Of
      description: |-
        Lists the full transitive member-of set of a role — every role it
        effectively belongs to, reachable upward through membership — keyset-
        paginated. Supported only when assignments are catalog-managed; an
        assignment-managing authorizer (e.g. OpenFGA) returns `501`.
      operationId: list_role_transitive_member_of
      parameters:
        - name: pageToken
          in: query
          required: false
          schema:
            type:
              - string
              - 'null'
        - name: pageSize
          in: query
          description: 'Upper bound on the number of results returned. Default: 100.'
          required: false
          schema:
            type:
              - integer
              - 'null'
            format: int64
        - name: role_id
          in: path
          description: Role ID
          required: true
          schema:
            type: string
            format: uuid
        - name: x-project-id
          in: header
          description: Project ID (optional; falls back to the default project if not provided)
          required: false
          schema:
            type:
              - string
              - 'null'
      responses:
        '200':
          description: Transitive roles the role belongs to
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListRoleMembershipsResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
        '501':
          description: Transitive listing is not supported under the configured authorizer backend
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/role/{role_id}/members:
    get:
      tags:
        - role
      summary: List Role Members
      description: |-
        Lists the direct members of a role — users and member roles — as one merged,
        keyset-paginated page. Optionally filtered to a single member kind via `?type=`.
      operationId: list_role_members
      parameters:
        - name: type
          in: query
          description: Restrict to one member kind (`user` or `role`). Both kinds when omitted.
          required: false
          schema:
            oneOf:
              - type: 'null'
              - $ref: '#/components/schemas/RoleMemberType'
        - name: pageToken
          in: query
          required: false
          schema:
            type:
              - string
              - 'null'
        - name: pageSize
          in: query
          description: 'Upper bound on the number of results returned. Default: 100.'
          required: false
          schema:
            type:
              - integer
              - 'null'
            format: int64
        - name: role_id
          in: path
          description: Role ID
          required: true
          schema:
            type: string
            format: uuid
        - name: x-project-id
          in: header
          description: Project ID (optional; falls back to the default project if not provided)
          required: false
          schema:
            type:
              - string
              - 'null'
      responses:
        '200':
          description: Direct members of the role
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListRoleMembersResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
    post:
      tags:
        - role
      summary: Add Role Members
      description: |-
        Adds one or more members (users and/or roles) to a role in a single atomic
        (all-or-nothing) batch. Idempotent — already-present members are accepted.
        Returns the requested members confirmed present.

        Handling of a not-yet-provisioned member depends on the configured
        authorization backend: a backend that stores assignments itself accepts the
        member by id, whereas catalog-backed authorization requires the member to
        exist first and otherwise returns `404` — provision the user (via
        `POST /user`) or create the role before assigning. Behavior is consistent
        within a deployment.
      operationId: add_role_members
      parameters:
        - name: role_id
          in: path
          description: Role ID
          required: true
          schema:
            type: string
            format: uuid
        - name: x-project-id
          in: header
          description: Project ID (optional; falls back to the default project if not provided)
          required: false
          schema:
            type:
              - string
              - 'null'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AddRoleMembersRequest'
        required: true
      responses:
        '200':
          description: Members added
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AddRoleMembersResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/role/{role_id}/members/transitive:
    get:
      tags:
        - role
      summary: List Transitive Role Members
      description: |-
        Lists the role's transitive members — users assigned to the role or any role
        in its downward membership closure, plus every role in that closure — as one
        keyset-paginated page, optionally filtered to one kind. Supported only when
        assignments are catalog-managed; an assignment-managing authorizer (e.g.
        OpenFGA) returns `501`.
      operationId: list_role_transitive_members
      parameters:
        - name: type
          in: query
          description: Restrict to one member kind (`user` or `role`). Both kinds when omitted.
          required: false
          schema:
            oneOf:
              - type: 'null'
              - $ref: '#/components/schemas/RoleMemberType'
        - name: pageToken
          in: query
          required: false
          schema:
            type:
              - string
              - 'null'
        - name: pageSize
          in: query
          description: 'Upper bound on the number of results returned. Default: 100.'
          required: false
          schema:
            type:
              - integer
              - 'null'
            format: int64
        - name: role_id
          in: path
          description: Role ID
          required: true
          schema:
            type: string
            format: uuid
        - name: x-project-id
          in: header
          description: Project ID (optional; falls back to the default project if not provided)
          required: false
          schema:
            type:
              - string
              - 'null'
      responses:
        '200':
          description: Transitive members of the role
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListRoleMembersResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
        '501':
          description: Transitive listing is not supported under the configured authorizer backend
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/role/{role_id}/members/{member_type}/{member_id}:
    delete:
      tags:
        - role
      summary: Remove Role Member
      description: |-
        Removes a single member (a user or a role) from a role. Idempotent — removing
        an absent member is a no-op and still returns `204`.
      operationId: remove_role_member
      parameters:
        - name: role_id
          in: path
          description: Role ID
          required: true
          schema:
            type: string
            format: uuid
        - name: member_type
          in: path
          description: 'Member kind: `user` or `role`'
          required: true
          schema:
            $ref: '#/components/schemas/RoleMemberType'
        - name: member_id
          in: path
          description: User id or role UUID
          required: true
          schema:
            type: string
        - name: x-project-id
          in: header
          description: Project ID (optional; falls back to the default project if not provided)
          required: false
          schema:
            type:
              - string
              - 'null'
      responses:
        '204':
          description: Member removed (or already absent)
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/role/{role_id}/metadata:
    get:
      tags:
        - role
      summary: Get Role Metadata
      description: |-
        Retrieves high-level metadata about a specific role.
        Depending on the authorizer, this method is typically allowed also for roles in
        other projects.
      operationId: get_role_metadata
      parameters:
        - name: role_id
          in: path
          description: Role ID
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: High level Role Metadata
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RoleMetadata'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/role/{role_id}/source-system:
    put:
      tags:
        - role
      summary: Set the source system for a role
      operationId: update_role_source_system
      parameters:
        - name: role_id
          in: path
          description: Role ID
          required: true
          schema:
            type: string
            format: uuid
        - name: x-project-id
          in: header
          description: Project ID (optional; falls back to the default project if not provided)
          required: false
          schema:
            type:
              - string
              - 'null'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateRoleSourceSystemRequest'
        required: true
      responses:
        '200':
          description: Role Source System updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Role'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/search/role:
    post:
      tags:
        - role
      summary: Search Role
      description: Performs a fuzzy search for roles based on the provided criteria.
      operationId: search_role
      parameters:
        - name: x-project-id
          in: header
          description: Project ID (optional; falls back to the default project if not provided)
          required: false
          schema:
            type:
              - string
              - 'null'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SearchRoleRequest'
        required: true
      responses:
        '200':
          description: List of roles
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SearchRoleResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/search/user:
    post:
      tags:
        - user
      summary: Search User
      description: Performs a fuzzy search for users based on the provided criteria.
      operationId: search_user
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SearchUserRequest'
        required: true
      responses:
        '200':
          description: List of users
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SearchUserResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/server/actions:
    get:
      tags:
        - server
      summary: Get allowed server actions
      operationId: get_server_actions
      parameters:
        - name: principalUser
          in: query
          description: |-
            The user to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
        - name: principalRole
          in: query
          description: |-
            The role to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetLakekeeperServerActionsResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/user:
    get:
      tags:
        - user
      summary: List Users
      description: Returns a paginated list of users based on the provided query parameters.
      operationId: list_user
      parameters:
        - name: name
          in: query
          description: Search for a specific username
          required: false
          schema:
            type:
              - string
              - 'null'
        - name: pageToken
          in: query
          description: Next page token
          required: false
          schema:
            type:
              - string
              - 'null'
        - name: pageSize
          in: query
          description: |-
            Signals an upper bound of the number of results that a client will receive.
            Default: 100
          required: false
          schema:
            type:
              - integer
              - 'null'
            format: int64
      responses:
        '200':
          description: List of users
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListUsersResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
    post:
      tags:
        - user
      summary: Provision User
      description: |-
        Creates a new user or updates an existing user's metadata from the provided token.
        The token should include "profile" and "email" scopes for complete user information.
      operationId: create_user
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateUserRequest'
        required: true
      responses:
        '200':
          description: User updated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/User'
        '201':
          description: User created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/User'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/user/{user_id}:
    get:
      tags:
        - user
      summary: Get User by ID
      description: Retrieves detailed information about a specific user.
      operationId: get_user
      parameters:
        - name: user_id
          in: path
          required: true
          schema:
            type: string
      responses:
        '200':
          description: User details
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/User'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
    put:
      tags:
        - user
      summary: Replace User
      description: |-
        Replaces the current user details with the new details provided in the request.
        If a field is not provided, it will be set to `None`.
      operationId: update_user
      parameters:
        - name: user_id
          in: path
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateUserRequest'
        required: true
      responses:
        '200':
          description: User details updated successfully
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
    delete:
      tags:
        - user
      summary: Delete User
      description: |-
        Permanently removes a user and all their associated permissions.
        If the user is re-registered later, their permissions will need to be re-added.
      operationId: delete_user
      parameters:
        - name: user_id
          in: path
          required: true
          schema:
            type: string
      responses:
        '204':
          description: User deleted successfully
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/user/{user_id}/actions:
    get:
      tags:
        - user
      summary: Get allowed actions on a user
      operationId: get_user_actions
      parameters:
        - name: principalUser
          in: query
          description: |-
            The user to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
        - name: principalRole
          in: query
          description: |-
            The role to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
            format: uuid
        - name: user_id
          in: path
          required: true
          schema:
            type: string
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetLakekeeperUserActionsResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/user/{user_id}/roles:
    get:
      tags:
        - user
      summary: List User Roles
      description: Lists the roles a user is directly assigned to, keyset-paginated.
      operationId: list_user_roles
      parameters:
        - name: pageToken
          in: query
          required: false
          schema:
            type:
              - string
              - 'null'
        - name: pageSize
          in: query
          description: 'Upper bound on the number of results returned. Default: 100.'
          required: false
          schema:
            type:
              - integer
              - 'null'
            format: int64
        - name: user_id
          in: path
          description: User ID
          required: true
          schema:
            type: string
        - name: x-project-id
          in: header
          description: Project ID (optional; falls back to the default project if not provided)
          required: false
          schema:
            type:
              - string
              - 'null'
      responses:
        '200':
          description: Roles the user is assigned to
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListRoleMembershipsResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/user/{user_id}/roles/transitive:
    get:
      tags:
        - user
      summary: List Transitive User Roles
      description: |-
        Lists the full effective (transitive) role set a user holds — direct
        assignments plus every role reachable upward through membership — keyset-
        paginated. Supported only when assignments are catalog-managed; an
        assignment-managing authorizer (e.g. OpenFGA) returns `501`.
      operationId: list_user_transitive_roles
      parameters:
        - name: pageToken
          in: query
          required: false
          schema:
            type:
              - string
              - 'null'
        - name: pageSize
          in: query
          description: 'Upper bound on the number of results returned. Default: 100.'
          required: false
          schema:
            type:
              - integer
              - 'null'
            format: int64
        - name: user_id
          in: path
          description: User ID
          required: true
          schema:
            type: string
        - name: x-project-id
          in: header
          description: Project ID (optional; falls back to the default project if not provided)
          required: false
          schema:
            type:
              - string
              - 'null'
      responses:
        '200':
          description: Transitive roles the user holds
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListRoleMembershipsResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
        '501':
          description: Transitive listing is not supported under the configured authorizer backend
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/warehouse:
    get:
      tags:
        - warehouse
      summary: List Warehouses
      description: |-
        Returns all warehouses in the project that the current user has access to.
        By default, deactivated warehouses are not included in the results.
        Set the `include_deactivated` query parameter to `true` to include them.
      operationId: list_warehouses
      parameters:
        - name: warehouseStatus
          in: query
          description: |-
            Optional filter to return only warehouses
            with the specified status.
            If not provided, only active warehouses are returned.
          required: false
          schema:
            type: array
            items:
              $ref: '#/components/schemas/WarehouseStatus'
        - name: projectId
          in: query
          description: |-
            The project ID to list warehouses for.
            Deprecated: Please use the `x-project-id` header instead.
          required: false
          schema:
            type:
              - string
              - 'null'
      responses:
        '200':
          description: List of warehouses
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListWarehousesResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
    post:
      tags:
        - warehouse
      summary: Create Warehouse
      description: |-
        Creates a new warehouse in the specified project with the provided configuration.
        The project of a warehouse cannot be changed after creation.
        This operation validates the storage configuration.
      operationId: create_warehouse
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateWarehouseRequest'
        required: true
      responses:
        '201':
          description: Warehouse created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateWarehouseResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/warehouse/{warehouse_id}:
    get:
      tags:
        - warehouse
      summary: Get Warehouse
      description: Retrieves detailed information about a specific warehouse.
      operationId: get_warehouse
      parameters:
        - name: warehouse_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: Warehouse details
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetWarehouseResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
    delete:
      tags:
        - warehouse
      summary: Delete Warehouse
      description: |-
        Permanently removes a warehouse and all its associated resources.
        Use the `force` parameter to delete protected warehouses.
      operationId: delete_warehouse
      parameters:
        - name: warehouse_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '204':
          description: Warehouse deleted successfully
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/warehouse/{warehouse_id}/actions:
    get:
      tags:
        - warehouse
      summary: Get allowed actions for a warehouse
      operationId: get_warehouse_actions
      parameters:
        - name: principalUser
          in: query
          description: |-
            The user to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
        - name: principalRole
          in: query
          description: |-
            The role to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
            format: uuid
        - name: warehouse_id
          in: path
          description: Warehouse ID
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetLakekeeperWarehouseActionsResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/warehouse/{warehouse_id}/activate:
    post:
      tags:
        - warehouse
      summary: Activate Warehouse
      description: Re-enables access to a previously deactivated warehouse.
      operationId: activate_warehouse
      parameters:
        - name: warehouse_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: Warehouse activated successfully
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/warehouse/{warehouse_id}/deactivate:
    post:
      tags:
        - warehouse
      summary: Deactivate Warehouse
      description: Temporarily disables access to a warehouse without deleting its data.
      operationId: deactivate_warehouse
      parameters:
        - name: warehouse_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: Warehouse deactivated successfully
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/warehouse/{warehouse_id}/delete-profile:
    post:
      tags:
        - warehouse
      summary: Update Deletion Profile
      description: Configures the soft-delete behavior for a warehouse.
      operationId: update_warehouse_delete_profile
      parameters:
        - name: warehouse_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateWarehouseDeleteProfileRequest'
        required: true
      responses:
        '200':
          description: Deletion Profile updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetWarehouseResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/warehouse/{warehouse_id}/deleted-tabulars:
    get:
      tags:
        - warehouse
      summary: List Soft-Deleted Tabulars
      description: Returns all soft-deleted tables and views in the warehouse that are visible to the current user.
      operationId: list_deleted_tabulars
      parameters:
        - name: warehouse_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
        - name: namespaceId
          in: query
          description: Filter by Namespace ID
          required: false
          schema:
            type: string
            format: uuid
        - name: pageToken
          in: query
          description: Next page token
          required: false
          schema:
            type:
              - string
              - 'null'
        - name: pageSize
          in: query
          description: |-
            Signals an upper bound of the number of results that a client will receive.
            Default: 100
          required: false
          schema:
            type:
              - integer
              - 'null'
            format: int64
      responses:
        '200':
          description: List of soft-deleted tabulars
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListDeletedTabularsResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/warehouse/{warehouse_id}/deleted-tabulars/undrop:
    post:
      tags:
        - warehouse
      summary: Undrop Tabular
      description: Restores previously deleted tables or views to make them accessible again.
      operationId: undrop_tabulars
      parameters:
        - name: warehouse_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UndropTabularsRequest'
        required: true
      responses:
        '204':
          description: Tabular undropped successfully
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/warehouse/{warehouse_id}/format-version-policy:
    post:
      tags:
        - warehouse
      summary: Update Format Version Policy
      description: |-
        Configures which Iceberg table format versions may be created in, or
        upgraded to, within a warehouse, and the default version applied when a
        create-table request does not specify one.
      operationId: update_warehouse_format_version_policy
      parameters:
        - name: warehouse_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateWarehouseFormatVersionPolicyRequest'
        required: true
      responses:
        '200':
          description: Format version policy updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetWarehouseResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/warehouse/{warehouse_id}/generic-table/{generic_table_id}/actions:
    get:
      tags:
        - warehouse
      summary: Get allowed actions for a generic table
      operationId: get_generic_table_actions
      parameters:
        - name: principalUser
          in: query
          description: |-
            The user to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
        - name: principalRole
          in: query
          description: |-
            The role to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
            format: uuid
        - name: warehouse_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
        - name: generic_table_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetLakekeeperGenericTableActionsResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/warehouse/{warehouse_id}/generic-table/{generic_table_id}/protection:
    get:
      tags:
        - warehouse
      summary: Get Generic Table Protection
      description: Retrieves whether a generic table is protected from deletion.
      operationId: get_generic_table_protection
      parameters:
        - name: warehouse_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
        - name: generic_table_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProtectionResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
    post:
      tags:
        - warehouse
      summary: Set Generic Table Protection
      description: Configures whether a generic table should be protected from deletion.
      operationId: set_generic_table_protection
      parameters:
        - name: warehouse_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
        - name: generic_table_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SetProtectionRequest'
        required: true
      responses:
        '200':
          description: Generic table protection set successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProtectionResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/warehouse/{warehouse_id}/managed-by:
    post:
      tags:
        - warehouse
      summary: Set Warehouse Managed-By
      description: |-
        Sets (or clears) the managed-by marker on a warehouse. When set, the
        warehouse spec becomes mutable only by the managing control plane
        (instance admins). Requires instance-admin privilege.
      operationId: set_warehouse_managed_by
      parameters:
        - name: warehouse_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SetWarehouseManagedByRequest'
        required: true
      responses:
        '200':
          description: Warehouse managed-by marker set successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetWarehouseResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/warehouse/{warehouse_id}/namespace/{namespace_id}/actions:
    get:
      tags:
        - warehouse
      summary: Get allowed actions for a namespace
      operationId: get_namespace_actions
      parameters:
        - name: principalUser
          in: query
          description: |-
            The user to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
        - name: principalRole
          in: query
          description: |-
            The role to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
            format: uuid
        - name: warehouse_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
        - name: namespace_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetLakekeeperNamespaceActionsResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/warehouse/{warehouse_id}/namespace/{namespace_id}/protection:
    get:
      tags:
        - warehouse
      summary: Get Namespace Protection
      description: Retrieves whether a namespace is protected from deletion.
      operationId: get_namespace_protection
      parameters:
        - name: warehouse_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
        - name: namespace_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProtectionResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
    post:
      tags:
        - warehouse
      summary: Set Namespace Protection
      description: Configures whether a namespace should be protected from deletion.
      operationId: set_namespace_protection
      parameters:
        - name: warehouse_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
        - name: namespace_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SetProtectionRequest'
        required: true
      responses:
        '200':
          description: Namespace protection set successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProtectionResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/warehouse/{warehouse_id}/protection:
    post:
      tags:
        - warehouse
      summary: Set Warehouse Protection
      description: Configures whether a warehouse should be protected from deletion.
      operationId: set_warehouse_protection
      parameters:
        - name: warehouse_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SetProtectionRequest'
        required: true
      responses:
        '200':
          description: Warehouse protection set successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProtectionResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/warehouse/{warehouse_id}/rename:
    post:
      tags:
        - warehouse
      summary: Rename Warehouse
      description: Updates the name of a specific warehouse.
      operationId: rename_warehouse
      parameters:
        - name: warehouse_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RenameWarehouseRequest'
        required: true
      responses:
        '200':
          description: Warehouse renamed successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetWarehouseResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/warehouse/{warehouse_id}/search-tabular:
    post:
      tags:
        - warehouse
      summary: Search Tabulars
      description: |-
        Performs a fuzzy search for tabulars based on the provided criteria. If the search string
        can be parsed as uuid:
        - if there is tabular with that uuid, the tabular is in the response
        - if there is a namespace with that uuid, tables in that namespace are in the response
      operationId: search_tabular
      parameters:
        - name: warehouse_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SearchTabularRequest'
        required: true
      responses:
        '200':
          description: List of tabulars
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SearchTabularResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/warehouse/{warehouse_id}/statistics:
    get:
      tags:
        - warehouse
      summary: Get Warehouse Statistics
      description: |-
        Retrieves statistical data about a warehouse's usage and resources over time.
        Statistics are aggregated hourly when changes occur.

        We lazily create a new statistics entry every hour, in between hours, the existing entry is
        being updated. If there's a change at `created_at + 1 hour`, a new entry is created.
        If there's been no change, no new entry is created, meaning there may be gaps.

        Example:
        - 00:16:32: warehouse created:
            - `timestamp: 01:00:00, created_at: 00:16:32, updated_at: null, 0 tables, 0 views`
        - 00:30:00: table created:
            - `timestamp: 01:00:00, created_at: 00:16:32, updated_at: 00:30:00, 1 table, 0 views`
        - 00:45:00: view created:
            - `timestamp: 01:00:00, created_at: 00:16:32, updated_at: 00:45:00, 1 table, 1 view`
        - 01:00:36: table deleted:
            - `timestamp: 02:00:00, created_at: 01:00:36, updated_at: null, 0 tables, 1 view`
            - `timestamp: 01:00:00, created_at: 00:16:32, updated_at: 00:45:00, 1 table, 1 view`
      operationId: get_warehouse_statistics
      parameters:
        - name: warehouse_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
        - name: page_token
          in: query
          description: Next page token
          required: false
          schema:
            type: string
        - name: page_size
          in: query
          description: Signals an upper bound of the number of results that a client will receive.
          required: false
          schema:
            type:
              - integer
              - 'null'
            format: int64
      responses:
        '200':
          description: Warehouse statistics
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WarehouseStatisticsResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/warehouse/{warehouse_id}/storage:
    post:
      tags:
        - warehouse
      summary: Update Storage Profile
      description: Updates both the storage profile and credentials of a warehouse.
      operationId: update_storage_profile
      parameters:
        - name: warehouse_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateWarehouseStorageRequest'
        required: true
      responses:
        '200':
          description: Storage profile updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetWarehouseResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/warehouse/{warehouse_id}/storage-credential:
    post:
      tags:
        - warehouse
      summary: Update Storage Credential
      description: |-
        Updates only the storage credential of a warehouse without modifying the storage profile.
        Useful for refreshing expiring credentials.
      operationId: update_storage_credential
      parameters:
        - name: warehouse_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateWarehouseCredentialRequest'
        required: true
      responses:
        '200':
          description: Storage credential updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetWarehouseResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/warehouse/{warehouse_id}/table/{table_id}/actions:
    get:
      tags:
        - warehouse
      summary: Get allowed actions for a table
      operationId: get_table_actions
      parameters:
        - name: principalUser
          in: query
          description: |-
            The user to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
        - name: principalRole
          in: query
          description: |-
            The role to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
            format: uuid
        - name: warehouse_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
        - name: table_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetLakekeeperTableActionsResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/warehouse/{warehouse_id}/table/{table_id}/protection:
    get:
      tags:
        - warehouse
      summary: Get Table Protection
      description: Retrieves whether a table is protected from deletion.
      operationId: get_table_protection
      parameters:
        - name: warehouse_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
        - name: table_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProtectionResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
    post:
      tags:
        - warehouse
      summary: Set Table Protection
      description: Configures whether a table should be protected from deletion.
      operationId: set_table_protection
      parameters:
        - name: warehouse_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
        - name: table_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SetProtectionRequest'
        required: true
      responses:
        '200':
          description: Table protection set successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProtectionResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/warehouse/{warehouse_id}/task-queue/expire_snapshots/config:
    get:
      tags:
        - tasks
      summary: Get the configuration for a Task Queue.
      description: These configurations are global per warehouse and shared across all instances of this kind of task.
      operationId: get_task_queue_config_expire_snapshots
      parameters:
        - name: warehouse_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: ''
          headers:
            x-request-id:
              schema:
                type: string
                format: uuid
              description: Request identifier, add this to your bug reports.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetExpireSnapshotsQueueConfig'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
    post:
      tags:
        - tasks
      summary: Set the configuration for a Task Queue.
      description: These configurations are global per warehouse and shared across all instances of this kind of task.
      operationId: set_task_queue_config_expire_snapshots
      parameters:
        - name: warehouse_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SetExpireSnapshotsQueueConfig'
        required: true
      responses:
        '204':
          description: Task queue config set successfully
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/warehouse/{warehouse_id}/task-queue/expire_snapshots/schedule:
    post:
      tags:
        - tasks
      summary: Schedule a task for an entity.
      description: |-
        Pre-checks run against the warehouse config and target entity
        properties before the task is enqueued. A failure surfaces as `400`
        with a specific error code (see the operator guide for the full set
        of pre-check codes).

        When a task is already active for the same (warehouse, entity,
        queue) triple, the call returns `409 TaskAlreadyActive` with the
        existing `task-id` in the body — chain to `POST /task/control`
        with `run-now` or `run-at` to retime it without an extra
        `task/list` round-trip.
      operationId: schedule_task_expire_snapshots
      parameters:
        - name: warehouse_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ScheduleExpireSnapshotsTaskRequest'
        required: true
      responses:
        '200':
          description: Task scheduled
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScheduleTaskResponse'
        '400':
          description: Pre-check failed (e.g. scheduling disabled at the warehouse, entity opted out, unsupported entity type) or the request violates a shape limit (e.g. scheduled-for too far in the future).
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
        '404':
          description: Target entity not found in this warehouse.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
        '409':
          description: A task is already active for this (warehouse, entity, queue). The error message includes the existing task-id; retime or cancel via POST /task/control.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/warehouse/{warehouse_id}/task-queue/remove_orphan_files/config:
    get:
      tags:
        - tasks
      summary: Get the configuration for a Task Queue.
      description: These configurations are global per warehouse and shared across all instances of this kind of task.
      operationId: get_task_queue_config_remove_orphan_files
      parameters:
        - name: warehouse_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: ''
          headers:
            x-request-id:
              schema:
                type: string
                format: uuid
              description: Request identifier, add this to your bug reports.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetRemoveOrphanFilesQueueConfig'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
    post:
      tags:
        - tasks
      summary: Set the configuration for a Task Queue.
      description: These configurations are global per warehouse and shared across all instances of this kind of task.
      operationId: set_task_queue_config_remove_orphan_files
      parameters:
        - name: warehouse_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SetRemoveOrphanFilesQueueConfig'
        required: true
      responses:
        '204':
          description: Task queue config set successfully
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/warehouse/{warehouse_id}/task-queue/remove_orphan_files/schedule:
    post:
      tags:
        - tasks
      summary: Schedule a task for an entity.
      description: |-
        Pre-checks run against the warehouse config and target entity
        properties before the task is enqueued. A failure surfaces as `400`
        with a specific error code (see the operator guide for the full set
        of pre-check codes).

        When a task is already active for the same (warehouse, entity,
        queue) triple, the call returns `409 TaskAlreadyActive` with the
        existing `task-id` in the body — chain to `POST /task/control`
        with `run-now` or `run-at` to retime it without an extra
        `task/list` round-trip.
      operationId: schedule_task_remove_orphan_files
      parameters:
        - name: warehouse_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ScheduleRemoveOrphanFilesTaskRequest'
        required: true
      responses:
        '200':
          description: Task scheduled
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScheduleTaskResponse'
        '400':
          description: Pre-check failed (e.g. scheduling disabled at the warehouse, entity opted out, unsupported entity type) or the request violates a shape limit (e.g. scheduled-for too far in the future).
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
        '404':
          description: Target entity not found in this warehouse.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
        '409':
          description: A task is already active for this (warehouse, entity, queue). The error message includes the existing task-id; retime or cancel via POST /task/control.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/warehouse/{warehouse_id}/task-queue/tabular_expiration/config:
    get:
      tags:
        - tasks
      summary: Get the configuration for a Task Queue.
      description: These configurations are global per warehouse and shared across all instances of this kind of task.
      operationId: get_task_queue_config_tabular_expiration
      parameters:
        - name: warehouse_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: ''
          headers:
            x-request-id:
              schema:
                type: string
                format: uuid
              description: Request identifier, add this to your bug reports.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetTabularExpirationQueueConfig'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
    post:
      tags:
        - tasks
      summary: Set the configuration for a Task Queue.
      description: These configurations are global per warehouse and shared across all instances of this kind of task.
      operationId: set_task_queue_config_tabular_expiration
      parameters:
        - name: warehouse_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SetTabularExpirationQueueConfig'
        required: true
      responses:
        '204':
          description: Task queue config set successfully
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/warehouse/{warehouse_id}/task-queue/tabular_purge/config:
    get:
      tags:
        - tasks
      summary: Get the configuration for a Task Queue.
      description: These configurations are global per warehouse and shared across all instances of this kind of task.
      operationId: get_task_queue_config_tabular_purge
      parameters:
        - name: warehouse_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: ''
          headers:
            x-request-id:
              schema:
                type: string
                format: uuid
              description: Request identifier, add this to your bug reports.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetPurgeQueueConfig'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
    post:
      tags:
        - tasks
      summary: Set the configuration for a Task Queue.
      description: These configurations are global per warehouse and shared across all instances of this kind of task.
      operationId: set_task_queue_config_tabular_purge
      parameters:
        - name: warehouse_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SetPurgeQueueConfig'
        required: true
      responses:
        '204':
          description: Task queue config set successfully
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/warehouse/{warehouse_id}/task/by-id/{task_id}:
    get:
      tags:
        - tasks
      summary: Get Details about a specific task by its ID.
      operationId: get_task_details
      parameters:
        - name: warehouse_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
        - name: task_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
        - name: numAttempts
          in: query
          description: 'Number of attempts to retrieve (default: 5)'
          required: false
          schema:
            type:
              - integer
              - 'null'
            format: int32
            default: 5
            minimum: 0
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetTaskDetailsResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/warehouse/{warehouse_id}/task/control:
    post:
      tags:
        - tasks
      summary: Control a set of tasks by their IDs (e.g., cancel, request stop, run now)
      description: Accepts at most 100 task IDs in one request.
      operationId: control_tasks
      parameters:
        - name: warehouse_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ControlTasksRequest'
        required: true
      responses:
        '204':
          description: All requested actions were successful
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/warehouse/{warehouse_id}/task/list:
    post:
      tags:
        - tasks
      summary: List active and historic tasks.
      operationId: list_tasks
      parameters:
        - name: warehouse_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ListTasksRequest'
        required: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListTasksResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/warehouse/{warehouse_id}/view/{view_id}/actions:
    get:
      tags:
        - warehouse
      summary: Get allowed actions for a view
      operationId: get_view_actions
      parameters:
        - name: principalUser
          in: query
          description: |-
            The user to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
        - name: principalRole
          in: query
          description: |-
            The role to show actions for.
            If neither user nor role is specified, shows actions for the current user.
          required: false
          schema:
            type: string
            format: uuid
        - name: warehouse_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
        - name: view_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetLakekeeperViewActionsResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/warehouse/{warehouse_id}/view/{view_id}/protection:
    get:
      tags:
        - warehouse
      summary: Get View Protection
      description: Retrieves whether a view is protected from deletion.
      operationId: get_view_protection
      parameters:
        - name: warehouse_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
        - name: view_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProtectionResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
    post:
      tags:
        - warehouse
      summary: Set View Protection
      description: Configures whether a view should be protected from deletion.
      operationId: set_view_protection
      parameters:
        - name: warehouse_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
        - name: view_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SetProtectionRequest'
        required: true
      responses:
        '200':
          description: View protection set successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProtectionResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
  /management/v1/whoami:
    get:
      tags:
        - user
      summary: Whoami
      description: Returns information about the user associated with the current authentication token.
      operationId: whoami
      responses:
        '200':
          description: Current user and instance-admin status
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WhoamiResponse'
        4XX:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IcebergErrorResponse'
components:
  schemas:
    AddRoleMembersRequest:
      type: object
      description: |-
        Request body for `POST /role/{id}/members`. Batch: adds every listed member to
        the role atomically (all-or-nothing).
      required:
        - members
      properties:
        members:
          type: array
          items:
            $ref: '#/components/schemas/RoleMemberRef'
    AddRoleMembersResponse:
      type: object
      description: |-
        Response for `POST /role/{id}/members`: the requested members confirmed present
        (idempotent — already-present members are included). Echoes identity
        [`RoleMemberRef`]s, not hydrated [`RoleMember`]s — use `GET /role/{id}/members`
        for display names.
      required:
        - members
      properties:
        members:
          type: array
          items:
            $ref: '#/components/schemas/RoleMemberRef'
    AdlsProfile:
      type: object
      description: |-
        Storage profile for a generic Azure Data Lake Storage Gen2 account.

        This profile speaks ADLS Gen2 against any storage account (including
        Microsoft Fabric / `OneLake`, if you configure `account_name = "onelake"`,
        `host = "dfs.fabric.microsoft.com"`, and a `key_prefix` like
        `<lakehouse>/Files/<sub>`). Lakekeeper offers `OneLakeProfile` as a
        convenience layer that knows how to compute those values from
        workspace + lakehouse IDs and that supports `OneLake`'s private-link endpoint
        pattern.
      required:
        - filesystem
        - account-name
      properties:
        account-name:
          type: string
          description: Name of the azure storage account.
        allow-alternative-protocols:
          type: boolean
          description: |-
            Allow alternative protocols such as `wasbs://` in locations.
            This is disabled by default. We do not recommend to use this setting
            except for migration of old tables via the register endpoint.
        authority-host:
          type:
            - string
            - 'null'
          format: uri
          description: 'The authority host to use for authentication. Default: `https://login.microsoftonline.com`.'
        filesystem:
          type: string
          description: Name of the adls filesystem, in blobstorage also known as container.
        host:
          type:
            - string
            - 'null'
          description: 'The host to use for the storage account. Default: `dfs.core.windows.net`.'
        key-prefix:
          type:
            - string
            - 'null'
          description: Subpath in the filesystem to use.
        sas-enabled:
          type: boolean
          description: |-
            Enable SAS (Shared Access Signature) token generation for Azure Data Lake Storage.
            When disabled, clients cannot use vended credentials for this storage profile.
            Defaults to true.
        sas-token-validity-seconds:
          type:
            - integer
            - 'null'
          format: int64
          description: 'The validity of the sas token in seconds. Default: 3600. Max: 7 days.'
          minimum: 0
        storage-layout:
          oneOf:
            - type: 'null'
            - $ref: '#/components/schemas/StorageLayout'
              description: Storage layout for namespace and tabular paths.
    AzCredential:
      oneOf:
        - type: object
          title: AzCredentialClientCredentials
          required:
            - client-id
            - tenant-id
            - client-secret
            - credential-type
          properties:
            client-id:
              type: string
            client-secret:
              type: string
            credential-type:
              type: string
              enum:
                - client-credentials
            tenant-id:
              type: string
        - type: object
          title: AzCredentialSharedAccessKey
          required:
            - key
            - credential-type
          properties:
            credential-type:
              type: string
              enum:
                - shared-access-key
            key:
              type: string
        - type: object
          title: AzCredentialManagedIdentity
          required:
            - credential-type
          properties:
            credential-type:
              type: string
              enum:
                - azure-system-identity
    AzCredentialType:
      type: string
      description: The type of Azure credential.
      enum:
        - client-credentials
        - shared-access-key
        - azure-system-identity
    BootstrapRequest:
      type: object
      required:
        - accept-terms-of-use
      properties:
        accept-terms-of-use:
          type: boolean
          description: Set to true if you accept LAKEKEEPER terms of use.
        is-operator:
          type: boolean
          description: |-
            If set to true, the calling user is treated as an operator and obtain
            a corresponding role. If not specified, the user is treated as a human.
        user-email:
          type:
            - string
            - 'null'
          description: |-
            Email of the user performing bootstrap. Optional. If not provided
            the server will try to parse the email from the provided token.
        user-name:
          type:
            - string
            - 'null'
          description: |-
            Name of the user performing bootstrap. Optional. If not provided
            the server will try to parse the name from the provided token.
            The initial user will become the global admin.
        user-type:
          oneOf:
            - type: 'null'
            - $ref: '#/components/schemas/UserType'
              description: |-
                Type of the user performing bootstrap. Optional. If not provided
                the server will try to parse the type from the provided token.
    CatalogActionCheckItem:
      type: object
      description: A single check item with optional identity override
      required:
        - operation
      properties:
        id:
          type:
            - string
            - 'null'
          description: |-
            Optional identifier for this check (returned in response).
            If not specified, the index in the request array will be used.
        identity:
          oneOf:
            - type: 'null'
            - $ref: '#/components/schemas/UserOrRole'
              description: |-
                The user or role to check access for.
                If not specified, the identity of the user making the request is used.
        operation:
          $ref: '#/components/schemas/CatalogActionCheckOperation'
          description: The operation to check
    CatalogActionCheckOperation:
      oneOf:
        - type: object
          required:
            - server
          properties:
            server:
              type: object
              required:
                - action
              properties:
                action:
                  $ref: '#/components/schemas/LakekeeperServerAction'
        - type: object
          required:
            - project
          properties:
            project:
              type: object
              required:
                - action
              properties:
                action:
                  $ref: '#/components/schemas/LakekeeperProjectAction'
                project-id:
                  type:
                    - string
                    - 'null'
                  format: uuid
        - type: object
          required:
            - warehouse
          properties:
            warehouse:
              type: object
              required:
                - action
                - warehouse-id
              properties:
                action:
                  $ref: '#/components/schemas/LakekeeperWarehouseAction'
                warehouse-id:
                  type: string
                  format: uuid
        - type: object
          required:
            - namespace
          properties:
            namespace:
              allOf:
                - $ref: '#/components/schemas/NamespaceIdentOrUuid'
                - type: object
                  required:
                    - action
                  properties:
                    action:
                      $ref: '#/components/schemas/LakekeeperNamespaceAction'
        - type: object
          required:
            - table
          properties:
            table:
              allOf:
                - $ref: '#/components/schemas/TabularIdentOrUuid'
                - type: object
                  required:
                    - action
                  properties:
                    action:
                      $ref: '#/components/schemas/LakekeeperTableAction'
        - type: object
          required:
            - view
          properties:
            view:
              allOf:
                - $ref: '#/components/schemas/TabularIdentOrUuid'
                - type: object
                  required:
                    - action
                  properties:
                    action:
                      $ref: '#/components/schemas/LakekeeperViewAction'
        - type: object
          required:
            - generic-table
          properties:
            generic-table:
              allOf:
                - $ref: '#/components/schemas/TabularIdentOrUuid'
                - type: object
                  required:
                    - action
                  properties:
                    action:
                      $ref: '#/components/schemas/LakekeeperGenericTableAction'
      description: Represents an action on an object
    CatalogActionsBatchCheckRequest:
      type: object
      required:
        - checks
      properties:
        checks:
          type: array
          items:
            $ref: '#/components/schemas/CatalogActionCheckItem'
          description: List of checks to perform
        error-on-not-found:
          type: boolean
          description: |-
            If true, return 404 error when resources are not found.
            If false, treat missing resources as denied (allowed = false).
            Defaults to false.
    CatalogActionsBatchCheckResponse:
      type: object
      required:
        - results
      properties:
        results:
          type: array
          items:
            $ref: '#/components/schemas/CatalogActionsBatchCheckResult'
    CatalogActionsBatchCheckResult:
      type: object
      required:
        - allowed
      properties:
        allowed:
          type: boolean
        id:
          type:
            - string
            - 'null'
    CedarEffectFilter:
      type: string
      enum:
        - Permit
        - Forbid
    CedarEntitySourceInfo:
      type: object
      required:
        - source-id
        - entity-count
        - config
      properties:
        config:
          $ref: '#/components/schemas/CedarSourceConfig'
          description: Configuration details of the source.
        entity-count:
          type: integer
          format: int64
          description: Number of entities associated with this source.
          minimum: 0
        source-id:
          type: string
          format: uuid
          description: Unique identifier for the entity source.
    CedarFileSourceConfig:
      type: object
      required:
        - file-path
      properties:
        file-path:
          type: string
    CedarKubernetesConfigMapSourceConfig:
      type: object
      required:
        - configmap-name
      properties:
        configmap-name:
          type: string
    CedarPolicySourceInfo:
      type: object
      required:
        - source-id
        - policy-count
        - config
      properties:
        config:
          $ref: '#/components/schemas/CedarSourceConfig'
          description: Configuration details of the policy source.
        policy-count:
          type: integer
          format: int64
          description: Number of policies associated with this source.
          minimum: 0
        source-id:
          type: string
          format: uuid
          description: Unique identifier for the policy source.
    CedarPrincipalConstraintPattern:
      type: object
      description: |-
        Constraint patterns for filtering policies by principal constraint type.

        Each field corresponds to a Cedar principal constraint pattern.
      properties:
        eq:
          type: boolean
          description: Include policies with `principal == <PrincipalType>::"<id>"` (specific entity)
          default: false
        in:
          type: boolean
          description: |-
            Include policies with `principal in <PrincipalType>::"<id>"` (within hierarchy)
            Also covers `principal is <Path> in <PrincipalType>::"<id>"` (typed entity within hierarchy)
          default: false
        is:
          type: boolean
          description: Include policies with `principal is <PrincipalType>` (any entity of this type)
          default: false
    CedarPrincipalTypeFilter:
      type: object
      description: |-
        Filter for Cedar policy principal constraints.

        This filter allows fine-grained control over which policies to retrieve based on
        their principal scope. Each principal type has its own set of constraint patterns.
      properties:
        any:
          type: boolean
          description: Include policies where `principal` is unconstrained (applies to all principals)
          default: false
        role:
          oneOf:
            - $ref: '#/components/schemas/CedarPrincipalConstraintPattern'
              description: Constraint patterns for `Lakekeeper::Role` principals
          default:
            eq: false
            in: false
            is: false
        user:
          oneOf:
            - $ref: '#/components/schemas/CedarPrincipalConstraintPattern'
              description: Constraint patterns for `Lakekeeper::User` principals
          default:
            eq: false
            in: false
            is: false
    CedarResolveResource:
      oneOf:
        - type: string
          enum:
            - server
        - type: object
          required:
            - project
          properties:
            project:
              type: object
              properties:
                project-id:
                  type:
                    - string
                    - 'null'
                  description: Project ID. If not specified, the ambient project from the request header is used.
        - type: object
          required:
            - warehouse
          properties:
            warehouse:
              type: object
              required:
                - warehouse-id
              properties:
                warehouse-id:
                  type: string
                  format: uuid
        - type: object
          required:
            - namespace
          properties:
            namespace:
              allOf:
                - $ref: '#/components/schemas/NamespaceIdentOrUuid'
        - type: object
          required:
            - table
          properties:
            table:
              allOf:
                - $ref: '#/components/schemas/TabularIdentOrUuid'
        - type: object
          required:
            - view
          properties:
            view:
              allOf:
                - $ref: '#/components/schemas/TabularIdentOrUuid'
        - type: object
          required:
            - generic-table
          properties:
            generic-table:
              allOf:
                - $ref: '#/components/schemas/TabularIdentOrUuid'
      description: |-
        Identifies the resource whose Cedar entity hierarchy should be resolved.

        Mirrors the shape of `CatalogActionCheckOperation` used by the batch-check
        endpoint — externally-tagged enum, reuses [`NamespaceIdentOrUuid`] /
        [`TabularIdentOrUuid`] so callers can address a resource by either UUID or by
        (warehouse + name), matching the rest of the management API.
    CedarResourceConstraintPattern:
      type: object
      description: |-
        Constraint patterns for filtering policies by resource constraint type.

        Each field corresponds to a Cedar resource constraint pattern.
      properties:
        eq:
          type: boolean
          description: Include policies with `resource == <ResourceType>::"<id>"` (specific entity)
          default: false
        in:
          type: boolean
          description: |-
            Include policies with `resource in <ResourceType>::"<id>"` (within hierarchy)
            Also covers `resource is <Path> in <ResourceType>::"<id>"` (typed entity within hierarchy)
          default: false
        is:
          type: boolean
          description: Include policies with `resource is <ResourceType>` (any entity of this type)
          default: false
    CedarResourceTypeFilter:
      type: object
      description: |-
        Filter for Cedar policy resource constraints.

        This filter allows fine-grained control over which policies to retrieve based on
        their resource scope. Each resource type has its own set of constraint patterns.
      properties:
        any:
          type: boolean
          description: Include policies where `resource` is unconstrained (applies to all resources)
          default: false
        generic-table:
          oneOf:
            - $ref: '#/components/schemas/CedarResourceConstraintPattern'
              description: Constraint patterns for `Lakekeeper::GenericTable` resources
          default:
            eq: false
            in: false
            is: false
        namespace:
          oneOf:
            - $ref: '#/components/schemas/CedarResourceConstraintPattern'
              description: Constraint patterns for `Lakekeeper::Namespace` resources
          default:
            eq: false
            in: false
            is: false
        project:
          oneOf:
            - $ref: '#/components/schemas/CedarResourceConstraintPattern'
              description: Constraint patterns for `Lakekeeper::Project` resources
          default:
            eq: false
            in: false
            is: false
        role:
          oneOf:
            - $ref: '#/components/schemas/CedarResourceConstraintPattern'
              description: Constraint patterns for `Lakekeeper::Role` resources
          default:
            eq: false
            in: false
            is: false
        server:
          oneOf:
            - $ref: '#/components/schemas/CedarResourceConstraintPattern'
              description: Constraint patterns for `Lakekeeper::Server` resources
          default:
            eq: false
            in: false
            is: false
        table:
          oneOf:
            - $ref: '#/components/schemas/CedarResourceConstraintPattern'
              description: Constraint patterns for `Lakekeeper::Table` resources
          default:
            eq: false
            in: false
            is: false
        user:
          oneOf:
            - $ref: '#/components/schemas/CedarResourceConstraintPattern'
              description: Constraint patterns for `Lakekeeper::User` resources
          default:
            eq: false
            in: false
            is: false
        view:
          oneOf:
            - $ref: '#/components/schemas/CedarResourceConstraintPattern'
              description: Constraint patterns for `Lakekeeper::View` resources
          default:
            eq: false
            in: false
            is: false
        warehouse:
          oneOf:
            - $ref: '#/components/schemas/CedarResourceConstraintPattern'
              description: Constraint patterns for `Lakekeeper::Warehouse` resources
          default:
            eq: false
            in: false
            is: false
    CedarSourceConfig:
      oneOf:
        - allOf:
            - $ref: '#/components/schemas/CedarFileSourceConfig'
            - type: object
              required:
                - source-type
              properties:
                source-type:
                  type: string
                  enum:
                    - file
        - allOf:
            - $ref: '#/components/schemas/CedarKubernetesConfigMapSourceConfig'
            - type: object
              required:
                - source-type
              properties:
                source-type:
                  type: string
                  enum:
                    - kubernetes-config-map
    CheckOperation:
      oneOf:
        - type: object
          required:
            - server
          properties:
            server:
              type: object
              required:
                - action
              properties:
                action:
                  $ref: '#/components/schemas/ServerAction'
        - type: object
          required:
            - project
          properties:
            project:
              type: object
              required:
                - action
              properties:
                action:
                  $ref: '#/components/schemas/ProjectAction'
                project-id:
                  type:
                    - string
                    - 'null'
                  format: uuid
        - type: object
          required:
            - warehouse
          properties:
            warehouse:
              type: object
              required:
                - action
                - warehouse-id
              properties:
                action:
                  $ref: '#/components/schemas/WarehouseAction'
                warehouse-id:
                  type: string
                  format: uuid
        - type: object
          required:
            - namespace
          properties:
            namespace:
              allOf:
                - $ref: '#/components/schemas/NamespaceIdentOrUuid'
                - type: object
                  required:
                    - action
                  properties:
                    action:
                      $ref: '#/components/schemas/NamespaceAction'
        - type: object
          required:
            - table
          properties:
            table:
              allOf:
                - $ref: '#/components/schemas/TabularIdentOrUuid'
                - type: object
                  required:
                    - action
                  properties:
                    action:
                      $ref: '#/components/schemas/TableAction'
        - type: object
          required:
            - view
          properties:
            view:
              allOf:
                - $ref: '#/components/schemas/TabularIdentOrUuid'
                - type: object
                  required:
                    - action
                  properties:
                    action:
                      $ref: '#/components/schemas/ViewAction'
        - type: object
          required:
            - generic-table
          properties:
            generic-table:
              allOf:
                - $ref: '#/components/schemas/TabularIdentOrUuid'
                - type: object
                  required:
                    - action
                  properties:
                    action:
                      $ref: '#/components/schemas/GenericTableAction'
      description: Represents an action on an object
    CheckRequest:
      type: object
      description: Check if a specific action is allowed on the given object
      required:
        - operation
      properties:
        identity:
          oneOf:
            - type: 'null'
            - $ref: '#/components/schemas/UserOrRole'
              description: The user or role to check access for.
        operation:
          $ref: '#/components/schemas/CheckOperation'
          description: The operation to check.
    CheckResponse:
      type: object
      required:
        - allowed
      properties:
        allowed:
          type: boolean
          description: Whether the action is allowed.
    ConsoleInfo:
      type: object
      description: Information about the UI (console) shipped with this binary.
      required:
        - edition
        - version
      properties:
        commit-sha:
          type:
            - string
            - 'null'
          description: Git commit SHA of the console source, if known.
        edition:
          type: string
          description: |-
            Edition / crate name of the bundled console.
            e.g. `lakekeeper-console` for the OSS console or
            `lakekeeper-console-plus` for the enterprise console.
        version:
          type: string
          description: SemVer of the console crate.
    ControlTaskAction:
      oneOf:
        - type: object
          description: Stop the task gracefully. The task will be retried.
          required:
            - action-type
          properties:
            action-type:
              type: string
              enum:
                - stop
        - type: object
          description: Cancel the task permanently. The task is not retried.
          required:
            - action-type
          properties:
            action-type:
              type: string
              enum:
                - cancel
        - type: object
          description: |-
            Run the task immediately, moving the `scheduled_for` time to now.
            Affects only tasks in `Scheduled` or `Stopping` state.
          required:
            - action-type
          properties:
            action-type:
              type: string
              enum:
                - run-now
        - type: object
          description: |-
            Run the task at the specified time, moving the `scheduled_for` time to the provided timestamp.
            Affects only tasks in `Scheduled` or `Stopping` state.
            Timestamps must be in RFC 3339 format.
          required:
            - scheduled-for
            - action-type
          properties:
            action-type:
              type: string
              enum:
                - run-at
            scheduled-for:
              type: string
              format: date-time
              description: The time to run the task at
              example: 2025-12-31T23:59:59Z
    ControlTasksRequest:
      type: object
      required:
        - action
        - task-ids
      properties:
        action:
          $ref: '#/components/schemas/ControlTaskAction'
          description: The action to perform on the task
        task-ids:
          type: array
          items:
            type: string
            format: uuid
          description: Tasks to apply the action to
    CreateProjectRequest:
      type: object
      required:
        - project-name
      properties:
        project-id:
          type:
            - string
            - 'null'
          description: |-
            Request a specific project ID - optional.
            If not provided, a new project ID will be generated (recommended).
        project-name:
          type: string
          description: Name of the project to create.
    CreateProjectResponse:
      type: object
      required:
        - project-id
      properties:
        project-id:
          type: string
          description: ID of the created project.
    CreateRoleRequest:
      type: object
      required:
        - name
      properties:
        description:
          type:
            - string
            - 'null'
          description: Description of the role
        name:
          type: string
          description: Name of the role to create
        project-id:
          type:
            - string
            - 'null'
          description: |-
            Project ID in which the role is created.
            Deprecated: Please use the `x-project-id` header instead.
        provider-id:
          type:
            - string
            - 'null'
          description: |-
            Provider that owns this role (e.g. `"lakekeeper"`, `"oidc"`).
            Must be provided together with `source-id`. Omit both to let the server
            assign `provider-id = "lakekeeper"` and a fresh UUIDv7 `source-id`.
        source-id:
          type:
            - string
            - 'null'
          description: |-
            Identifier of the role in the provider.
            Must be provided together with `provider-id`.
    CreateUserRequest:
      type: object
      properties:
        email:
          type:
            - string
            - 'null'
          description: |-
            Email of the user. If id is not specified, the email is extracted
            from the provided token.
        id:
          type:
            - string
            - 'null'
          description: |-
            Subject id of the user - allows user provisioning.
            The id must be identical to the subject in JWT tokens, prefixed
            with `<idp-identifier>~`. For example: `oidc~1234567890` for OIDC users
            or `kubernetes~1234567890` for Kubernetes users.
            To create users in self-service manner, do not set the id.
            The id is then extracted from the passed JWT token.
        name:
          type:
            - string
            - 'null'
          description: |-
            Name of the user. If id is not specified, the name is extracted
            from the provided token.
        update-if-exists:
          type: boolean
          description: |-
            Update the user if it already exists
            Default: false
        user-type:
          oneOf:
            - type: 'null'
            - $ref: '#/components/schemas/UserType'
              description: Type of the user. Useful to override wrongly classified users
    CreateWarehouseRequest:
      type: object
      required:
        - warehouse-name
        - storage-profile
      properties:
        allowed-format-versions:
          type:
            - array
            - 'null'
          items:
            type: integer
            format: int32
          description: |-
            Iceberg table format versions that may be created in, or upgraded to,
            within this warehouse. Must be a non-empty subset of `[1, 2, 3]`.
            Defaults to all supported versions when omitted.
        default-format-version:
          type:
            - integer
            - 'null'
          format: int32
          description: |-
            Default Iceberg table format version applied when a create-table request
            does not specify one. Must be a member of `allowed-format-versions`. When
            omitted, resolves to v2 if allowed, otherwise the highest allowed version.
        delete-profile:
          $ref: '#/components/schemas/TabularDeleteProfile'
          description: 'Profile to determine behavior upon dropping of tabulars. Default: hard deletion.'
        managed-by:
          $ref: '#/components/schemas/ManagedBy'
          description: |-
            Which control plane, if any, exclusively manages this warehouse's spec.
            Defaults to `self-managed`. Creating a managed warehouse (e.g. `instance-admin`)
            requires instance-admin privilege.
        project-id:
          type:
            - string
            - 'null'
          description: |-
            Project ID in which to create the warehouse.
            Deprecated: Please use the `x-project-id` header instead.
        storage-credential:
          oneOf:
            - type: 'null'
            - $ref: '#/components/schemas/StorageCredential'
              description: Optional storage credential to use for the warehouse.
        storage-profile:
          $ref: '#/components/schemas/StorageProfile'
          description: Storage profile to use for the warehouse.
        warehouse-name:
          type: string
          description: |-
            Name of the warehouse to create. Must be unique
            within a project and may not contain "/"
    CreateWarehouseResponse:
      $ref: '#/components/schemas/GetWarehouseResponse'
    DeletedTabularResponse:
      type: object
      required:
        - id
        - name
        - namespace
        - typ
        - warehouse-id
        - created-at
        - deleted-at
        - expiration-date
      properties:
        created-at:
          type: string
          format: date-time
          description: Date when the tabular was created
        deleted-at:
          type: string
          format: date-time
          description: Date when the tabular was deleted
        expiration-date:
          type: string
          format: date-time
          description: Date when the tabular will not be recoverable anymore
        id:
          type: string
          format: uuid
          description: Unique identifier of the tabular
        name:
          type: string
          description: Name of the tabular
        namespace:
          type: array
          items:
            type: string
          description: List of namespace parts the tabular belongs to
        typ:
          $ref: '#/components/schemas/TabularType'
          description: Type of the tabular
        warehouse-id:
          type: string
          format: uuid
          description: Warehouse ID where the tabular is stored
    EndpointMode:
      oneOf:
        - type: object
          description: |-
            Use the global `OneLake` endpoint `onelake.dfs.fabric.microsoft.com`. Default.

            Also the correct choice for tenant-level private link — tenant PE
            only changes DNS resolution, not the URL Lakekeeper constructs.
          required:
            - type
          properties:
            type:
              type: string
              enum:
                - default
        - type: object
          description: |-
            Use a region-pinned endpoint `<region>-onelake.dfs.fabric.microsoft.com`.
            Use this when data residency requires the request to stay within a
            specific Azure region.
          required:
            - region
            - type
          properties:
            region:
              type: string
              description: |-
                Azure region slug, e.g. `westus`, `centralus`, `northeurope`.
                Trimmed and lowercased at validation time, then pattern-checked to
                match the Azure region-slug shape (lowercase ASCII letter followed
                by lowercase letters or digits) so a stray `.` or `-` can't smuggle
                an extra host segment into the resolved DFS host. An unknown but
                well-shaped slug still surfaces as a DNS-resolution failure at
                access time. See `normalize_endpoint_mode` for the exact rule.
            type:
              type: string
              enum:
                - regional
        - type: object
          description: |-
            Use a workspace-scoped private-link endpoint
            `<workspaceId>.z<xy>.dfs.fabric.microsoft.com`. The host is computed
            from the workspace ID at runtime; users only opt in via this variant.

            For *tenant*-level private link, stay on [`Default`] — the global
            onelake FQDN is what gets routed through a tenant PE.
          required:
            - type
          properties:
            type:
              type: string
              enum:
                - workspace-private-link
      description: |-
        How Lakekeeper connects to the `OneLake` DFS endpoint.

        Fabric supports two kinds of Azure Private Link configurations, and only
        one of them maps to a dedicated variant here:

        - **Tenant-level private link**: traffic to the global host
          `onelake.dfs.fabric.microsoft.com` is routed privately via DNS that
          points the global FQDN at a tenant-PE NIC. From Lakekeeper's
          perspective this is indistinguishable from public traffic — use
          `Default`. (Same shape as a private endpoint in front of a regular
          ADLS Gen2 storage account.)
        - **Workspace-level private link**: each workspace gets its own
          `<wsId>.z<xy>.dfs.fabric.microsoft.com` FQDN routed via a
          workspace-scoped PE. Lakekeeper needs to build that FQDN — use
          [`WorkspacePrivateLink`].
    EndpointStatistic:
      type: object
      required:
        - count
        - http-route
        - status-code
        - created-at
      properties:
        count:
          type: integer
          format: int64
          description: Number of requests to this endpoint for the current time-slice.
        created-at:
          type: string
          format: date-time
          description: |-
            Timestamp at which the datapoint was created in the database.

            This is the exact time at which the current endpoint-status-warehouse combination was called
            for the first time in the current time-slice.
        http-route:
          type: string
          description: |-
            The route of the endpoint.

            Format: `METHOD /path/to/endpoint`
        status-code:
          type: integer
          format: int32
          description: The status code of the response.
          minimum: 0
        updated-at:
          type:
            - string
            - 'null'
          format: date-time
          description: |-
            Timestamp at which the datapoint was last updated.

            This is the exact time at which the current datapoint was last updated.
        warehouse-id:
          type:
            - string
            - 'null'
          format: uuid
          description: |-
            The ID of the warehouse that handled the request.

            Only present for requests that could be associated with a warehouse. Some management
            endpoints cannot be associated with a warehouse, e.g. warehouse creation or user management
            will not have a `warehouse-id`.
        warehouse-name:
          type:
            - string
            - 'null'
          description: |-
            The name of the warehouse that handled the request.

            Only present for requests that could be associated with a warehouse. Some management
            endpoints cannot be associated with a warehouse, e.g. warehouse creation or user management
            will not have a `warehouse-id`
    EndpointStatisticsResponse:
      type: object
      required:
        - timestamps
        - called-endpoints
        - previous-page-token
        - next-page-token
      properties:
        called-endpoints:
          type: array
          items:
            type: array
            items:
              $ref: '#/components/schemas/EndpointStatistic'
          description: |-
            Array of arrays of statistics detailing each called endpoint for each `timestamp`.

            See docs of `timestamps` for more details.
        next-page-token:
          type: string
          description: |-
            Token to get the next page of results.

            Inverse of `previous-page-token`, see its documentation above.
        previous-page-token:
          type: string
          description: |-
            Token to get the previous page of results.

            Endpoint statistics are not paginated through page-limits, we paginate them by stepping
            through time. By default, the list-statistics endpoint will return all statistics for
            `now()` - 1 day to `now()`. In the request, you can specify a `range_specifier` to set the end
            date and step interval. The `previous-page-token` will then move to the neighboring window.
            E.g. in the default case of `now()` and 1 day, it'd be `now()` - 2 days to `now()` - 1 day.
        timestamps:
          type: array
          items:
            type: string
            format: date-time
          description: |-
            Array of timestamps indicating the time at which each entry in the `called_endpoints` array
            is valid.

            We lazily create a new statistics entry every hour, in between hours, the existing entry
            is being updated. If any endpoint is called in the following hour, there'll be an entry in
            `timestamps` for the following hour. If not, then there'll be no entry.
    ErrorModel:
      type: object
      description: JSON error payload returned in a response with further details on the error
      required:
        - message
        - type
        - code
      properties:
        code:
          type: integer
          format: int32
          description: HTTP response code
          minimum: 0
        message:
          type: string
          description: Human-readable error message
        stack:
          type: array
          items:
            type: string
        type:
          type: string
          description: Internal type definition of the error
    ExpireSnapshotsQueueConfig:
      type: object
      description: |-
        Warehouse-specific configuration for the expiration queue.
        Parameters can be overridden with table properties. Please see the documentation of each parameter for details.
      properties:
        enable-expire-snapshots:
          type:
            - boolean
            - 'null'
          description: |-
            Enable or disable automatic expiration of snapshots for all tables in this warehouse.
            Can be overridden on a per-table level with the table property `lakekeeper.history.expire.enabled`.
            Tables with the `gc.enabled` flag set to false, are also excluded from automatic expiration.
          default: 'false'
        max-ref-age-ms:
          type:
            - integer
            - 'null'
          format: int64
          description: |-
            For snapshot references except the main branch, default max age of snapshot references to keep while expiring snapshots.
            The main branch never expires.
            If not set, defaults to `i64::MAX` (no expiration).
          default: 9223372036854775807
        max-snapshot-age-ms:
          type:
            - integer
            - 'null'
          format: int64
          description: |-
            Default maximum age of a snapshot in milliseconds before it is considered expired.
            If not set, defaults to `432000000` (5 days).
            Can be overridden on a per-table level with the table property `history.expire.max-snapshot-age-ms`.
          default: 432000000
        min-snapshots-to-expire:
          type:
            - integer
            - 'null'
          format: int32
          description: |-
            Minimum number of snapshots that must be eligible for expiration before the job runs.
            This prevents expensive expiration jobs from running when there are only a few snapshots to expire.
            If not set, defaults to `20`.
            Can be overridden on a per-table level with the table property `lakekeeper.history.expire.min-snapshots-to-expire`.
          default: 20
          minimum: 0
        min-snapshots-to-keep:
          type:
            - integer
            - 'null'
          format: int32
          description: |-
            Default min number of snapshots to keep on the table and all of its branches while expiring snapshots.
            If not set, defaults to `1`.
            Can be overridden on a per-table level with the table property `history.expire.min-snapshots-to-keep`.
          default: 1
    GcsCredential:
      oneOf:
        - type: object
          title: GcsCredentialServiceAccountKey
          description: |-
            Service Account Key

            The key is the JSON object obtained when creating a service account key in the GCP console.
          required:
            - key
            - credential-type
          properties:
            credential-type:
              type: string
              enum:
                - service-account-key
            key:
              $ref: '#/components/schemas/GcsServiceKey'
        - type: object
          title: GcsCredentialSystemIdentity
          description: |-
            GCP System Identity

            Use the service account that the application is running as.
            This can be a Compute Engine default service account or a user-assigned service account.
          required:
            - credential-type
          properties:
            credential-type:
              type: string
              enum:
                - gcp-system-identity
      description: |-
        GCS Credentials

        Currently only supports Service Account Key
        Example of a key:
        ```json
            {
              "type": "service_account",
              "project_id": "example-project-1234",
              "private_key_id": "....",
              "private_key": "-----BEGIN PRIVATE KEY-----\n.....\n-----END PRIVATE KEY-----\n",
              "client_email": "abc@example-project-1234.iam.gserviceaccount.com",
              "client_id": "123456789012345678901",
              "auth_uri": "https://accounts.google.com/o/oauth2/auth",
              "token_uri": "https://oauth2.googleapis.com/token",
              "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
              "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/abc%example-project-1234.iam.gserviceaccount.com",
              "universe_domain": "googleapis.com"
            }
        ```
    GcsCredentialType:
      type: string
      description: The type of GCS credential.
      enum:
        - service-account-key
        - gcp-system-identity
    GcsProfile:
      type: object
      required:
        - bucket
      properties:
        bucket:
          type: string
          description: Name of the GCS bucket
        key-prefix:
          type:
            - string
            - 'null'
          description: Subpath in the bucket to use.
        storage-layout:
          oneOf:
            - type: 'null'
            - $ref: '#/components/schemas/StorageLayout'
              description: Storage layout for namespace and tabular paths.
        sts-enabled:
          type: boolean
          description: |-
            Enable STS (Security Token Service) downscoped token generation for GCS.
            When disabled, clients cannot use vended credentials for this storage profile.
            Defaults to true.
    GcsServiceKey:
      type: object
      required:
        - type
        - project_id
        - private_key_id
        - private_key
        - client_email
        - client_id
        - auth_uri
        - token_uri
        - auth_provider_x509_cert_url
        - client_x509_cert_url
        - universe_domain
      properties:
        auth_provider_x509_cert_url:
          type: string
        auth_uri:
          type: string
        client_email:
          type: string
        client_id:
          type: string
        client_x509_cert_url:
          type: string
        private_key:
          type: string
        private_key_id:
          type: string
        project_id:
          type: string
        token_uri:
          type: string
        type:
          type: string
        universe_domain:
          type: string
    GenericTableAction:
      type: string
      enum:
        - drop
        - undrop
        - write_data
        - read_data
        - get_metadata
        - rename
        - include_in_list
        - get_tasks
        - control_tasks
        - set_protection
        - read_assignments
        - grant_pass_grants
        - grant_manage_grants
        - grant_describe
        - grant_select
        - grant_modify
        - change_ownership
    GenericTableAssignment:
      oneOf:
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - ownership
          title: GenericTableAssignmentOwnership
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - pass_grants
          title: GenericTableAssignmentPassGrants
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - manage_grants
          title: GenericTableAssignmentManageGrants
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - describe
          title: GenericTableAssignmentDescribe
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - select
          title: GenericTableAssignmentSelect
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - modify
          title: GenericTableAssignmentModify
    GenericTableRelation:
      type: string
      enum:
        - ownership
        - pass_grants
        - manage_grants
        - describe
        - select
        - modify
    GetCedarPoliciesResponse:
      type: object
      required:
        - policies
      properties:
        next-page-token:
          type:
            - string
            - 'null'
          description: |-
            Opaque token for retrieving the next page of results.
            If `None`, there are no more pages to retrieve.
        policies:
          type: array
          items: {}
          description: |-
            List of JSON formatted Cedar policies.

            For schema details, see `<https://docs.cedarpolicy.com/policies/json-format.html>`
    GetCedarSchemaResponse:
      type: object
      required:
        - schema-fragments
      properties:
        schema-fragments:
          type: object
          description: |-
            The currently active Cedar schema fragments.
            The key is the fragment file path, and the value is the fragment content.
          additionalProperties:
            type: string
          propertyNames:
            type: string
    GetEndpointStatisticsRequest:
      type: object
      required:
        - warehouse
      properties:
        range-specifier:
          oneOf:
            - type: 'null'
            - $ref: '#/components/schemas/TimeWindowSelector'
              description: |-
                Range specifier

                Either for an explicit range or a page token to paginate through the results. See the docs of
                `TimeWindowSelector` for more details.
        status-codes:
          type:
            - array
            - 'null'
          items:
            type: integer
            format: int32
            minimum: 0
          description: |-
            Status code filter

            Optional filter to only return statistics for requests with specific status codes.
        warehouse:
          $ref: '#/components/schemas/WarehouseFilter'
          description: |-
            Warehouse filter

            Can return statistics for a specific warehouse, all warehouses or requests that could not be
            associated to any warehouse.
    GetExpireSnapshotsQueueConfig:
      type: object
      required:
        - queue-config
      properties:
        max-seconds-since-last-heartbeat:
          type:
            - integer
            - 'null'
          format: int64
        queue-config:
          $ref: '#/components/schemas/ExpireSnapshotsQueueConfig'
    GetGenericTableAssignmentsResponse:
      type: object
      required:
        - assignments
      properties:
        assignments:
          type: array
          items:
            $ref: '#/components/schemas/GenericTableAssignment'
    GetLakekeeperGenericTableActionsResponse:
      type: object
      required:
        - allowed-actions
      properties:
        allowed-actions:
          type: array
          items:
            $ref: '#/components/schemas/LakekeeperGenericTableAction'
    GetLakekeeperNamespaceActionsResponse:
      type: object
      required:
        - allowed-actions
      properties:
        allowed-actions:
          type: array
          items:
            $ref: '#/components/schemas/LakekeeperNamespaceActionKind'
    GetLakekeeperProjectActionsResponse:
      type: object
      required:
        - allowed-actions
      properties:
        allowed-actions:
          type: array
          items:
            $ref: '#/components/schemas/LakekeeperProjectActionKind'
    GetLakekeeperRoleActionsResponse:
      type: object
      required:
        - allowed-actions
      properties:
        allowed-actions:
          type: array
          items:
            $ref: '#/components/schemas/LakekeeperRoleActionKind'
    GetLakekeeperServerActionsResponse:
      type: object
      required:
        - allowed-actions
      properties:
        allowed-actions:
          type: array
          items:
            $ref: '#/components/schemas/LakekeeperServerActionKind'
    GetLakekeeperTableActionsResponse:
      type: object
      required:
        - allowed-actions
      properties:
        allowed-actions:
          type: array
          items:
            $ref: '#/components/schemas/LakekeeperTableActionKind'
    GetLakekeeperUserActionsResponse:
      type: object
      required:
        - allowed-actions
      properties:
        allowed-actions:
          type: array
          items:
            $ref: '#/components/schemas/LakekeeperUserAction'
    GetLakekeeperViewActionsResponse:
      type: object
      required:
        - allowed-actions
      properties:
        allowed-actions:
          type: array
          items:
            $ref: '#/components/schemas/LakekeeperViewActionKind'
    GetLakekeeperWarehouseActionsResponse:
      type: object
      required:
        - allowed-actions
      properties:
        allowed-actions:
          type: array
          items:
            $ref: '#/components/schemas/LakekeeperWarehouseActionKind'
    GetNamespaceAccessResponse:
      type: object
      required:
        - allowed-actions
      properties:
        allowed-actions:
          type: array
          items:
            $ref: '#/components/schemas/NamespaceAction'
    GetNamespaceAssignmentsResponse:
      type: object
      required:
        - assignments
      properties:
        assignments:
          type: array
          items:
            $ref: '#/components/schemas/NamespaceAssignment'
    GetNamespaceAuthPropertiesResponse:
      type: object
      required:
        - managed-access
        - managed-access-inherited
      properties:
        managed-access:
          type: boolean
        managed-access-inherited:
          type: boolean
    GetOpenFGAGenericTableActionsResponse:
      type: object
      required:
        - allowed-actions
      properties:
        allowed-actions:
          type: array
          items:
            $ref: '#/components/schemas/OpenFGAGenericTableAction'
    GetOpenFGANamespaceActionsResponse:
      type: object
      required:
        - allowed-actions
      properties:
        allowed-actions:
          type: array
          items:
            $ref: '#/components/schemas/OpenFGANamespaceAction'
    GetOpenFGAProjectActionsResponse:
      type: object
      required:
        - allowed-actions
      properties:
        allowed-actions:
          type: array
          items:
            $ref: '#/components/schemas/OpenFGAProjectAction'
    GetOpenFGARoleActionsResponse:
      type: object
      required:
        - allowed-actions
      properties:
        allowed-actions:
          type: array
          items:
            $ref: '#/components/schemas/OpenFGARoleAction'
    GetOpenFGAServerActionsResponse:
      type: object
      required:
        - allowed-actions
      properties:
        allowed-actions:
          type: array
          items:
            $ref: '#/components/schemas/OpenFGAServerAction'
    GetOpenFGATableActionsResponse:
      type: object
      required:
        - allowed-actions
      properties:
        allowed-actions:
          type: array
          items:
            $ref: '#/components/schemas/OpenFGATableAction'
    GetOpenFGAViewActionsResponse:
      type: object
      required:
        - allowed-actions
      properties:
        allowed-actions:
          type: array
          items:
            $ref: '#/components/schemas/OpenFGAViewAction'
    GetOpenFGAWarehouseActionsResponse:
      type: object
      required:
        - allowed-actions
      properties:
        allowed-actions:
          type: array
          items:
            $ref: '#/components/schemas/OpenFGAWarehouseAction'
    GetProjectAccessResponse:
      type: object
      required:
        - allowed-actions
      properties:
        allowed-actions:
          type: array
          items:
            $ref: '#/components/schemas/ProjectAction'
    GetProjectAssignmentsResponse:
      type: object
      required:
        - assignments
        - project-id
      properties:
        assignments:
          type: array
          items:
            $ref: '#/components/schemas/ProjectAssignment'
        project-id:
          type: string
          format: uuid
    GetProjectResponse:
      type: object
      required:
        - project-id
        - project-name
      properties:
        project-id:
          type: string
          description: ID of the project.
        project-name:
          type: string
          description: Name of the project
    GetProjectTaskDetailsResponse:
      allOf:
        - $ref: '#/components/schemas/ProjectTaskInfo'
          description: Most recent task information
        - type: object
          required:
            - task-data
            - attempts
          properties:
            attempts:
              type: array
              items:
                $ref: '#/components/schemas/TaskAttempt'
              description: History of past attempts
            execution-details:
              type:
                - object
                - 'null'
              description: Execution details for the current attempt
            message:
              type:
                - string
                - 'null'
              description: |-
                Message for the current attempt: success result details if it
                succeeded, or the failure reason if it failed. `null` while the
                attempt is still running or scheduled.
            task-data:
              type: object
              description: Task-specific data
    GetPurgeQueueConfig:
      type: object
      required:
        - queue-config
      properties:
        max-seconds-since-last-heartbeat:
          type:
            - integer
            - 'null'
          format: int64
        queue-config:
          $ref: '#/components/schemas/PurgeQueueConfig'
    GetRemoveOrphanFilesQueueConfig:
      type: object
      required:
        - queue-config
      properties:
        max-seconds-since-last-heartbeat:
          type:
            - integer
            - 'null'
          format: int64
        queue-config:
          $ref: '#/components/schemas/RemoveOrphanFilesQueueConfig'
    GetRoleAccessResponse:
      type: object
      required:
        - allowed-actions
      properties:
        allowed-actions:
          type: array
          items:
            $ref: '#/components/schemas/RoleAction'
    GetRoleAssignmentsResponse:
      type: object
      required:
        - assignments
      properties:
        assignments:
          type: array
          items:
            $ref: '#/components/schemas/RoleAssignment'
    GetServerAccessResponse:
      type: object
      required:
        - allowed-actions
      properties:
        allowed-actions:
          type: array
          items:
            $ref: '#/components/schemas/ServerAction'
    GetServerAssignmentsResponse:
      type: object
      required:
        - assignments
      properties:
        assignments:
          type: array
          items:
            $ref: '#/components/schemas/ServerAssignment'
    GetTableAccessResponse:
      type: object
      required:
        - allowed-actions
      properties:
        allowed-actions:
          type: array
          items:
            $ref: '#/components/schemas/TableAction'
    GetTableAssignmentsResponse:
      type: object
      required:
        - assignments
      properties:
        assignments:
          type: array
          items:
            $ref: '#/components/schemas/TableAssignment'
    GetTabularExpirationQueueConfig:
      type: object
      required:
        - queue-config
      properties:
        max-seconds-since-last-heartbeat:
          type:
            - integer
            - 'null'
          format: int64
        queue-config:
          $ref: '#/components/schemas/TabularExpirationQueueConfig'
    GetTaskDetailsResponse:
      allOf:
        - $ref: '#/components/schemas/WarehouseTaskInfo'
          description: Most recent task information
        - type: object
          required:
            - task-data
            - attempts
          properties:
            attempts:
              type: array
              items:
                $ref: '#/components/schemas/TaskAttempt'
              description: History of past attempts
            execution-details:
              type:
                - object
                - 'null'
              description: Execution details for the current attempt
            message:
              type:
                - string
                - 'null'
              description: |-
                Message for the current attempt: success result details if it
                succeeded, or the failure reason if it failed. `null` while the
                attempt is still running or scheduled.
            task-data:
              type: object
              description: Task-specific data
    GetTaskLogCleanupConfig:
      type: object
      required:
        - queue-config
      properties:
        max-seconds-since-last-heartbeat:
          type:
            - integer
            - 'null'
          format: int64
        queue-config:
          $ref: '#/components/schemas/TaskLogCleanupConfig'
    GetViewAccessResponse:
      type: object
      required:
        - allowed-actions
      properties:
        allowed-actions:
          type: array
          items:
            $ref: '#/components/schemas/ViewAction'
    GetViewAssignmentsResponse:
      type: object
      required:
        - assignments
      properties:
        assignments:
          type: array
          items:
            $ref: '#/components/schemas/ViewAssignment'
    GetWarehouseAccessResponse:
      type: object
      required:
        - allowed-actions
      properties:
        allowed-actions:
          type: array
          items:
            $ref: '#/components/schemas/WarehouseAction'
    GetWarehouseAssignmentsResponse:
      type: object
      required:
        - assignments
      properties:
        assignments:
          type: array
          items:
            $ref: '#/components/schemas/WarehouseAssignment'
    GetWarehouseAuthPropertiesResponse:
      type: object
      required:
        - managed-access
      properties:
        managed-access:
          type: boolean
    GetWarehouseResponse:
      type: object
      required:
        - id
        - warehouse-id
        - name
        - project-id
        - storage-profile
        - delete-profile
        - status
        - protected
        - allowed-format-versions
      properties:
        allowed-format-versions:
          type: array
          items:
            type: integer
            format: int32
          description: |-
            Iceberg table format versions that may be created in, or upgraded to,
            within this warehouse.
        default-format-version:
          type:
            - integer
            - 'null'
          format: int32
          description: |-
            Default Iceberg table format version applied when a create-table request
            does not specify one. When absent, resolves to v2 if allowed, otherwise
            the highest allowed version.
        delete-profile:
          $ref: '#/components/schemas/TabularDeleteProfile'
          description: Delete profile used for the warehouse.
        id:
          type: string
          format: uuid
          description: ID of the warehouse.
          deprecated: true
        managed-by:
          $ref: '#/components/schemas/ManagedBy'
          description: |-
            Which control plane, if any, exclusively manages this warehouse's spec.
            When not `self-managed`, spec mutations are restricted to that control plane.
        name:
          type: string
          description: Name of the warehouse.
        project-id:
          type: string
          description: Project ID in which the warehouse was created.
        protected:
          type: boolean
          description: Whether the warehouse is protected from being deleted.
        status:
          $ref: '#/components/schemas/WarehouseStatus'
          description: Whether the warehouse is active.
        storage-credential-type:
          oneOf:
            - type: 'null'
            - $ref: '#/components/schemas/StorageCredentialType'
              description: |-
                Best-effort indicator of the storage credential type. When present it
                reflects the detected credential kind; when absent the warehouse may
                either have no credential configured or the secret lookup may have
                failed. Does not contain secret values.
        storage-profile:
          $ref: '#/components/schemas/StorageProfile'
          description: Storage profile used for the warehouse.
        updated-at:
          type:
            - string
            - 'null'
          format: date-time
          description: Last updated timestamp.
        warehouse-id:
          type: string
          format: uuid
          description: ID of the warehouse.
    IcebergErrorResponse:
      type: object
      description: JSON wrapper for all error responses (non-2xx)
      required:
        - error
      properties:
        error:
          $ref: '#/components/schemas/ErrorModel'
    LakekeeperGenericTableAction:
      oneOf:
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - drop
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - read_data
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - write_data
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - get_metadata
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - rename
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - include_in_list
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - undrop
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - get_tasks
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - control_tasks
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - set_protection
    LakekeeperNamespaceAction:
      oneOf:
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - create_table
            name:
              type:
                - string
                - 'null'
              description: Name of the table to create.
            properties:
              type: object
              additionalProperties:
                type: string
              propertyNames:
                type: string
            table_id:
              type:
                - string
                - 'null'
              format: uuid
              description: Table ID, if externally provided (e.g. via register).
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - create_view
            name:
              type:
                - string
                - 'null'
              description: Name of the view to create.
            properties:
              type: object
              additionalProperties:
                type: string
              propertyNames:
                type: string
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - create_namespace
            name:
              type:
                - string
                - 'null'
              description: Name of the namespace to create.
            properties:
              type: object
              additionalProperties:
                type: string
              propertyNames:
                type: string
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - delete
            force:
              type: boolean
              description: |-
                Whether the warehouse-configured soft-deletion is bypassed, i.e.
                contained tabulars are hard-deleted immediately instead of being
                recoverable for the configured grace period.
            purge:
              type: boolean
              description: Whether the underlying data/metadata files are physically purged.
            recursive:
              type: boolean
              description: |-
                Whether the drop recurses into child namespaces, tables and views,
                deleting the entire subtree rooted at this namespace.
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - update_properties
            removed_properties:
              type: array
              items:
                type: string
            updated_properties:
              type: object
              additionalProperties:
                type: string
              propertyNames:
                type: string
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - get_metadata
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - list_tables
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - list_views
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - list_namespaces
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - list_everything
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - set_protection
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - include_in_list
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - create_generic_table
            base_location:
              type:
                - string
                - 'null'
              description: |-
                User-supplied base location override — primary lever for
                path-based authorization policy.
            format:
              type:
                - string
                - 'null'
              description: |-
                Generic table format (e.g. "lance", "delta") — primary lever for
                format-based authorization policy.
            generic_table_id:
              type:
                - string
                - 'null'
              format: uuid
              description: Generic table ID, if externally provided.
            name:
              type:
                - string
                - 'null'
              description: Name of the generic table to create.
            properties:
              type: object
              additionalProperties:
                type: string
              propertyNames:
                type: string
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - list_generic_tables
    LakekeeperNamespaceActionKind:
      oneOf:
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - create_table
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - create_view
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - create_namespace
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - delete
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - update_properties
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - get_metadata
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - list_tables
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - list_views
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - list_namespaces
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - list_everything
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - set_protection
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - include_in_list
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - create_generic_table
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - list_generic_tables
    LakekeeperProjectAction:
      oneOf:
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - create_warehouse
            name:
              type:
                - string
                - 'null'
              description: Name of the warehouse to create.
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - delete
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - rename
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - get_metadata
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - list_warehouses
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - include_in_list
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - create_role
            name:
              type:
                - string
                - 'null'
              description: Name of the role to create.
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - list_roles
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - search_roles
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - get_endpoint_statistics
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - modify_task_queue_config
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - get_task_queue_config
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - get_project_tasks
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - control_project_tasks
    LakekeeperProjectActionKind:
      oneOf:
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - create_warehouse
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - delete
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - rename
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - get_metadata
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - list_warehouses
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - include_in_list
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - create_role
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - list_roles
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - search_roles
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - get_endpoint_statistics
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - modify_task_queue_config
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - get_task_queue_config
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - get_project_tasks
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - control_project_tasks
    LakekeeperRoleActionKind:
      oneOf:
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - read
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - read_metadata
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - delete
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - update
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - manage_role_assignments
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - read_role_assignments
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - update_source_system
    LakekeeperServerAction:
      oneOf:
        - type: object
          description: Can create items inside the server (can create Warehouses).
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - create_project
            name:
              type:
                - string
                - 'null'
              description: Name of the project to create.
            project_id:
              type:
                - string
                - 'null'
              description: Project ID, if externally provided.
        - type: object
          description: Can update all users on this server.
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - update_users
        - type: object
          description: Can delete all users on this server.
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - delete_users
        - type: object
          description: Can List all users on this server.
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - list_users
        - type: object
          description: Can provision user
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - provision_users
    LakekeeperServerActionKind:
      oneOf:
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - create_project
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - update_users
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - delete_users
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - list_users
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - provision_users
    LakekeeperTableAction:
      oneOf:
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - drop
            force:
              type: boolean
              description: |-
                Whether the warehouse-configured soft-deletion is bypassed, i.e. the
                table is hard-deleted immediately instead of being recoverable for the
                configured grace period. Extra destructive — irreversible right away.
            purge:
              type: boolean
              description: Whether the underlying data files are physically purged from storage.
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - write_data
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - read_data
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - get_metadata
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - commit
            removed_properties:
              type: array
              items:
                type: string
            updated_properties:
              type: object
              additionalProperties:
                type: string
              propertyNames:
                type: string
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - rename
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - include_in_list
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - undrop
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - get_tasks
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - control_tasks
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - set_protection
    LakekeeperTableActionKind:
      oneOf:
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - drop
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - write_data
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - read_data
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - get_metadata
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - commit
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - rename
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - include_in_list
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - undrop
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - get_tasks
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - control_tasks
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - set_protection
    LakekeeperUserAction:
      oneOf:
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - read
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - update
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - delete
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - read_role_assignments
    LakekeeperViewAction:
      oneOf:
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - drop
            force:
              type: boolean
              description: |-
                Whether the warehouse-configured soft-deletion is bypassed, i.e. the
                view is hard-deleted immediately instead of being recoverable for the
                configured grace period. Extra destructive — irreversible right away.
            purge:
              type: boolean
              description: Whether the underlying metadata files are physically purged from storage.
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - get_metadata
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - select
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - commit
            removed_properties:
              type: array
              items:
                type: string
            updated_properties:
              type: object
              additionalProperties:
                type: string
              propertyNames:
                type: string
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - include_in_list
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - rename
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - undrop
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - get_tasks
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - control_tasks
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - set_protection
    LakekeeperViewActionKind:
      oneOf:
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - drop
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - get_metadata
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - select
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - commit
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - include_in_list
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - rename
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - undrop
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - get_tasks
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - control_tasks
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - set_protection
    LakekeeperWarehouseAction:
      oneOf:
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - create_namespace
            name:
              type:
                - string
                - 'null'
              description: Name of the namespace to create.
            properties:
              type: object
              additionalProperties:
                type: string
              propertyNames:
                type: string
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - delete
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - update_storage
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - update_storage_credential
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - get_metadata
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - get_config
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - list_namespaces
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - list_everything
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - use
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - include_in_list
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - deactivate
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - activate
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - rename
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - list_deleted_tabulars
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - modify_soft_deletion
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - get_task_queue_config
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - modify_task_queue_config
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - get_all_tasks
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - control_all_tasks
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - set_protection
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - set_format_version_policy
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - get_endpoint_statistics
    LakekeeperWarehouseActionKind:
      oneOf:
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - create_namespace
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - delete
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - update_storage
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - update_storage_credential
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - get_metadata
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - get_config
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - list_namespaces
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - list_everything
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - use
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - include_in_list
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - deactivate
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - activate
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - rename
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - list_deleted_tabulars
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - modify_soft_deletion
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - get_task_queue_config
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - modify_task_queue_config
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - get_all_tasks
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - control_all_tasks
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - set_protection
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - set_format_version_policy
        - type: object
          required:
            - action
          properties:
            action:
              type: string
              enum:
                - get_endpoint_statistics
    LicenseStatus:
      type: object
      description: Status of license validation
      required:
        - license-type
        - valid
      properties:
        audience:
          type:
            - string
            - 'null'
          description: Audience or entity the license is issued to
        customer:
          type:
            - string
            - 'null'
          description: Customer name the license is issued to (None for open source)
        error:
          type:
            - string
            - 'null'
          description: Any validation error that occurred
        expiration:
          type:
            - string
            - 'null'
          format: date-time
          description: License expiration date (None for perpetual licenses like Apache)
        issuer:
          type:
            - string
            - 'null'
          description: Organization or entity that issued the license for Lakekeeper
        license-id:
          type:
            - string
            - 'null'
          description: License ID or identifier
        license-type:
          type: string
          description: License type (e.g., "Apache-2.0", "Vakamo-Enterprise", etc.)
        valid:
          type: boolean
          description: If the license is valid and active
    ListCedarEntitySourcesResponse:
      type: object
      required:
        - entity-sources
      properties:
        entity-sources:
          type: array
          items:
            $ref: '#/components/schemas/CedarEntitySourceInfo'
    ListCedarPoliciesQuery:
      type: object
      description: |-
        Query parameters for listing Cedar policies.

        # Pagination Consistency

        When using pagination with `page_token`, list continuation is only consistent if
        policy sources have not changed between calls. If policy sources are added, removed,
        or modified between paginated requests, results may be incomplete or contain duplicates.
      properties:
        effect-filter:
          oneOf:
            - type: 'null'
            - $ref: '#/components/schemas/CedarEffectFilter'
              description: |-
                Filter by effect (permit/forbid).
                If not provided, policies of all effects are returned.
        page-size:
          type: integer
          description: |-
            Maximum number of policies to return per page.
            Defaults to 1000 if not specified.
          minimum: 0
        page-token:
          type:
            - string
            - 'null'
          description: |-
            Opaque page token from a previous response.
            Use this to retrieve the next page of results.
            The token represents a policy ID to start from.
        principal-type-filter:
          oneOf:
            - type: 'null'
            - $ref: '#/components/schemas/CedarPrincipalTypeFilter'
              description: |-
                Filter by principal entity type names.
                Returns policies where the principal scope matches any of these types.
        resource-type-filter:
          oneOf:
            - type: 'null'
            - $ref: '#/components/schemas/CedarResourceTypeFilter'
              description: |-
                Filter by resource entity type names.
                Returns policies where the resource scope matches any of these types.
        source-filter:
          type:
            - array
            - 'null'
          items:
            type: string
            format: uuid
          description: |-
            Only return policies from the specified source IDs.
            If not provided, policies from all sources are returned.
    ListCedarPolicySourcesResponse:
      type: object
      required:
        - policy-sources
      properties:
        policy-sources:
          type: array
          items:
            $ref: '#/components/schemas/CedarPolicySourceInfo'
    ListDeletedTabularsResponse:
      type: object
      required:
        - tabulars
      properties:
        next-page-token:
          type:
            - string
            - 'null'
          description: Token to fetch the next page
        tabulars:
          type: array
          items:
            $ref: '#/components/schemas/DeletedTabularResponse'
          description: List of tabulars
    ListProjectTasksRequest:
      type: object
      properties:
        created-after:
          type:
            - string
            - 'null'
          format: date-time
          description: Filter tasks created after this timestamp
          example: 2025-12-31T23:59:59Z
        created-before:
          type:
            - string
            - 'null'
          format: date-time
          description: Filter tasks created before this timestamp
          example: 2025-12-31T23:59:59Z
        page-size:
          type:
            - integer
            - 'null'
          format: int64
          description: Number of results per page
        page-token:
          type:
            - string
            - 'null'
          description: |-
            Next page token, re-use the same request as for the original request,
            but set this to the `next_page_token` from the previous response.
            Stop iterating when no more items are returned in a page.
        queue-name:
          type:
            - array
            - 'null'
          items:
            type: string
          description: Filter by one or more queue names
        status:
          type:
            - array
            - 'null'
          items:
            $ref: '#/components/schemas/TaskStatus'
          description: Filter by task status
    ListProjectTasksResponse:
      type: object
      required:
        - tasks
      properties:
        next-page-token:
          type:
            - string
            - 'null'
          description: Token for the next page of results
        tasks:
          type: array
          items:
            $ref: '#/components/schemas/ProjectTaskInfo'
          description: List of tasks
    ListProjectsResponse:
      type: object
      required:
        - projects
      properties:
        projects:
          type: array
          items:
            $ref: '#/components/schemas/GetProjectResponse'
          description: List of projects
    ListRoleMembersResponse:
      type: object
      description: |-
        One page of a role's members (users ∪ member roles) — direct for `/members`,
        transitive for `/members/transitive`.
      required:
        - members
      properties:
        members:
          type: array
          items:
            $ref: '#/components/schemas/RoleMember'
        next-page-token:
          type:
            - string
            - 'null'
          description: |-
            Token for the next page; `null`/absent once the listing is exhausted.
            Note for SDK authors: **stop when `next-page-token` is null/absent.** The
            final page of results may itself return a null token, so don't rely on
            receiving a separate trailing empty page — keep requesting until the token
            is null.
    ListRoleMembershipsResponse:
      type: object
      description: |-
        One page of roles — the `member-of` set or a user's roles, direct or transitive
        depending on the endpoint.
      required:
        - roles
      properties:
        next-page-token:
          type:
            - string
            - 'null'
          description: |-
            Token for the next page; `null`/absent once the listing is exhausted.
            Note for SDK authors: **stop when `next-page-token` is null/absent.** The
            final page of results may itself return a null token, so don't rely on
            receiving a separate trailing empty page — keep requesting until the token
            is null.
        roles:
          type: array
          items:
            $ref: '#/components/schemas/RoleMembership'
    ListRolesResponse:
      type: object
      required:
        - roles
      properties:
        next-page-token:
          type:
            - string
            - 'null'
        roles:
          type: array
          items:
            $ref: '#/components/schemas/Role'
    ListTasksRequest:
      type: object
      properties:
        created-after:
          type:
            - string
            - 'null'
          format: date-time
          description: Filter tasks created after this timestamp
          example: 2025-12-31T23:59:59Z
        created-before:
          type:
            - string
            - 'null'
          format: date-time
          description: Filter tasks created before this timestamp
          example: 2025-12-31T23:59:59Z
        entities:
          type:
            - array
            - 'null'
          items:
            $ref: '#/components/schemas/WarehouseTaskEntityFilter'
          description: Filter by specific entity
        page-size:
          type:
            - integer
            - 'null'
          format: int64
          description: Number of results per page
        page-token:
          type:
            - string
            - 'null'
          description: |-
            Next page token, re-use the same request as for the original request,
            but set this to the `next_page_token` from the previous response.
            Stop iterating when no more items are returned in a page.
        queue-name:
          type:
            - array
            - 'null'
          items:
            type: string
          description: Filter by one or more queue names
        status:
          type:
            - array
            - 'null'
          items:
            $ref: '#/components/schemas/TaskStatus'
          description: Filter by task status
    ListTasksResponse:
      type: object
      required:
        - tasks
      properties:
        next-page-token:
          type:
            - string
            - 'null'
          description: Token for the next page of results
        tasks:
          type: array
          items:
            $ref: '#/components/schemas/WarehouseTaskInfo'
          description: List of tasks
    ListUsersResponse:
      type: object
      required:
        - users
      properties:
        next-page-token:
          type:
            - string
            - 'null'
        users:
          type: array
          items:
            $ref: '#/components/schemas/User'
    ListWarehousesResponse:
      type: object
      required:
        - warehouses
      properties:
        warehouses:
          type: array
          items:
            $ref: '#/components/schemas/GetWarehouseResponse'
          description: List of warehouses in the project.
    ManagedBy:
      type: string
      description: |-
        Which control plane, if any, exclusively manages a warehouse's spec.

        `self-managed` (the default) leaves the spec mutable by the warehouse's own
        owners through the usual grants. When set to `instance-admin`, spec changes —
        storage profile, credentials, delete profile, rename, status, protection,
        format-version policy, and deletion — are accepted only from instance
        administrators; other callers are rejected even when their grants would
        otherwise allow it. Child resources (namespaces, tables, grants), task-queue
        configuration, and data access are unaffected.
      enum:
        - self-managed
        - instance-admin
    NamespaceAction:
      type: string
      enum:
        - create_table
        - create_view
        - create_generic_table
        - create_namespace
        - delete
        - update_properties
        - get_metadata
        - read_assignments
        - grant_create
        - grant_describe
        - grant_modify
        - grant_select
        - grant_pass_grants
        - grant_manage_grants
        - set_protection
    NamespaceAssignment:
      oneOf:
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - ownership
          title: NamespaceAssignmentOwnership
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - pass_grants
          title: NamespaceAssignmentPassGrants
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - manage_grants
          title: NamespaceAssignmentManageGrants
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - describe
          title: NamespaceAssignmentDescribe
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - select
          title: NamespaceAssignmentSelect
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - create
          title: NamespaceAssignmentCreate
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - modify
          title: NamespaceAssignmentModify
    NamespaceIdentOrUuid:
      oneOf:
        - type: object
          required:
            - namespace-id
            - warehouse-id
          properties:
            namespace-id:
              type: string
              format: uuid
            warehouse-id:
              type: string
              format: uuid
        - type: object
          required:
            - namespace
            - warehouse-id
          properties:
            namespace:
              type: array
              items:
                type: string
            warehouse-id:
              type: string
              format: uuid
      description: Identifier for a namespace, either a UUID or its name and warehouse ID
    NamespaceRelation:
      type: string
      enum:
        - ownership
        - pass_grants
        - manage_grants
        - describe
        - select
        - create
        - modify
    OneLakeProfile:
      type: object
      description: |-
        Storage profile for a Microsoft Fabric / `OneLake` lakehouse.

        Convenience wrapper around the ADLS Gen2 surface that derives the
        account name (`onelake`), container (workspace ID), key prefix
        (`<lakehouse>/Files/<sub>`), and endpoint host from the supplied workspace
        and lakehouse UUIDs and endpoint mode.
      required:
        - workspace-id
        - lakehouse-id
      properties:
        authority-host:
          type:
            - string
            - 'null'
          format: uri
          description: |-
            The authority host to use for authentication.
            Default: `https://login.microsoftonline.com`.
        directory-rel-path:
          type:
            - string
            - 'null'
          description: |-
            Subpath beneath `<top-level-folder>/` inside the lakehouse — the root
            directory under which Lakekeeper writes all warehouse data.
        endpoint-mode:
          $ref: '#/components/schemas/EndpointMode'
          description: Endpoint connection mode. Defaults to the global endpoint.
        lakehouse-id:
          type: string
          format: uuid
          description: UUID of the lakehouse within the workspace.
        sas-enabled:
          type: boolean
          description: Enable SAS-token generation. Defaults to true.
        sas-token-validity-seconds:
          type:
            - integer
            - 'null'
          format: int64
          description: 'SAS-token validity in seconds. Default: 3600. Max: 3600 (`OneLake` cap).'
          minimum: 0
        storage-layout:
          oneOf:
            - type: 'null'
            - $ref: '#/components/schemas/StorageLayout'
              description: Storage layout for namespace and tabular paths.
        top-level-folder:
          $ref: '#/components/schemas/TopLevelFolder'
          description: Top-level managed folder. Defaults to `Files`.
        workspace-id:
          type: string
          format: uuid
          description: UUID of the Fabric workspace this warehouse lives in.
    OpenFGAGenericTableAction:
      type: string
      enum:
        - read_assignments
        - grant_pass_grants
        - grant_manage_grants
        - grant_describe
        - grant_select
        - grant_modify
        - change_ownership
    OpenFGANamespaceAction:
      type: string
      enum:
        - read_assignments
        - grant_create
        - grant_describe
        - grant_modify
        - grant_select
        - grant_pass_grants
        - grant_manage_grants
    OpenFGAProjectAction:
      type: string
      enum:
        - read_assignments
        - grant_role_creator
        - grant_create
        - grant_describe
        - grant_modify
        - grant_select
        - grant_project_admin
        - grant_security_admin
        - grant_data_admin
    OpenFGARoleAction:
      type: string
      enum:
        - assume
        - can_grant_assignee
        - can_change_ownership
        - read_assignments
    OpenFGAServerAction:
      type: string
      enum:
        - read_assignments
        - grant_admin
    OpenFGATableAction:
      type: string
      enum:
        - read_assignments
        - grant_pass_grants
        - grant_manage_grants
        - grant_describe
        - grant_select
        - grant_modify
        - change_ownership
    OpenFGAViewAction:
      type: string
      enum:
        - read_assignments
        - grant_pass_grants
        - grant_manage_grants
        - grant_describe
        - grant_select
        - grant_modify
        - change_ownership
    OpenFGAWarehouseAction:
      type: string
      enum:
        - read_assignments
        - grant_create
        - grant_describe
        - grant_modify
        - grant_select
        - grant_pass_grants
        - grant_manage_grants
        - change_ownership
    ProjectAction:
      type: string
      enum:
        - create_warehouse
        - delete
        - rename
        - list_warehouses
        - create_role
        - list_roles
        - search_roles
        - read_assignments
        - grant_role_creator
        - grant_create
        - grant_describe
        - grant_modify
        - grant_select
        - grant_project_admin
        - grant_security_admin
        - grant_data_admin
        - get_endpoint_statistics
    ProjectAssignment:
      oneOf:
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - project_admin
          title: ProjectAssignmentProjectAdmin
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - security_admin
          title: ProjectAssignmentSecurityAdmin
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - data_admin
          title: ProjectAssignmentDataAdmin
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - role_creator
          title: ProjectAssignmentRoleCreator
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - describe
          title: ProjectAssignmentDescribe
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - select
          title: ProjectAssignmentSelect
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - create
          title: ProjectAssignmentCreate
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - modify
          title: ProjectAssignmentModify
    ProjectRelation:
      type: string
      enum:
        - project_admin
        - security_admin
        - data_admin
        - role_creator
        - describe
        - select
        - create
        - modify
    ProjectTaskInfo:
      type: object
      required:
        - task-id
        - project-id
        - queue-name
        - status
        - scheduled-for
        - attempt
        - progress
        - created-at
      properties:
        attempt:
          type: integer
          format: int32
          description: Current attempt number
        created-at:
          type: string
          format: date-time
          description: When this task attempt was created
        last-heartbeat-at:
          type:
            - string
            - 'null'
          format: date-time
          description: Last heartbeat timestamp for running tasks
        parent-task-id:
          type:
            - string
            - 'null'
          format: uuid
          description: Parent task ID if this is a sub-task
        picked-up-at:
          type:
            - string
            - 'null'
          format: date-time
          description: When the latest attempt of the task was picked up for processing by a worker.
        progress:
          type: number
          format: float
          description: Progress of the task (0.0 to 1.0)
        project-id:
          type: string
          description: Project ID associated with the task
        queue-name:
          type: string
          description: Name of the queue processing this task
        scheduled-for:
          type: string
          format: date-time
          description: When the latest attempt of the task is scheduled for
        status:
          $ref: '#/components/schemas/TaskStatus'
          description: Current status of the task
        task-id:
          type: string
          format: uuid
          description: Unique identifier for the task
        updated-at:
          type:
            - string
            - 'null'
          format: date-time
          description: When the task was last updated
    ProtectionResponse:
      type: object
      required:
        - protected
      properties:
        protected:
          type: boolean
          description: Indicates whether the entity is protected
        updated_at:
          type:
            - string
            - 'null'
          format: date-time
          description: Updated at
    PurgeQueueConfig:
      type: object
    QueueConfig: {}
    QueueConfigResponse:
      allOf:
        - {}
        - type: object
          required:
            - queue-name
          properties:
            queue-name:
              type: string
    RemoveOrphanFilesQueueConfig:
      type: object
      properties:
        default-older-than-ms:
          type: integer
          format: int64
          description: |-
            Only remove files older than this duration (in milliseconds).
            Defaults to 604800000 (7 days). **24-hour safety floor** is
            enforced at task pickup (`RemoveOrphanFilesRetentionTooShort`
            error code); values below it cause the worker to refuse to
            run, unless `disable-min-older-than-check` is set on this same
            config. Mirrors Spark's `retentionDurationCheck.enabled =
            false` escape.

            Negative, zero, or sub-day values still deserialize cleanly —
            the runtime check is what blocks them. Out-of-range i64 values
            that don't fit in `chrono::TimeDelta` fall back to a zero
            duration rather than panicking.
          default: 604800000
        disable-min-older-than-check:
          type: boolean
          description: |-
            Bypass the 24-hour minimum on `default-older-than-ms`. When
            `false` (the default), the worker refuses to run a task whose
            configured retention is shorter than 24h — a typo like
            `default-older-than-ms: 6000` (6 seconds) would otherwise
            silently delete in-flight writer uploads. Set to `true` only
            when you genuinely need sub-day retention (dev/test). Mirrors
            Spark's `retentionDurationCheck.enabled = false` escape.
          default: false
        dry-run:
          type: boolean
          description: |-
            When `true`, identify orphan files but do not delete them. The
            task still completes normally and records `would_delete_count` /
            `would_delete_bytes` in its result; `deleted_bytes` is zero, so
            the adaptive scheduler observes a rate of zero and falls back
            to `maximum-interval-seconds`. Useful for previewing what a
            run would remove before enabling deletion. Defaults to `false`.
          default: false
        enable-remove-orphan-files:
          type: boolean
          description: |-
            Master switch for adaptive scheduling on this warehouse. When
            `false` (the default), no tables are scheduled for the orphan-
            files queue unless they have
            `lakekeeper.remove-orphan-files.enabled=true` set explicitly.
          default: false
        max-run-time-seconds:
          type: integer
          format: int64
          description: |-
            Maximum wall-clock duration of a single task attempt, in seconds.
            On timeout the task is marked failed and is retried at most once
            before being recorded as a terminal failure. Operators with very
            large tables can raise this; in exchange a single attempt may hold
            a worker slot for the configured duration. Defaults to 3600 (60
            minutes). Must be at least 60.
          default: 3600
          minimum: 60
        maximum-interval-seconds:
          type: integer
          format: int64
          description: |-
            Upper bound on the adaptive next-run interval, in seconds. Even
            idle tables get a periodic safety check at this cadence.
            Defaults to 90 days. Must be at least 86400 (1 day).
          default: 7776000
          minimum: 86400
        target-reclaim-bytes:
          type: integer
          format: int64
          description: |-
            Discovery-rate target in bytes. The hook schedules the next run
            at the time the previous run's observed orphan-bytes-per-second
            rate is expected to accumulate this much reclaimable data,
            clamped to the internal floor (1 day) and the configured ceiling
            (`maximum-interval-seconds`). Defaults to 1 GiB.

            `0` is accepted and means "always schedule at the floor (1 day)
            whenever any orphan is found." Useful for setups that want
            scheduling driven solely by the floor/ceiling clamp instead of
            by observed rate.
          default: 1073741824
          minimum: 0
    RenameProjectRequest:
      type: object
      required:
        - new-name
      properties:
        new-name:
          type: string
          description: New name for the project.
    RenameWarehouseRequest:
      type: object
      required:
        - new-name
      properties:
        new-name:
          type: string
          description: New name for the warehouse.
    ResolveCedarEntitiesRequest:
      type: object
      description: Request body for resolving Cedar entities.
      required:
        - resource
      properties:
        principal:
          oneOf:
            - type: 'null'
            - $ref: '#/components/schemas/UserOrRole'
              description: |-
                Optional principal to resolve entities for.
                If not specified, the identity of the caller is used.
        resource:
          $ref: '#/components/schemas/CedarResolveResource'
          description: The resource to resolve entities for.
    ResolveCedarEntitiesResponse:
      type: object
      description: Response from resolving Cedar entities.
      required:
        - entities
        - entity-count
      properties:
        entities:
          type: array
          items: {}
          description: |-
            Cedar entities in native JSON format.
            Each element represents a Cedar entity with uid, attrs, and parents.
        entity-count:
          type: integer
          description: Total number of entities resolved.
          minimum: 0
    Role:
      type: object
      required:
        - id
        - ident
        - provider-id
        - source-id
        - name
        - project-id
        - created-at
      properties:
        created-at:
          type: string
          format: date-time
          description: Timestamp when the role was created
        description:
          type:
            - string
            - 'null'
          description: Description of the role
        id:
          type: string
          format: uuid
          description: Globally unique UUID identifier
        ident:
          type: string
          description: |-
            Composite project-scoped identifier (`provider~source_id`).
            Unique within a project.
        name:
          type: string
          description: Name of the role
        project-id:
          type: string
          description: Project ID in which the role is created.
        provider-id:
          type: string
          description: Provider that owns this role (e.g. `"lakekeeper"`, `"oidc"`).
        source-id:
          type: string
          description: Identifier of the role in the provider.
        updated-at:
          type:
            - string
            - 'null'
          format: date-time
          description: Timestamp when the role was last updated
    RoleAction:
      type: string
      enum:
        - assume
        - can_grant_assignee
        - can_change_ownership
        - delete
        - update
        - read
        - read_assignments
    RoleAssignment:
      oneOf:
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - assignee
          title: RoleAssignmentAssignee
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - ownership
          title: RoleAssignmentOwnership
    RoleMember:
      oneOf:
        - allOf:
            - $ref: '#/components/schemas/UserMembership'
              description: A user assigned to the role.
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - user
          description: A user assigned to the role.
        - allOf:
            - $ref: '#/components/schemas/RoleMembership'
              description: Another role that is a member of the role.
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - role
          description: Another role that is a member of the role.
      description: |-
        A member of a role, returned by `GET /role/{id}/members`. Discriminated by
        `type`: a `user` (direct user→role assignment) or a `role` (role→role edge).
        Identity is hydrated; for requests and add confirmations use the
        un-hydrated [`RoleMemberRef`] instead.
    RoleMemberRef:
      oneOf:
        - type: object
          description: A user, by `IdP` subject id.
          required:
            - id
            - type
          properties:
            id:
              type: string
            type:
              type: string
              enum:
                - user
        - type: object
          description: A role, by id.
          required:
            - id
            - type
          properties:
            id:
              type: string
              format: uuid
            type:
              type: string
              enum:
                - role
      description: |-
        An identity reference to a role member — a `user` or a `role`, by typed id.
        Sent in `POST /role/{id}/members` requests and echoed by the add confirmation
        (remove returns `204` with no body). Unlike [`RoleMember`] it is never hydrated
        (no display name): it names *which* principal, not its display identity.
    RoleMemberType:
      type: string
      description: Kind of a role member. Serializes as `"user"` / `"role"`.
      enum:
        - user
        - role
    RoleMembership:
      type: object
      description: |-
        A role's display identity in a membership listing: the role-member variant of
        [`RoleMember`], and the item type of `/member-of` and `/user/{id}/roles`.
        `ident` (`provider/source-id`) is the stable external handle a client references
        the role by; `id` is the internal UUID. All fields are always present — a role
        whose id no longer resolves in the catalog (a dangling authorizer edge) is
        dropped from the listing and logged, never surfaced with a null identity.
      required:
        - id
        - ident
        - name
      properties:
        id:
          type: string
          format: uuid
        ident:
          type: string
        name:
          type: string
    RoleMetadata:
      type: object
      description: |-
        Metadata of a role with reduced information.
        Returned for cross-project role references.
      required:
        - id
        - ident
        - provider-id
        - source-id
        - name
        - project-id
      properties:
        id:
          type: string
          format: uuid
          description: Globally unique UUID identifier
        ident:
          type: string
          description: Composite project-scoped identifier (`provider~source_id`).
        name:
          type: string
          description: Name of the role
        project-id:
          type: string
          description: Project ID in which the role is created.
        provider-id:
          type: string
          description: Provider that owns this role (e.g. `"lakekeeper"`, `"oidc"`).
        source-id:
          type: string
          description: Identifier of the role in the provider.
    RoleRelation:
      type: string
      enum:
        - assignee
        - ownership
    S3AccessKeyCredential:
      type: object
      title: S3CredentialAccessKey
      required:
        - access-key-id
        - secret-access-key
      properties:
        access-key-id:
          type: string
        external-id:
          type:
            - string
            - 'null'
        secret-access-key:
          type: string
    S3AwsSystemIdentityCredential:
      type: object
      title: S3CredentialSystemIdentity
      properties:
        external-id:
          type:
            - string
            - 'null'
    S3CloudflareR2Credential:
      type: object
      title: CloudflareR2Credential
      required:
        - access-key-id
        - secret-access-key
        - token
        - account-id
      properties:
        access-key-id:
          type: string
          description: Access key ID used for IO operations of Lakekeeper
        account-id:
          type: string
          description: Cloudflare account ID, used to determine the temporary credentials endpoint.
        secret-access-key:
          type: string
          description: Secret key associated with the access key ID.
        token:
          type: string
          description: |-
            Token associated with the access key ID.
            This is used to fetch downscoped temporary credentials for vended credentials.
    S3Credential:
      oneOf:
        - allOf:
            - $ref: '#/components/schemas/S3AccessKeyCredential'
              description: Authenticate to AWS using access-key and secret-key.
            - type: object
              required:
                - credential-type
              properties:
                credential-type:
                  type: string
                  enum:
                    - access-key
          description: Authenticate to AWS using access-key and secret-key.
        - allOf:
            - $ref: '#/components/schemas/S3AwsSystemIdentityCredential'
              description: |-
                Authenticate to AWS using the identity configured on the system
                 that runs lakekeeper. The AWS SDK is used to load the credentials.
            - type: object
              required:
                - credential-type
              properties:
                credential-type:
                  type: string
                  enum:
                    - aws-system-identity
          description: |-
            Authenticate to AWS using the identity configured on the system
             that runs lakekeeper. The AWS SDK is used to load the credentials.
        - allOf:
            - $ref: '#/components/schemas/S3CloudflareR2Credential'
            - type: object
              required:
                - credential-type
              properties:
                credential-type:
                  type: string
                  enum:
                    - cloudflare-r2
    S3CredentialType:
      type: string
      description: The type of S3 credential.
      enum:
        - access-key
        - aws-system-identity
        - cloudflare-r2
    S3Flavor:
      type: string
      enum:
        - aws
        - s3-compat
    S3Profile:
      type: object
      required:
        - bucket
        - region
        - sts-enabled
      properties:
        allow-alternative-protocols:
          type:
            - boolean
            - 'null'
          description: |-
            Allow `s3a://` and `s3n://` in locations.
            This is disabled by default. We do not recommend to use this setting
            except for migration of old hadoop-based tables via the register endpoint.
            Tables with `s3a` paths are not accessible outside the Java ecosystem.
        assume-role-arn:
          type:
            - string
            - 'null'
          description: Optional ARN to assume when accessing the bucket from Lakekeeper.
        aws-kms-key-arn:
          type:
            - string
            - 'null'
          description: ARN of the KMS key used to encrypt the S3 bucket, if any.
        bucket:
          type: string
          description: Name of the S3 bucket
        endpoint:
          type:
            - string
            - 'null'
          format: uri
          description: |-
            Optional endpoint to use for S3 requests, if not provided
            the region will be used to determine the endpoint.
            If both region and endpoint are provided, the endpoint will be used.
            Example: `http://s3-de.my-domain.com:9000`
        flavor:
          $ref: '#/components/schemas/S3Flavor'
          description: |-
            S3 flavor to use.
            Defaults to AWS
        key-prefix:
          type:
            - string
            - 'null'
          description: Subpath in the bucket to use.
        legacy-md5-behavior:
          type:
            - boolean
            - 'null'
          description: |-
            Legacy MD5 behavior for S3 operations requiring checksums.
            When enabled, Lakekeeper will use the legacy MD5 checksum for operations like `DeleteObjects`.
        path-style-access:
          type:
            - boolean
            - 'null'
          description: |-
            Path style access for S3 requests.
            If the underlying S3 supports both, we recommend to not set `path_style_access`.
        push-s3-delete-disabled:
          type: boolean
          description: |-
            Controls whether the `s3.delete-enabled=false` flag is sent to clients.

            In all Iceberg 1.x versions, when Spark executes `DROP TABLE xxx PURGE`, it directly
            deletes files from S3, bypassing the catalog's soft-deletion mechanism.
            Other query engines properly delegate this operation to the catalog.
            This Spark behavior is expected to change in Iceberg 2.0.

            Setting this to `true` pushes the `s3.delete-enabled=false` flag to clients,
            which discourages Spark from directly deleting files during `DROP TABLE xxx PURGE` operations.
            Note that clients may override this setting, and it affects other Spark operations
            that require file deletion, such as removing snapshots.

            For more details, refer to Lakekeeper's
            [Soft-Deletion documentation](https://docs.lakekeeper.io/docs/nightly/concepts/#soft-deletion).
            This flag has no effect if Soft-Deletion is disabled for the warehouse.
        region:
          type: string
          description: Region to use for S3 requests.
        remote-signing-enabled:
          type: boolean
          description: |-
            Enable remote signing for S3 requests.
            When disabled, clients cannot use remote signing even if STS is disabled.
            Defaults to true.
        remote-signing-url-style:
          $ref: '#/components/schemas/S3UrlStyleDetectionMode'
          description: |-
            S3 URL style detection mode for remote signing.
            One of `auto`, `path-style`, `virtual-host`.
            Default: `auto`. When set to `auto`, Lakekeeper will first try to parse the URL as
            `virtual-host` and then attempt `path-style`.
            `path` assumes the bucket name is the first path segment in the URL. `virtual-host`
            assumes the bucket name is the first subdomain if it is preceding `.s3` or `.s3-`.

            Examples

            Virtual host:
              - <https://bucket.s3.endpoint.com/bar/a/key>
              - <https://bucket.s3-eu-central-1.amazonaws.com/file>

            Path style:
              - <https://s3.endpoint.com/bucket/bar/a/key>
              - <https://s3.us-east-1.amazonaws.com/bucket/file>
        storage-layout:
          oneOf:
            - type: 'null'
            - $ref: '#/components/schemas/StorageLayout'
              description: Storage layout for namespace and tabular paths.
        sts-enabled:
          type: boolean
        sts-endpoint:
          type:
            - string
            - 'null'
          format: uri
          description: |-
            Optional endpoint to use for STS requests.
            Use this when the STS endpoint differs from the S3 endpoint,
            which is common with S3-compatible storage systems.
            If not provided, the S3 `endpoint` is used for STS requests as well.
        sts-role-arn:
          type:
            - string
            - 'null'
          description: |-
            Optional role ARN to assume for sts vended-credentials.
            If not provided, `assume_role_arn` is used.
            Either `assume_role_arn` or `sts_role_arn` must be provided if `sts_enabled` is true.
        sts-session-tags:
          type: object
          description: Optional session tags for STS assume role operations.
          additionalProperties:
            type: string
          propertyNames:
            type: string
        sts-token-validity-seconds:
          type: integer
          format: int64
          description: The validity of the sts tokens in seconds. Default is 3600
          minimum: 0
    S3UrlStyleDetectionMode:
      type: string
      enum:
        - path
        - virtual_host
        - auto
    ScheduleExpireSnapshotsTaskRequest:
      type: object
      description: Request body for scheduling a task.
      required:
        - entity
      properties:
        entity:
          $ref: '#/components/schemas/WarehouseTaskEntityId'
          description: |-
            Entity to schedule the task for. Unsupported entity types return
            `400` from the pre-check.
        scheduled-for:
          type:
            - string
            - 'null'
          format: date-time
          description: |-
            When the task should run. Omit (or pass `null`) to run on the next
            worker poll. RFC 3339 / ISO 8601 format. Must be within roughly one
            year of now; further-out values return
            `400 ScheduledForTooFarInFuture`.
          example: 2026-12-31T23:59:59Z
    ScheduleRemoveOrphanFilesTaskRequest:
      type: object
      description: Request body for scheduling a task.
      required:
        - entity
      properties:
        entity:
          $ref: '#/components/schemas/WarehouseTaskEntityId'
          description: |-
            Entity to schedule the task for. Unsupported entity types return
            `400` from the pre-check.
        scheduled-for:
          type:
            - string
            - 'null'
          format: date-time
          description: |-
            When the task should run. Omit (or pass `null`) to run on the next
            worker poll. RFC 3339 / ISO 8601 format. Must be within roughly one
            year of now; further-out values return
            `400 ScheduledForTooFarInFuture`.
          example: 2026-12-31T23:59:59Z
    ScheduleTaskResponse:
      type: object
      description: Response returned on a successful schedule call.
      required:
        - task-id
      properties:
        task-id:
          type: string
          format: uuid
          description: The id of the newly scheduled task.
    SearchRoleRequest:
      type: object
      required:
        - search
      properties:
        project-id:
          type:
            - string
            - 'null'
          description: |-
            Deprecated: Please use the `x-project-id` header instead.
            Project ID in which the role is created.
        search:
          type: string
          description: |-
            Search string for fuzzy search.
            Length is truncated to 64 characters.
    SearchRoleResponse:
      type: object
      required:
        - roles
      properties:
        roles:
          type: array
          items:
            $ref: '#/components/schemas/Role'
          description: List of roles matching the search criteria
    SearchTabular:
      type: object
      required:
        - namespace-name
        - tabular-name
        - tabular-id
      properties:
        distance:
          type:
            - number
            - 'null'
          format: float
          description: Better matches have a lower distance
        namespace-name:
          type: array
          items:
            type: string
          description: Namespace name
        tabular-id:
          $ref: '#/components/schemas/TabularIdentUuid'
          description: ID of the tabular
        tabular-name:
          type: string
          description: Tabular name
    SearchTabularRequest:
      type: object
      required:
        - search
      properties:
        search:
          type: string
          description: |-
            Search string for fuzzy search.
            Length is truncated to 64 characters.
          maxLength: 64
    SearchTabularResponse:
      type: object
      description: Search result for tabulars
      required:
        - tabulars
      properties:
        tabulars:
          type: array
          items:
            $ref: '#/components/schemas/SearchTabular'
          description: List of tabulars matching the search criteria
    SearchUser:
      type: object
      required:
        - name
        - id
        - user-type
      properties:
        email:
          type:
            - string
            - 'null'
          description: |-
            Email of the user. If id is not specified, the email is extracted
            from the provided token.
        id:
          type: string
          description: ID of the user
        name:
          type: string
          description: Name of the user
        user-type:
          $ref: '#/components/schemas/UserType'
          description: Type of the user
    SearchUserRequest:
      type: object
      required:
        - search
      properties:
        search:
          type: string
          description: |-
            Search string for fuzzy search.
            Length is truncated to 64 characters.
    SearchUserResponse:
      type: object
      description: Search result for users
      required:
        - users
      properties:
        users:
          type: array
          items:
            $ref: '#/components/schemas/SearchUser'
          description: List of users matching the search criteria
    ServerAction:
      type: string
      enum:
        - create_project
        - update_users
        - delete_users
        - list_users
        - grant_admin
        - provision_users
        - read_assignments
    ServerAssignment:
      oneOf:
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - admin
          title: ServerAssignmentAdmin
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - operator
          title: ServerAssignmentOperator
    ServerInfo:
      type: object
      required:
        - version
        - lakekeeper-version
        - bootstrapped
        - server-id
        - authz-backend
        - aws-system-identities-enabled
        - azure-system-identities-enabled
        - gcp-system-identities-enabled
        - queues
        - license-status
      properties:
        authz-backend:
          type: string
          description: '`AuthZ` backend in use.'
        aws-system-identities-enabled:
          type: boolean
          description: If using AWS system identities for S3 storage profiles are enabled.
        azure-system-identities-enabled:
          type: boolean
          description: If using Azure system identities for Azure storage profiles are enabled.
        bootstrapped:
          type: boolean
          description: Whether the catalog has been bootstrapped.
        console:
          oneOf:
            - type: 'null'
            - $ref: '#/components/schemas/ConsoleInfo'
              description: Information about the bundled console (UI), if any.
        default-project-id:
          type:
            - string
            - 'null'
          description: Default Project ID. Null if not set
        gcp-system-identities-enabled:
          type: boolean
          description: If using GCP system identities for GCS storage profiles are enabled.
        lakekeeper-commit-sha:
          type:
            - string
            - 'null'
          description: |-
            Git commit SHA of the upstream `lakekeeper` crate, if the binary
            reported it at build time.
        lakekeeper-enterprise-commit-sha:
          type:
            - string
            - 'null'
          description: Git commit SHA of the enterprise binary, if known.
        lakekeeper-enterprise-version:
          type:
            - string
            - 'null'
          description: |-
            SemVer of the enterprise binary (e.g. `lakekeeper-plus`) when this
            server is an enterprise build. `None` on OSS builds.
        lakekeeper-version:
          type: string
          description: |-
            SemVer of the upstream `lakekeeper` crate the server was built
            against.
        license-status:
          $ref: '#/components/schemas/LicenseStatus'
          description: License status information
        queues:
          type: array
          items:
            type: string
          description: List of queues that are registered for the server.
        server-id:
          type: string
          format: uuid
          description: |-
            ID of the server.
            Returns null if the catalog has not been bootstrapped.
        version:
          type: string
          description: |-
            Deprecated alias of `lakekeeper-version`. Always equal to it; kept
            for clients that read the plain `version` field. New clients should
            read `lakekeeper-version` and/or `lakekeeper-enterprise-version`.
          deprecated: true
    ServerRelation:
      type: string
      enum:
        - admin
        - operator
    SetExpireSnapshotsQueueConfig:
      type: object
      required:
        - queue-config
      properties:
        max-seconds-since-last-heartbeat:
          type:
            - integer
            - 'null'
          format: int64
        queue-config:
          $ref: '#/components/schemas/ExpireSnapshotsQueueConfig'
    SetManagedAccessRequest:
      type: object
      required:
        - managed-access
      properties:
        managed-access:
          type: boolean
    SetProtectionRequest:
      type: object
      required:
        - protected
      properties:
        protected:
          type: boolean
          description: Setting this to `true` will prevent the entity from being deleted unless `force` is used.
    SetPurgeQueueConfig:
      type: object
      required:
        - queue-config
      properties:
        max-seconds-since-last-heartbeat:
          type:
            - integer
            - 'null'
          format: int64
        queue-config:
          $ref: '#/components/schemas/PurgeQueueConfig'
    SetRemoveOrphanFilesQueueConfig:
      type: object
      required:
        - queue-config
      properties:
        max-seconds-since-last-heartbeat:
          type:
            - integer
            - 'null'
          format: int64
        queue-config:
          $ref: '#/components/schemas/RemoveOrphanFilesQueueConfig'
    SetTabularExpirationQueueConfig:
      type: object
      required:
        - queue-config
      properties:
        max-seconds-since-last-heartbeat:
          type:
            - integer
            - 'null'
          format: int64
        queue-config:
          $ref: '#/components/schemas/TabularExpirationQueueConfig'
    SetTaskLogCleanupConfig:
      type: object
      required:
        - queue-config
      properties:
        max-seconds-since-last-heartbeat:
          type:
            - integer
            - 'null'
          format: int64
        queue-config:
          $ref: '#/components/schemas/TaskLogCleanupConfig'
    SetWarehouseManagedByRequest:
      type: object
      required:
        - managed-by
      properties:
        managed-by:
          $ref: '#/components/schemas/ManagedBy'
          description: |-
            New managed-by marker. Use `self-managed` to clear. Setting or clearing the
            marker requires instance-admin privilege.
    StorageCredential:
      oneOf:
        - allOf:
            - $ref: '#/components/schemas/S3Credential'
              description: |-
                Credentials for S3 storage

                Example payload in the code-snippet below:

                ```
                use lakekeeper::service::storage::StorageCredential;
                let cred: StorageCredential = serde_json::from_str(r#"{
                    "type": "s3",
                    "credential-type": "access-key",
                    "access-key-id": "minio-root-user",
                    "secret-access-key": "minio-root-password"
                  }"#).unwrap();
                ```
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - s3
          title: StorageCredentialS3
          description: |-
            Credentials for S3 storage

            Example payload in the code-snippet below:

            ```
            use lakekeeper::service::storage::StorageCredential;
            let cred: StorageCredential = serde_json::from_str(r#"{
                "type": "s3",
                "credential-type": "access-key",
                "access-key-id": "minio-root-user",
                "secret-access-key": "minio-root-password"
              }"#).unwrap();
            ```
        - allOf:
            - $ref: '#/components/schemas/AzCredential'
              description: |-
                Credentials for Az storage

                Example payload:

                ```
                use lakekeeper::service::storage::StorageCredential;
                let cred: StorageCredential = serde_json::from_str(r#"{
                    "type": "az",
                    "credential-type": "client-credentials",
                    "client-id": "...",
                    "client-secret": "...",
                    "tenant-id": "..."
                  }"#).unwrap();
                ```
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - az
          title: StorageCredentialAz
          description: |-
            Credentials for Az storage

            Example payload:

            ```
            use lakekeeper::service::storage::StorageCredential;
            let cred: StorageCredential = serde_json::from_str(r#"{
                "type": "az",
                "credential-type": "client-credentials",
                "client-id": "...",
                "client-secret": "...",
                "tenant-id": "..."
              }"#).unwrap();
            ```
        - allOf:
            - $ref: '#/components/schemas/GcsCredential'
              description: |
                Credentials for GCS storage

                Example payload in the code-snippet below:

                ```
                use lakekeeper::service::storage::StorageCredential;
                let cred: StorageCredential = serde_json::from_str(r#"{
                    "type": "gcs",
                    "credential-type": "service-account-key",
                    "key": {
                      "type": "service_account",
                      "project_id": "example-project-1234",
                      "private_key_id": "....",
                      "private_key": "-----BEGIN PRIVATE KEY-----\n.....\n-----END PRIVATE KEY-----\n",
                      "client_email": "abc@example-project-1234.iam.gserviceaccount.com",
                      "client_id": "123456789012345678901",
                      "auth_uri": "https://accounts.google.com/o/oauth2/auth",
                      "token_uri": "https://oauth2.googleapis.com/token",
                      "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
                      "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/abc%example-project-1234.iam.gserviceaccount.com",
                      "universe_domain": "googleapis.com"
                    }
                }"#).unwrap();
                ```
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - gcs
          title: StorageCredentialGcs
          description: |
            Credentials for GCS storage

            Example payload in the code-snippet below:

            ```
            use lakekeeper::service::storage::StorageCredential;
            let cred: StorageCredential = serde_json::from_str(r#"{
                "type": "gcs",
                "credential-type": "service-account-key",
                "key": {
                  "type": "service_account",
                  "project_id": "example-project-1234",
                  "private_key_id": "....",
                  "private_key": "-----BEGIN PRIVATE KEY-----\n.....\n-----END PRIVATE KEY-----\n",
                  "client_email": "abc@example-project-1234.iam.gserviceaccount.com",
                  "client_id": "123456789012345678901",
                  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
                  "token_uri": "https://oauth2.googleapis.com/token",
                  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
                  "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/abc%example-project-1234.iam.gserviceaccount.com",
                  "universe_domain": "googleapis.com"
                }
            }"#).unwrap();
            ```
      description: Storage secret for a warehouse.
    StorageCredentialType:
      oneOf:
        - type: object
          description: S3 credential type
          required:
            - credential-type
            - type
          properties:
            credential-type:
              $ref: '#/components/schemas/S3CredentialType'
              description: S3 credential type
            type:
              type: string
              enum:
                - s3
        - type: object
          description: Azure credential type
          required:
            - credential-type
            - type
          properties:
            credential-type:
              $ref: '#/components/schemas/AzCredentialType'
              description: Azure credential type
            type:
              type: string
              enum:
                - az
        - type: object
          description: GCS credential type
          required:
            - credential-type
            - type
          properties:
            credential-type:
              $ref: '#/components/schemas/GcsCredentialType'
              description: GCS credential type
            type:
              type: string
              enum:
                - gcs
      description: |-
        The type of storage credential configured for a warehouse, without secret values.

        This is returned in API responses so clients know which credential type
        was selected (e.g. to restore radio button state in the UI).
    StorageLayout:
      oneOf:
        - type: object
          required:
            - type
          properties:
            type:
              type: string
              enum:
                - default
        - allOf:
            - $ref: '#/components/schemas/StorageLayoutFlat'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - tabular-only
        - allOf:
            - $ref: '#/components/schemas/StorageLayoutFullHierarchy'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - full-hierarchy
      description: |-
        Controls how namespace and tabular paths are constructed under the warehouse base location.

        - `default` / omitted: flat — no namespace directories; all tabulars are placed directly under
          the base location with a fixed `"{uuid}"` segment. (Changed in 0.13; before 0.13 the default
          emitted a `"{uuid}"` directory for the direct-parent namespace. Existing namespaces created
          before 0.13 keep their persisted location, so only namespaces created on/after 0.13 use the
          flat default.)
        - `full-hierarchy`: one directory per namespace level, one per tabular.
        - `tabular-only`: no namespace directories; all tabulars are placed directly under the base
          location, with a configurable tabular template (which must contain `{uuid}`).

        Segment templates may use `{uuid}` and `{name}` as placeholders.
      example:
        type: full-hierarchy
        namespace: '{name}-{uuid}'
        tabular: '{name}-{uuid}'
    StorageLayoutFlat:
      type: object
      description: |-
        No namespace directories; all tabulars are placed directly under the base location.

        For a tabular `my_tabular` (uuid `…002`) the path is: `<base>/<tabular-segment>`.
        The tabular template must contain `{uuid}` to avoid collisions between tabulars with the same name.
      required:
        - tabular
      properties:
        tabular:
          $ref: '#/components/schemas/StorageLayoutTabularTemplate'
      example:
        tabular: '{name}-{uuid}'
    StorageLayoutFullHierarchy:
      type: object
      description: |-
        One directory per namespace level, one per tabular.

        For a tabular `my_tabular` (uuid `…003`) in `grandparent_ns` / `parent_ns` the path is:
        `<base>/<grandparent-segment>/<parent-segment>/<tabular-segment>`.
      required:
        - namespace
        - tabular
      properties:
        namespace:
          $ref: '#/components/schemas/StorageLayoutNamespaceTemplate'
        tabular:
          $ref: '#/components/schemas/StorageLayoutTabularTemplate'
      example:
        namespace: '{name}-{uuid}'
        tabular: '{name}-{uuid}'
    StorageLayoutNamespaceTemplate:
      type: string
      description: 'Template string for namespace path segments. Placeholders {uuid} and {name} (with curly braces) will be replaced with the actual namespace UUID and name respectively. The {name} value is percent-encoded (URL percent-encoding) so spaces and special characters are escaped (e.g. "my name" becomes "my%20name"). The {uuid} value is inserted as-is without encoding. Example: "{name}-{uuid}" for a namespace named "my ns" renders to "my%20ns-550e8400-e29b-41d4-a716-446655440001".'
      example: '{uuid}'
    StorageLayoutTabularTemplate:
      type: string
      description: 'Template string for tabular names. Placeholders {uuid} and {name} (with curly braces) will be replaced with the actual tabular UUID and name respectively. The {name} value is percent-encoded (URL percent-encoding) so spaces and special characters are escaped (e.g. "my tabular" becomes "my%20tabular"). The {uuid} value is inserted as-is without encoding. Example: "{name}-{uuid}" for a tabular named "my tabular" renders to "my%20tabular-550e8400-e29b-41d4-a716-446655440002".'
      example: '{uuid}'
    StorageProfile:
      oneOf:
        - allOf:
            - $ref: '#/components/schemas/AdlsProfile'
              description: |-
                Generic Azure Data Lake Storage Gen2 profile. Speaks ADLS Gen2 against
                any storage account.
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - adls
          title: StorageProfileAdls
          description: |-
            Generic Azure Data Lake Storage Gen2 profile. Speaks ADLS Gen2 against
            any storage account.
        - allOf:
            - $ref: '#/components/schemas/OneLakeProfile'
              description: |-
                `OneLake` (Microsoft Fabric) profile. Knows how to construct `OneLake`
                URLs from workspace + lakehouse IDs and how to derive the
                workspace-private-link endpoint host.
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - onelake
          title: StorageProfileOneLake
          description: |-
            `OneLake` (Microsoft Fabric) profile. Knows how to construct `OneLake`
            URLs from workspace + lakehouse IDs and how to derive the
            workspace-private-link endpoint host.
        - allOf:
            - $ref: '#/components/schemas/S3Profile'
              description: S3 storage profile
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - s3
          title: StorageProfileS3
          description: S3 storage profile
        - allOf:
            - $ref: '#/components/schemas/GcsProfile'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - gcs
          title: StorageProfileGcs
      description: Storage profile for a warehouse.
    TableAction:
      type: string
      enum:
        - drop
        - write_data
        - read_data
        - get_metadata
        - commit
        - rename
        - read_assignments
        - grant_pass_grants
        - grant_manage_grants
        - grant_describe
        - grant_select
        - grant_modify
        - change_ownership
        - get_tasks
        - control_tasks
        - set_protection
    TableAssignment:
      oneOf:
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - ownership
          title: TableAssignmentOwnership
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - pass_grants
          title: TableAssignmentPassGrants
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - manage_grants
          title: TableAssignmentManageGrants
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - describe
          title: TableAssignmentDescribe
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - select
          title: TableAssignmentSelect
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - modify
          title: TableAssignmentModify
    TableRelation:
      type: string
      enum:
        - ownership
        - pass_grants
        - manage_grants
        - describe
        - select
        - modify
    TabularDeleteProfile:
      oneOf:
        - type: object
          title: TabularDeleteProfileHard
          required:
            - type
          properties:
            type:
              type: string
              enum:
                - hard
        - type: object
          title: TabularDeleteProfileSoft
          required:
            - expiration-seconds
            - type
          properties:
            expiration-seconds:
              type: integer
              format: int64
            type:
              type: string
              enum:
                - soft
    TabularExpirationQueueConfig:
      type: object
      description: Warehouse-specific configuration for the tabular expiration (Soft-Deletion) queue.
    TabularIdentOrUuid:
      oneOf:
        - type: object
          required:
            - warehouse-id
            - table-id
          properties:
            table-id:
              type: string
              format: uuid
            warehouse-id:
              type: string
              format: uuid
        - type: object
          required:
            - namespace
            - table
            - warehouse-id
          properties:
            namespace:
              type: array
              items:
                type: string
            table:
              type: string
              description: Name of the table, view, or generic table.
            warehouse-id:
              type: string
              format: uuid
      description: |-
        Identifier for a tabular (table, view, or generic table) — either a UUID
        or its name and namespace. Wire format primary names are `table-id` and
        `table`; `view_id` / `view` and `generic_table_id` / `generic_table` are
        accepted as input aliases for client ergonomics.
    TabularIdentUuid:
      oneOf:
        - type: object
          required:
            - id
            - type
          properties:
            id:
              type: string
              format: uuid
            type:
              type: string
              enum:
                - table
        - type: object
          required:
            - id
            - type
          properties:
            id:
              type: string
              format: uuid
            type:
              type: string
              enum:
                - view
        - type: object
          required:
            - id
            - type
          properties:
            id:
              type: string
              format: uuid
            type:
              type: string
              enum:
                - generic-table
    TabularType:
      type: string
      description: Type of tabular
      enum:
        - table
        - view
        - generic-table
    TaskAttempt:
      type: object
      required:
        - attempt
        - status
        - scheduled-for
        - created-at
        - progress
      properties:
        attempt:
          type: integer
          format: int32
          description: Attempt number
        created-at:
          type: string
          format: date-time
          description: When this attempt was created
        duration:
          type:
            - string
            - 'null'
          description: How long this attempt took
          example: PT1H30M45.5S
        execution-details:
          type:
            - object
            - 'null'
          description: Execution details for this attempt
        message:
          type:
            - string
            - 'null'
          description: Message associated with this attempt
        progress:
          type: number
          format: float
          description: Progress achieved in this attempt
        scheduled-for:
          type: string
          format: date-time
          description: When this attempt was scheduled for
        started-at:
          type:
            - string
            - 'null'
          format: date-time
          description: When this attempt started
        status:
          $ref: '#/components/schemas/TaskStatus'
          description: Status of this attempt
    TaskLogCleanupConfig:
      type: object
      properties:
        cleanup-period:
          type:
            - string
            - 'null'
          description: |-
            How often to run the cleanup task in ISO8601 duration format. Defaults to once a day (P1D).
            If a value below 1 day is provided, it will be set to the default of 1 day.
          example: PT1H30M45.5S
        retention-period:
          type:
            - string
            - 'null'
          description: How long to retain task logs before deletion in ISO8601 duration format. Defaults to 90 days.
          example: PT1H30M45.5S
    TaskStatus:
      type: string
      enum:
        - RUNNING
        - SCHEDULED
        - STOPPING
        - CANCELLED
        - SUCCESS
        - FAILED
    TimeWindowSelector:
      oneOf:
        - type: object
          required:
            - end
            - interval
            - type
          properties:
            end:
              type: string
              format: date-time
              description: |-
                End timestamp of the time window
                Specify
              example: 2023-12-31T23:59:59Z
            interval:
              type: string
              description: |-
                Duration/span of the time window

                The returned statistics will be for the time window from `end` - `interval` to `end`.
                Specify a ISO8601 duration string, e.g. `PT1H` for 1 hour, `P1D` for 1 day.
              example: P1D
            type:
              type: string
              enum:
                - window
          example:
            type: window
            end: 2023-12-31T23:59:59Z
            interval: P1D
        - type: object
          required:
            - token
            - type
          properties:
            token:
              type: string
              description: |-
                Opaque Token from previous response for paginating through time windows

                Use the `next_page_token` or `previous_page_token` from a previous response
            type:
              type: string
              enum:
                - page-token
          example:
            type: page-token
            token: xyz
    TopLevelFolder:
      type: string
      description: |-
        Top-level managed folder within a Fabric lakehouse.

        Fabric reserves `Files/` and `Tables/` as managed folders directly under
        each lakehouse item. `Files/` is the default for Lakekeeper-managed Iceberg
        tables; `Tables/` is supported for completeness but writing Iceberg metadata
        there conflicts with Fabric's automatic Delta/Iceberg virtualization.
      enum:
        - Files
        - Tables
    UndropTabularsRequest:
      type: object
      required:
        - targets
      properties:
        targets:
          type: array
          items:
            $ref: '#/components/schemas/TabularIdentUuid'
          description: Tabulars to undrop
    UpdateGenericTableAssignmentsRequest:
      type: object
      properties:
        deletes:
          type: array
          items:
            $ref: '#/components/schemas/GenericTableAssignment'
        writes:
          type: array
          items:
            $ref: '#/components/schemas/GenericTableAssignment'
    UpdateNamespaceAssignmentsRequest:
      type: object
      properties:
        deletes:
          type: array
          items:
            $ref: '#/components/schemas/NamespaceAssignment'
        writes:
          type: array
          items:
            $ref: '#/components/schemas/NamespaceAssignment'
    UpdateProjectAssignmentsRequest:
      type: object
      properties:
        deletes:
          type: array
          items:
            $ref: '#/components/schemas/ProjectAssignment'
        writes:
          type: array
          items:
            $ref: '#/components/schemas/ProjectAssignment'
    UpdateRoleAssignmentsRequest:
      type: object
      properties:
        deletes:
          type: array
          items:
            $ref: '#/components/schemas/RoleAssignment'
        writes:
          type: array
          items:
            $ref: '#/components/schemas/RoleAssignment'
    UpdateRoleRequest:
      type: object
      required:
        - name
      properties:
        description:
          type:
            - string
            - 'null'
          description: Description of the role. If not set, the description will be removed.
        name:
          type: string
          description: Name of the role to create
    UpdateRoleSourceSystemRequest:
      type: object
      required:
        - source-id
        - provider-id
      properties:
        provider-id:
          type: string
          description: New Provider ID of the role.
        source-id:
          type: string
          description: New Source ID / External ID of the role.
    UpdateServerAssignmentsRequest:
      type: object
      properties:
        deletes:
          type: array
          items:
            $ref: '#/components/schemas/ServerAssignment'
        writes:
          type: array
          items:
            $ref: '#/components/schemas/ServerAssignment'
    UpdateTableAssignmentsRequest:
      type: object
      properties:
        deletes:
          type: array
          items:
            $ref: '#/components/schemas/TableAssignment'
        writes:
          type: array
          items:
            $ref: '#/components/schemas/TableAssignment'
    UpdateUserRequest:
      type: object
      required:
        - name
        - user-type
      properties:
        email:
          type:
            - string
            - 'null'
        name:
          type: string
        user-type:
          $ref: '#/components/schemas/UserType'
    UpdateViewAssignmentsRequest:
      type: object
      properties:
        deletes:
          type: array
          items:
            $ref: '#/components/schemas/ViewAssignment'
        writes:
          type: array
          items:
            $ref: '#/components/schemas/ViewAssignment'
    UpdateWarehouseAssignmentsRequest:
      type: object
      properties:
        deletes:
          type: array
          items:
            $ref: '#/components/schemas/WarehouseAssignment'
        writes:
          type: array
          items:
            $ref: '#/components/schemas/WarehouseAssignment'
    UpdateWarehouseCredentialRequest:
      type: object
      properties:
        new-storage-credential:
          oneOf:
            - type: 'null'
            - $ref: '#/components/schemas/StorageCredential'
              description: |-
                New storage credential to use for the warehouse.
                If not specified, the existing credential is removed.
    UpdateWarehouseDeleteProfileRequest:
      type: object
      required:
        - delete-profile
      properties:
        delete-profile:
          $ref: '#/components/schemas/TabularDeleteProfile'
    UpdateWarehouseFormatVersionPolicyRequest:
      type: object
      required:
        - allowed-format-versions
      properties:
        allowed-format-versions:
          type: array
          items:
            type: integer
            format: int32
          description: |-
            Iceberg table format versions that may be created in, or upgraded to,
            within this warehouse. Must be a non-empty subset of `[1, 2, 3]`.
        default-format-version:
          type:
            - integer
            - 'null'
          format: int32
          description: |-
            Default Iceberg table format version applied when a create-table request
            does not specify one. Must be a member of `allowed-format-versions`. When
            omitted, resolves to v2 if allowed, otherwise the highest allowed version.
    UpdateWarehouseStorageRequest:
      type: object
      required:
        - storage-profile
      properties:
        storage-credential:
          oneOf:
            - type: 'null'
            - $ref: '#/components/schemas/StorageCredential'
              description: |-
                Optional storage credential to use for the warehouse.
                The existing credential is not re-used. If no credential is
                provided, we assume that this storage does not require credentials.
        storage-profile:
          $ref: '#/components/schemas/StorageProfile'
          description: |-
            Storage profile to use for the warehouse.
            The new profile must point to the same location as the existing profile
            to avoid data loss. For S3 this means that you may not change the
            bucket or key prefix. The region may only be changed if an `endpoint`
            is set on the new profile (so the endpoint, not the region, determines
            where S3 requests are routed).
    User:
      type: object
      description: User of the catalog
      required:
        - name
        - id
        - user-type
        - last-updated-with
        - created-at
      properties:
        created-at:
          type: string
          format: date-time
          description: Timestamp when the user was created
        email:
          type:
            - string
            - 'null'
          description: Email of the user
        id:
          type: string
          description: The user's ID
        last-updated-with:
          $ref: '#/components/schemas/UserLastUpdatedWith'
          description: The endpoint that last updated the user
        name:
          type: string
          description: Name of the user
        updated-at:
          type:
            - string
            - 'null'
          format: date-time
          description: Timestamp when the user was last updated
        user-type:
          $ref: '#/components/schemas/UserType'
          description: Type of the user
    UserLastUpdatedWith:
      type: string
      description: How the user was last updated
      enum:
        - create-endpoint
        - config-call-creation
        - update-endpoint
        - role-provider
    UserMembership:
      type: object
      description: |-
        A user's identity in a membership listing (the `user` variant of
        [`RoleMember`]). All identity fields are nullable: under an assignment-managing
        authorizer (e.g. OpenFGA) a member may be assigned but not yet provisioned in
        the catalog, so only the `id` is known. `name`/`email` are also `null` for a
        provisioned-but-nameless user.
      required:
        - id
      properties:
        email:
          type:
            - string
            - 'null'
          description: Email; `null` if unknown.
        id:
          type: string
          description: '`IdP` subject id of the user.'
        name:
          type:
            - string
            - 'null'
          description: Display name; `null` when the user has no name.
        user-type:
          oneOf:
            - type: 'null'
            - $ref: '#/components/schemas/UserType'
              description: |-
                Whether the principal is a human or an application; `null` when the user
                is assigned but not provisioned in the catalog (the id is all that's known).
    UserOrRole:
      oneOf:
        - type: object
          title: UserOrRoleUser
          description: Id of the user
          required:
            - user
          properties:
            user:
              type: string
              description: Id of the user
        - type: object
          title: UserOrRoleRole
          description: Id of the role
          required:
            - role
          properties:
            role:
              type: string
              format: uuid
              description: Id of the role
      description: Identifies a user or a role
    UserType:
      type: string
      description: Type of a User
      enum:
        - human
        - application
    ViewAction:
      type: string
      enum:
        - drop
        - commit
        - get_metadata
        - select
        - rename
        - read_assignments
        - grant_pass_grants
        - grant_manage_grants
        - grant_describe
        - grant_select
        - grant_modify
        - change_ownership
        - get_tasks
        - control_tasks
        - set_protection
    ViewAssignment:
      oneOf:
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - ownership
          title: ViewAssignmentOwnership
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - pass_grants
          title: ViewAssignmentPassGrants
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - manage_grants
          title: ViewAssignmentManageGrants
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - describe
          title: ViewAssignmentDescribe
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - select
          title: ViewAssignmentSelect
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - modify
          title: ViewAssignmentModify
    ViewRelation:
      type: string
      enum:
        - ownership
        - pass_grants
        - manage_grants
        - describe
        - select
        - modify
    WarehouseAction:
      type: string
      enum:
        - create_namespace
        - delete
        - modify_storage
        - modify_storage_credential
        - get_config
        - get_metadata
        - list_namespaces
        - include_in_list
        - deactivate
        - activate
        - rename
        - list_deleted_tabulars
        - read_assignments
        - grant_create
        - grant_describe
        - grant_modify
        - grant_select
        - grant_pass_grants
        - grant_manage_grants
        - change_ownership
        - get_all_tasks
        - control_all_tasks
        - set_protection
        - set_format_version_policy
        - get_endpoint_statistics
    WarehouseAssignment:
      oneOf:
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - ownership
          title: WarehouseAssignmentOwnership
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - pass_grants
          title: WarehouseAssignmentPassGrants
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - manage_grants
          title: WarehouseAssignmentManageGrants
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - describe
          title: WarehouseAssignmentDescribe
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - select
          title: WarehouseAssignmentSelect
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - create
          title: WarehouseAssignmentCreate
        - allOf:
            - $ref: '#/components/schemas/UserOrRole'
            - type: object
              required:
                - type
              properties:
                type:
                  type: string
                  enum:
                    - modify
          title: WarehouseAssignmentModify
    WarehouseFilter:
      oneOf:
        - type: object
          description: Filter for a specific warehouse
          required:
            - id
            - type
          properties:
            id:
              type: string
              format: uuid
            type:
              type: string
              enum:
                - warehouse-id
        - type: object
          description: Filter for items that are not associated with a warehouse
          required:
            - type
          properties:
            type:
              type: string
              enum:
                - unmapped
        - type: object
          description: Return all items in the current project, regardless of warehouse association
          required:
            - type
          properties:
            type:
              type: string
              enum:
                - all
    WarehouseRelation:
      type: string
      enum:
        - ownership
        - pass_grants
        - manage_grants
        - describe
        - select
        - create
        - modify
    WarehouseStatistics:
      type: object
      required:
        - timestamp
        - number-of-tables
        - number-of-views
        - updated-at
      properties:
        number-of-tables:
          type: integer
          format: int64
          description: Number of tables in the warehouse.
        number-of-views:
          type: integer
          format: int64
          description: Number of views in the warehouse.
        timestamp:
          type: string
          format: date-time
          description: |-
            Timestamp of when these statistics are valid until

            We lazily create a new statistics entry every hour, in between hours, the existing entry
            is being updated. If there's a change at `created_at` + 1 hour, a new entry is created. If
            there's no change, no new entry is created.
        updated-at:
          type: string
          format: date-time
          description: Timestamp of when these statistics were last updated
    WarehouseStatisticsResponse:
      type: object
      required:
        - warehouse-ident
        - stats
      properties:
        next-page-token:
          type:
            - string
            - 'null'
          description: Next page token
        stats:
          type: array
          items:
            $ref: '#/components/schemas/WarehouseStatistics'
          description: Ordered list of warehouse statistics.
        warehouse-ident:
          type: string
          format: uuid
          description: ID of the warehouse for which the stats were collected.
    WarehouseStatus:
      type: string
      description: Status of a warehouse
      enum:
        - active
        - inactive
    WarehouseTaskEntityFilter:
      oneOf:
        - type: object
          description: Get tasks for a specific table
          required:
            - table-id
            - type
          properties:
            table-id:
              type: string
              format: uuid
            type:
              type: string
              enum:
                - table
        - type: object
          description: Get tasks for a specific view
          required:
            - view-id
            - type
          properties:
            type:
              type: string
              enum:
                - view
            view-id:
              type: string
              format: uuid
        - type: object
          description: Get tasks for a specific generic table
          required:
            - generic-table-id
            - type
          properties:
            generic-table-id:
              type: string
              format: uuid
            type:
              type: string
              enum:
                - generic-table
        - type: object
          description: |-
            Get Warehouse-level tasks which are not associated with a specific entity
            inside the warehouse
          required:
            - type
          properties:
            type:
              type: string
              enum:
                - warehouse
    WarehouseTaskEntityId:
      oneOf:
        - type: object
          required:
            - table-id
            - type
          properties:
            table-id:
              type: string
              format: uuid
            type:
              type: string
              enum:
                - table
        - type: object
          required:
            - view-id
            - type
          properties:
            type:
              type: string
              enum:
                - view
            view-id:
              type: string
              format: uuid
        - type: object
          required:
            - generic-table-id
            - type
          properties:
            generic-table-id:
              type: string
              format: uuid
            type:
              type: string
              enum:
                - generic-table
    WarehouseTaskInfo:
      type: object
      required:
        - task-id
        - project-id
        - warehouse-id
        - queue-name
        - status
        - scheduled-for
        - attempt
        - progress
        - created-at
      properties:
        attempt:
          type: integer
          format: int32
          description: Current attempt number
        created-at:
          type: string
          format: date-time
          description: When this task attempt was created
        entity:
          oneOf:
            - type: 'null'
            - $ref: '#/components/schemas/WarehouseTaskEntityId'
              description: Type of the sub-entity this task operates on. None if this is a warehouse-level task.
        entity-name:
          type:
            - array
            - 'null'
          items:
            type: string
          description: Name of the entity this task operates on. None if this is a warehouse-level task.
        last-heartbeat-at:
          type:
            - string
            - 'null'
          format: date-time
          description: Last heartbeat timestamp for running tasks
        parent-task-id:
          type:
            - string
            - 'null'
          format: uuid
          description: Parent task ID if this is a sub-task
        picked-up-at:
          type:
            - string
            - 'null'
          format: date-time
          description: When the latest attempt of the task was picked up for processing by a worker.
        progress:
          type: number
          format: float
          description: Progress of the task (0.0 to 1.0)
        project-id:
          type: string
          description: Project ID associated with the task
        queue-name:
          type: string
          description: Name of the queue processing this task
        scheduled-for:
          type: string
          format: date-time
          description: When the latest attempt of the task is scheduled for
        status:
          $ref: '#/components/schemas/TaskStatus'
          description: Current status of the task
        task-id:
          type: string
          format: uuid
          description: Unique identifier for the task
        updated-at:
          type:
            - string
            - 'null'
          format: date-time
          description: When the task was last updated
        warehouse-id:
          type: string
          format: uuid
          description: Warehouse ID associated with the task
    WhoamiResponse:
      allOf:
        - $ref: '#/components/schemas/User'
        - type: object
          required:
            - is-instance-admin
          properties:
            is-instance-admin:
              type: boolean
              description: |-
                Whether the authenticated principal is an instance admin (configured via
                `LAKEKEEPER__INSTANCE_ADMINS`). Instance admins may modify the spec of
                warehouses marked `managed-by: instance-admin`. Only ever `true` for a
                principal acting directly; role-assumed requests do not inherit it.
      description: |-
        Response of the `whoami` endpoint: the catalog user for the current token,
        plus request-scoped privilege not stored on the user record.
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
security:
  - bearerAuth: []
tags:
  - name: server
    description: Manage Server
  - name: project
    description: Manage Projects
  - name: warehouse
    description: Manage Warehouses
  - name: tasks
    description: View & Manage Tasks
  - name: user
    description: Manage Users
  - name: role
    description: Manage Roles
  - name: permissions-openfga
    description: Authorization and permissions management using OpenFGA
  - name: permissions-cedar
    description: Cedar Authorization Management. Only available if Cedar authorization is enabled.