SHIELD.json

{
    "components": {
        "parameters": {
            "correlationId": {
                "description": "The object ID of the correlation identifier for the specified record.",
                "in": "path",
                "name": "correlationId",
                "required": true,
                "schema": {
                    "example": "1d71e0fe-6e4a-464d-a690-80addf3bda55",
                    "format": "uuid",
                    "maxLength": 36,
                    "minLength": 36,
                    "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-5][0-9a-f]{3}-[089ab][0-9a-f]{3}-[0-9a-f]{12}$",
                    "type": "string"
                }
            },
            "deviceId": {
                "description": "The SHIELD ID (Entra ID Device ID) of the managed device to target.",
                "in": "path",
                "name": "deviceId",
                "required": true,
                "schema": {
                    "example": "75da7fa4-4a04-44c8-8f2c-c1b2fa29aa51",
                    "format": "uuid",
                    "maxLength": 36,
                    "minLength": 36,
                    "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-5][0-9a-f]{3}-[089ab][0-9a-f]{3}-[0-9a-f]{12}$",
                    "type": "string"
                }
            },
            "intermediaryId": {
                "description": "The Object ID of the parent group for the intermediary that you wish to target.",
                "in": "path",
                "name": "intermediaryId",
                "required": true,
                "schema": {
                    "example": "25d4d9da-28ea-42f8-b3df-23c3969abffa",
                    "format": "uuid",
                    "maxLength": 36,
                    "minLength": 36,
                    "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-5][0-9a-f]{3}-[089ab][0-9a-f]{3}-[0-9a-f]{12}$",
                    "type": "string"
                }
            },
            "nextLink": {
                "description": "Information to be provided to the API call in order to retrieve next set of data as part of pagination. It could be a simple number or full URL representing MS Graph API navigation. This information should not be generated by hand or changed. In case of MS Graph API, please only use tokens the server gives you and do not bring them from outside.",
                "in": "query",
                "name": "nextLink",
                "schema": {
                    "minLength": 1,
                    "type": "string"
                },
                "examples": {
                    "number": {
                        "value": "3",
                        "summary": "Number for the next page in the navigation flow"
                    },
                    "uri": {
                        "value": "https://graph.microsoft.com/beta/devices?$top=20&$skiptoken=RFNwdCtEZXZpY2VfMThkNGY4OTAtMDA2YS00ZWM1LWI2OWYtY2VmNDY4ZjczNzQ4K0RldmljZV8xOGQ0Zjg5MC0wMDZhLTRlYzUtYjY5Zi1jZWY0NjhmNzM3NDg",
                        "summary": "Complete URL with details of the request and a skip token for MS Graph to parse and respond"
                    }
                }
            },
            "offeringId": {
                "description": "Unique identifier of the marketplace offering",
                "in": "path",
                "name": "offeringId",
                "required": true,
                "schema": {
                    "description": "Unique identifier of the marketplace offering.",
                    "example": "271ab834-7469-4f2d-a705-549972c4f325",
                    "format": "uuid",
                    "maxLength": 36,
                    "minLength": 36,
                    "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-5][0-9a-f]{3}-[089ab][0-9a-f]{3}-[0-9a-f]{12}$",
                    "type": "string"
                }
            },
            "search": {
                "description": "Used in object filtering.",
                "in": "query",
                "name": "search",
                "schema": {
                    "example": "finance",
                    "type": "string"
                }
            },
            "securityClass": {
                "description": "The security class of managed object to retrieve. Unknown values, will be ignored. Please see https://learn.microsoft.com/en-us/security/compass/privileged-access-security-levels for a description of security levels.",
                "in": "path",
                "name": "securityClass",
                "required": true,
                "schema": {
                    "$ref": "#/components/schemas/SecurityClassList"
                }
            },
            "updateChannelName": {
                "description": "Name of the update channel that should be used when querying or downloading updates.",
                "in": "path",
                "name": "Update Channel Name",
                "required": true,
                "schema": {
                    "example": "stable",
                    "type": "string",
                    "enum": [
                        "alpha",
                        "beta",
                        "stable"
                    ]
                }
            },
            "userId": {
                "description": "The SHIELD ID (Entra ID User's Object ID) of the managed user to target.",
                "in": "path",
                "name": "userId",
                "required": true,
                "schema": {
                    "example": "264a8bed-0714-48fd-8b9d-0e4c4715cee5",
                    "format": "uuid",
                    "maxLength": 36,
                    "minLength": 36,
                    "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-5][0-9a-f]{3}-[089ab][0-9a-f]{3}-[0-9a-f]{12}$",
                    "type": "string"
                }
            }
        },
        "responses": {
            "201": {
                "description": "The authorization was recorded successfully."
            },
            "202": {
                "description": "The process to create a report has started."
            },
            "400": {
                "description": "Invalid input!"
            },
            "401": {
                "description": "Principal is not authorized to access this endpoint. Check to make sure the Bearer token is valid and present!"
            },
            "403": {
                "description": "Principal does not contain the correct scopes (permissions) for the API call that was made, or was made from the wrong tenant. If the permissions were granted, ensure that the access token was requested with the correct scopes."
            },
            "404": {
                "description": "The requested object was not found."
            },
            "409": {
                "description": "A job is already in progress."
            },
            "525": {
                "description": "Infrastructure not deployed. Please deploy the infrastructure before using this endpoint."
            }
        },
        "schemas": {
            "Core.SystemRequirements": {
                "title": "Core - System Requirements",
                "description": "Collection of indicators that notify the caller if the system requirements have been met for various sub components to operate.",
                "properties": {
                    "azurePermissions": {
                        "description": "Flag that indicates if the required Azure RBAC assignment(s) are present or not.",
                        "type": "boolean",
                        "example": true
                    },
                    "defendEntitlement": {
                        "description": "Flag that indicates if the required defend licenses are present or not.",
                        "type": "boolean",
                        "example": false
                    },
                    "discoverEntitlement": {
                        "description": "Flag that indicates if the required discover licenses are present or not.",
                        "type": "boolean",
                        "example": true
                    },
                    "entraPermissions": {
                        "description": "Flag that indicates if the required Entra ID Role assignment(s) are present or not.",
                        "type": "boolean",
                        "example": true
                    },
                    "servicePlans": {
                        "description": "Flag that indicates if the required M365 licenses are present or not.",
                        "type": "boolean",
                        "example": false
                    }
                },
                "type": "object",
                "required": [
                    "azurePermissions",
                    "defendEntitlement",
                    "discoverEntitlement",
                    "entraPermissions",
                    "servicePlans"
                ]
            },
            "Authenticator.RequestStatus": {
                "title": "Authentication - Status",
                "description": "List of credentials that are being waited for by SHIELD's internal authentication engine.",
                "properties": {
                    "accessToken": {
                        "oneOf": [
                            {
                                "description": "Flag that represents if the server is not waiting for a specific access token.",
                                "type": "boolean",
                                "example": false
                            },
                            {
                                "$ref": "#/components/schemas/Authenticator.Status.TokenAudience"
                            }
                        ]
                    },
                    "sccAuth": {
                        "description": "Flag that represents if the server is waiting for SCC Auth credentials.",
                        "type": "boolean",
                        "example": true
                    }
                },
                "type": "object",
                "required": [
                    "accessToken",
                    "sccAuth"
                ]
            },
            "Authenticator.Status.TokenAudience": {
                "title": "SHIELD - Authenticator - Status - Token Audience",
                "description": "If a access token is being requested, this is the audience that the access token should have when being submitted.",
                "properties": {
                    "audience": {
                        "description": "Audience ID of the access token that is being requested.",
                        "type": "string",
                        "format": "uuid",
                        "maxLength": 36,
                        "minLength": 36,
                        "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-5][0-9a-f]{3}-[089ab][0-9a-f]{3}-[0-9a-f]{12}$",
                        "example": "00000002-0000-0000-b000-000000000000"
                    }
                },
                "type": "object",
                "required": [
                    "audience"
                ]
            },
            "Authenticator.Container.Credentials": {
                "title": "SHIELD - Authenticator - SCC Auth",
                "description": "SHIELD - Defender, and Purview portal Container Credentials",
                "type": "object",
                "properties": {
                    "authenticatedUpn": {
                        "description": "User principal name of the user that authenticated to the portals.",
                        "example": "user@example.com",
                        "type": "string",
                        "format": "email"
                    },
                    "expiration": {
                        "description": "Point in time at which the whole authentication structure has an expired state and is un-useable.",
                        "example": "2024-09-26T18:16:29.340Z",
                        "type": "string",
                        "format": "date-time"
                    },
                    "security": {
                        "$ref": "#/components/schemas/Authenticator.Container.Credentials.SccAuth"
                    },
                    "compliance": {
                        "$ref": "#/components/schemas/Authenticator.Container.Credentials.SccAuth"
                    },
                    "purview": {
                        "$ref": "#/components/schemas/Authenticator.Container.Credentials.SccAuth"
                    }
                },
                "required": [
                    "authenticatedUpn",
                    "security",
                    "compliance",
                    "purview"
                ]
            },
            "Authenticator.Container.Credentials.SccAuth": {
                "title": "SHIELD - Authenticator - SCC Auth - Credential Container",
                "description": "Container for the credentials for a single SccAuth authenticated site.",
                "properties": {
                    "sccAuth": {
                        "description": "Authentication Token.",
                        "example": "54BKPtTL-eSMFp5cqYTMMSblm2U80cUJqQgmbe4f_sRn4ammMmU1NKNurn9HqpsUtS4FrMJRTKa3Or_pFbedM_57R0fVBfNJ-m2Pvey9OweWIDradzT0dB1WnufPTJiT2y7zSQy91Y9wJIn1_aY5q-MNh75qwjM84Dng-mYzbd9KqUfyPUolOo-j-... (Truncated)",
                        "type": "string"
                    },
                    "xsrf": {
                        "description": "Cross Site Request Forgery Prevention Token.",
                        "example": "PEDwTvWdm2qSTe-n8h-1praK4OcQK1ELTJ08DWYqBRzQiyA2MIuEKEMNLu4ExjDNpAOUnAxmsqOeuGzb82MJYkegOE6hW8BzpSM6k9nbTbJ4yjNGzMSQvWUnyqrBvGa8JfSRiSeaKdXGBnxGd90Spw2:... (truncated)",
                        "type": "string"
                    }
                },
                "required": [
                    "sccAuth",
                    "xsrf"
                ],
                "type": "object"
            },
            "Discover.ExecutionStatus": {
                "title": "Discover - Status",
                "description": "Detailed status that indicates the current state of the Discover engine and its progress.",
                "type": "object",
                "properties": {
                    "running": {
                        "description": "Flag that indicates if another run is already in progress or not.",
                        "type": "boolean",
                        "example": true
                    }
                },
                "required": [
                    "running"
                ]
            },
            "ManagedObject.Intermediary": {
                "description": "Base template for all intermediary objects to inherit from.",
                "properties": {
                    "id": {
                        "description": "Read-only.",
                        "example": "e097a3f5-9599-44a2-8923-fd3276c83ae1",
                        "format": "uuid",
                        "maxLength": 36,
                        "minLength": 36,
                        "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-5][0-9a-f]{3}-[089ab][0-9a-f]{3}-[0-9a-f]{12}$",
                        "readOnly": true,
                        "type": "string"
                    },
                    "kind": {
                        "description": "Type of Intermediary that the properties are describing.",
                        "example": "AVD",
                        "type": "string"
                    },
                    "name": {
                        "description": "Human friendly name of the AVD cluster. This will be displayed to end users in the remote desktop app and web portals.",
                        "example": "Legacy Reach Back",
                        "maxLength": 42,
                        "minLength": 1,
                        "type": "string"
                    },
                    "securityClass": {
                        "$ref": "#/components/schemas/SecurityClassList"
                    }
                },
                "required": [
                    "name"
                ],
                "title": "Intermediary - Base Type",
                "type": "object"
            },
            "ManagedObject.AvdIntermediary": {
                "properties": {
                    "addressRangeCIDR": {
                        "description": "Optional Virtual Network IP Address range, defaults to 10.0.0.0/16.",
                        "example": "172.16.1.0/24",
                        "type": "string"
                    },
                    "assignmentGroup": {
                        "description": "Read-only value that the server generates that is the Object ID of the user assignment security group for the current instance of the AVD intermediary.",
                        "example": "68873e26-3c35-465c-9422-0884a00beb36",
                        "format": "uuid",
                        "maxLength": 36,
                        "minLength": 36,
                        "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-5][0-9a-f]{3}-[089ab][0-9a-f]{3}-[0-9a-f]{12}$",
                        "readOnly": true,
                        "type": "string"
                    },
                    "index": {
                        "description": "Used to uniquely name multiple session hosts in a single host pool.",
                        "minimum": 0,
                        "nullable": false,
                        "type": "number"
                    },
                    "location": {
                        "description": "Azure Regions that are available for the configured subscription. Resources will be deployed to the region specified here.",
                        "example": "East US 2",
                        "type": "string"
                    },
                    "resourceId": {
                        "description": "ID of the Host Pool. This is generated by the server and can't be set, hence the read only flag.",
                        "example": "/subscriptions/742f0d26-daa0-4f84-8d4f-fb052f89f639/resourceGroups/SHIELD_-_PSM-Legacy_Reach_Back/providers/Microsoft.DesktopVirtualization/hostpools/SHIELD_-_PSM-Cluster-Legacy_Reach_Back",
                        "minLength": 122,
                        "readOnly": true,
                        "type": "string"
                    },
                    "sessionHostGroup": {
                        "description": "Read-only value that the server generates that is the Object ID of the session host security group for the current instance of the AVD intermediary.",
                        "example": "f99f0918-da9b-4c58-9a8d-9346abc5d9ec",
                        "format": "uuid",
                        "maxLength": 36,
                        "minLength": 36,
                        "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-5][0-9a-f]{3}-[089ab][0-9a-f]{3}-[0-9a-f]{12}$",
                        "readOnly": true,
                        "type": "string"
                    },
                    "sessionHostPrefix": {
                        "description": "Short name to append to the beginning of the session host VMs. The max computer name length is 15, 4 chars are reserved for indexing and 4 for prefixing.",
                        "example": "Reach",
                        "maxLength": 7,
                        "minLength": 1,
                        "type": "string"
                    },
                    "vmSku": {
                        "description": "SKU ID in Azure of the VM session host set that is to be deployed.",
                        "example": "Standard_D2s_v5",
                        "type": "string"
                    }
                },
                "required": [
                    "index",
                    "location",
                    "sessionHostPrefix",
                    "vmSku"
                ],
                "title": "Intermediary - Azure Virtual Desktop",
                "type": "object"
            },
            "LicenseReport.CorrelationRecord": {
                "description": "Metadata that describes the execution session (run) that is used to tie/relate all of the license report together.",
                "example": {
                    "auditTenantAccount": "priv-user@example.com",
                    "correlationId": "9d838115-0868-45d4-b8a5-98adc1af7e42",
                    "reportTenantAccount": "ent-user@example.com",
                    "tenantId": "7e536189-b2dd-4c8b-98b1-9b174777883f",
                    "createdAt": "2024-08-01T21:13:12.821Z",
                    "updatedAt": "2024-08-01T21:13:12.821Z"
                },
                "properties": {
                    "auditTenantAccount": {
                        "description": "The user account used to retrieve the license information in the tenant being audited.",
                        "example": "admin-user@example.com",
                        "format": "email",
                        "type": "string"
                    },
                    "correlationId": {
                        "description": "The ID of the execution session (run) that is used to tie/relate all of the data together.",
                        "example": "88da2253-758f-4135-9d37-64448c8b65c1",
                        "format": "uuid",
                        "type": "string",
                        "pattern": "^\\w+-\\w+-\\w+-\\w+-\\w+$"
                    },
                    "reportTenantAccount": {
                        "description": "User account used to store/report the license report to the SHI Lab cloud service.",
                        "example": "generic-user@example.com",
                        "format": "email",
                        "type": "string"
                    },
                    "tenantId": {
                        "description": "Unique ID of customer's Microsoft tenant that the license report is for.",
                        "example": "0e1fe83f-a33f-4250-8546-225b8d45ae01",
                        "format": "uuid",
                        "type": "string",
                        "pattern": "^\\w+-\\w+-\\w+-\\w+-\\w+$"
                    },
                    "createdAt": {
                        "description": "Timestamp of when the report was created.",
                        "example": "2024-08-01T21:12:22.148Z",
                        "format": "date-time",
                        "type": "string"
                    },
                    "updatedAt": {
                        "description": "Timestamp of when the report was last updated.",
                        "example": "2024-08-01T21:12:22.148Z",
                        "format": "date-time",
                        "type": "string"
                    }
                },
                "required": [
                    "auditTenantAccount"
                ],
                "title": "License Report - Correlation Record",
                "type": "object"
            },
            "LicenseReport.LicenseData": {
                "type": "object",
                "properties": {
                    "assignedLicense": {
                        "additionalProperties": {
                            "type": "integer",
                            "nullable": true
                        },
                        "description": "License assignment on the specified principal.",
                        "type": "object"
                    },
                    "assignedService": {
                        "additionalProperties": {
                            "oneOf": [
                                {
                                    "$ref": "#/components/schemas/LicenseReport.FeatureBreakdown"
                                },
                                {
                                    "type": "integer",
                                    "format": "int32"
                                }
                            ],
                            "nullable": true
                        },
                        "description": "Service configuration assignment.  This is used to record the set of principals that are \"benefiting\" from the service, regardless of license status.",
                        "type": "object"
                    },
                    "consumedService": {
                        "additionalProperties": {
                            "oneOf": [
                                {
                                    "$ref": "#/components/schemas/LicenseReport.FeatureBreakdown"
                                },
                                {
                                    "type": "integer",
                                    "format": "int32"
                                }
                            ],
                            "nullable": true
                        },
                        "description": "Usage telemetry retrieved for the service to indicate if the specific principal is consuming the service or not, regardless of license status.",
                        "type": "object"
                    }
                },
                "required": [
                    "assignedLicense",
                    "assignedService",
                    "consumedService"
                ],
                "description": "Collection of principals that have had their in-use licenses and assigned licenses. Where the key is the principal ID and the value is the insights.",
                "example": {
                    "assignedLicense": {
                        "eec0eb4f-6444-4f95-aba0-50c24d67f998": null,
                        "41781fb2-bc02-4b7c-bd55-b576c07bb09d": null,
                        "7159f980-6f83-4b67-bf41-e172b3ae1352": null
                    },
                    "assignedService": {
                        "eec0eb4f-6444-4f95-aba0-50c24d67f998": {
                            "Conditional Access": false,
                            "Access Review": true,
                            "Entitlement Management": false,
                            "Identity Protection": true
                        },
                        "41781fb2-bc02-4b7c-bd55-b576c07bb09d": {
                            "Conditional Access": true,
                            "Dynamic Group": false,
                            "Group Naming": true,
                            "On-Prem SSPR": false,
                            "Group Expiration": true,
                            "Provisioning Engine": true,
                            "Enterprise State Roaming": false
                        },
                        "6511755b-c27d-4c66-a59e-b835e6b54e7f": null
                    },
                    "consumedService": {
                        "eec0eb4f-6444-4f95-aba0-50c24d67f998": {
                            "Conditional Access": true,
                            "Access Review": false,
                            "Entitlement Management": false,
                            "Identity Protection": true
                        },
                        "41781fb2-bc02-4b7c-bd55-b576c07bb09d": {
                            "Conditional Access": true,
                            "Dynamic Group": false,
                            "Group Naming": true,
                            "On-Prem SSPR": false,
                            "Group Expiration": true,
                            "Provisioning Engine": true,
                            "Enterprise State Roaming": false
                        },
                        "4b0d28f2-c1ce-48ae-a7d2-1caaa7825891": null,
                        "c90f1a25-e6cd-4163-ac6c-ca7616c585a9": null
                    }
                },
                "title": "License Report - License Data"
            },
            "LicenseReport.FeatureBreakdown": {
                "additionalProperties": {
                    "type": "boolean"
                },
                "description": "List of features that are configured for the specific service plan's service configuration for the related principal.\nThe key is the name of the feature that is being described.\nThe value is the state of the feature configuration, `true` is in scope and `false` meaning not in scope.",
                "example": {
                    "Conditional Access": true,
                    "Access Reviews": true,
                    "Dynamic Groups": false,
                    "On-Prem Password Rest": true,
                    "On-Prem Password Protection": false
                },
                "title": "License Report - Feature Breakdown",
                "type": "object"
            },
            "LicenseReport": {
                "description": "Completely calculated license report structure that is the result of a complete run.",
                "example": {
                    "availableLicense": {
                        "e17b13ee-9749-488b-9289-d31a8fde045d": 123,
                        "2d995b6a-d4aa-4d8d-a03c-372ecb66509d": 456,
                        "cbf6ee7c-c3c1-44a6-9f18-020c65536470": 789
                    },
                    "correlation": {
                        "auditTenantAccount": "admin-user@example.com",
                        "correlationId": "88da2253-758f-4135-9d37-64448c8b65c1",
                        "reportTenantAccount": "generic-user@example.com",
                        "tenantId": "0e1fe83f-a33f-4250-8546-225b8d45ae01"
                    },
                    "licenseData": {
                        "250844e1-a7ab-4f21-8e3f-58f51b5983a3": {
                            "assignedLicense": {
                                "e17b13ee-9749-488b-9289-d31a8fde045d": null
                            },
                            "assignedService": {
                                "cbf6ee7c-c3c1-44a6-9f18-020c65536470": null,
                                "c7bcba35-199c-41e5-8c8d-6d4e4aad8964": null
                            },
                            "consumedService": {
                                "fe98c41a-d931-4f6f-a5bc-750ba7144a77": null,
                                "0474bdf1-ee76-4aff-a65c-6f82e5e1d5a6": {
                                    "Something Here": true,
                                    "Other Obscure feature": false
                                }
                            }
                        }
                    }
                },
                "type": "object",
                "properties": {
                    "availableLicense": {
                        "additionalProperties": {
                            "example": 1234,
                            "type": "integer"
                        },
                        "description": "Breakdown of the purchased licenses/service plans available in the tenant being audited for this run. Where the key is the ID of the service plan and the value is how many licenses are available/purchase for it.",
                        "example": {
                            "eec0eb4f-6444-4f95-aba0-50c24d67f998": 1234,
                            "41781fb2-bc02-4b7c-bd55-b576c07bb09d": 123
                        },
                        "title": "License Report - Available Licenses",
                        "type": "object"
                    },
                    "correlation": {
                        "$ref": "#/components/schemas/LicenseReport.CorrelationRecord"
                    },
                    "licenseData": {
                        "additionalProperties": {
                            "$ref": "#/components/schemas/LicenseReport.LicenseData"
                        }
                    }
                },
                "required": [
                    "availableLicense",
                    "correlation",
                    "licenseData"
                ],
                "title": "License Report - Complete Object"
            },
            "ManagedObject.Device": {
                "title": "Managed Device",
                "description": "Structure that represents a all of the states a managed device could be in.",
                "type": "object",
                "properties": {
                    "commissionedDate": {
                        "description": "This is the ISO 8601 string format of the time representing the commission date of the PAW.",
                        "example": "2023-02-04T05:06:09.601Z",
                        "format": "date-time",
                        "type": "string"
                    },
                    "displayName": {
                        "description": "Current computer name of the device according to Entra ID. Empty string indicates that the device has not joined Entra ID yet.",
                        "example": "Priv-01534962354",
                        "maxLength": 15,
                        "minLength": 0,
                        "type": "string"
                    },
                    "id": {
                        "description": "Entra ID Device ID (Not Object ID) of the specified device.",
                        "example": "9f237e13-9a04-4daf-b3d4-6d2beec3c2bf",
                        "format": "uuid",
                        "maxLength": 36,
                        "minLength": 36,
                        "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-5][0-9a-f]{3}-[089ab][0-9a-f]{3}-[0-9a-f]{12}$",
                        "readOnly": true,
                        "type": "string"
                    },
                    "parentDeviceId": {
                        "description": "DeviceID of the parent PAW device.",
                        "example": "81682cf5-0405-491d-8ab8-e07c778d7eaf",
                        "nullable": true,
                        "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-5][0-9a-f]{3}-[089ab][0-9a-f]{3}-[0-9a-f]{12}$",
                        "type": "string"
                    },
                    "securityClass": {
                        "$ref": "#/components/schemas/SecurityClassList"
                    },
                    "uniqueGroupId": {
                        "description": "The object ID of the unique security group that contains the managed Entra ID Device Identity.",
                        "example": "146964e0-8ca4-4af0-9c2a-894b32912463",
                        "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-5][0-9a-f]{3}-[089ab][0-9a-f]{3}-[0-9a-f]{12}$",
                        "readOnly": true,
                        "type": "string"
                    }
                },
                "required": [
                    "commissionedDate",
                    "displayName",
                    "id",
                    "securityClass",
                    "uniqueGroupId"
                ]
            },
            "ManagedObject.PrivilegedDevice": {
                "description": "Set of properties that are available on privileged managed device objects only.",
                "title": "Managed Device - Privileged",
                "type": "object",
                "allOf": [
                    {
                        "$ref": "#/components/schemas/ManagedObject.Device"
                    },
                    {
                        "type": "object",
                        "properties": {
                            "groupAssignmentId": {
                                "description": "This is the ID of the Custom CSP Device Configuration that configures the local admin and local hyper-v group memberships.",
                                "example": "830d8b6f-2f6f-41f7-8800-0c07445abd36",
                                "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-5][0-9a-f]{3}-[089ab][0-9a-f]{3}-[0-9a-f]{12}$",
                                "type": "string"
                            },
                            "securityClass": {
                                "description": "Security class that indicates this device is a privileged device.",
                                "example": "Privileged",
                                "type": "string",
                                "enum": [
                                    "Privileged"
                                ]
                            },
                            "userAssignmentId": {
                                "description": "The ID of the Settings Catalog that contains the user rights assignment of the specified PAW device.",
                                "example": "146964e0-8ca4-4af0-9c2a-894b32912463",
                                "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-5][0-9a-f]{3}-[089ab][0-9a-f]{3}-[0-9a-f]{12}$",
                                "readOnly": true,
                                "type": "string"
                            },
                            "userAssignmentList": {
                                "description": "List of Object IDs for the privileged user accounts that are assigned to this device.",
                                "example": [
                                    "56d0d4e1-96f6-4cfb-a5e9-a4ee923169a8",
                                    "94a9d681-a8d2-43eb-a83b-d4bfe90259ff",
                                    "c54d4854-9254-4689-8a22-1cc80a3dae4e"
                                ],
                                "type": "array",
                                "items": {
                                    "type": "string",
                                    "format": "uuid"
                                }
                            }
                        },
                        "required": [
                            "groupAssignmentId",
                            "securityClass",
                            "userAssignmentId",
                            "userAssignmentList"
                        ]
                    }
                ]
            },
            "ManagedObject.User": {
                "title": "Managed User",
                "description": "A user object that has limited properties. The user object is generated by combining multiple pieces of metadata from Entra ID and SHIELD.",
                "properties": {
                    "creationDate": {
                        "description": "A date object representing when the user managed by SHIELD.",
                        "example": "2023-10-21T15:24:47.970Z",
                        "format": "date-time",
                        "readOnly": true,
                        "type": "string"
                    },
                    "displayName": {
                        "description": "The name shown on UIs for the privileged user according to Entra ID.",
                        "example": "Example User (Priv)",
                        "maxLength": 256,
                        "nullable": true,
                        "type": "string"
                    },
                    "firstName": {
                        "description": "Given name of the privileged user according to Entra ID.",
                        "maxLength": 64,
                        "nullable": true,
                        "type": "string"
                    },
                    "id": {
                        "description": "The Entra ID Object ID of the managed user. This is the one property that is stored in the settings engine. This is the key in the storage systems to uniquely separate the managed user's data from others.",
                        "example": "9f237e13-9a04-4daf-b3d4-6d2beec3c2bf",
                        "format": "uuid",
                        "maxLength": 36,
                        "minLength": 36,
                        "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-5][0-9a-f]{3}-[089ab][0-9a-f]{3}-[0-9a-f]{12}$",
                        "readOnly": true,
                        "type": "string"
                    },
                    "intermediaryAssignmentList": {
                        "type": "array",
                        "description": "List of intermediaries that the user is assigned to.",
                        "items": {
                            "type": "string",
                            "format": "uuid"
                        },
                        "example": [
                            "0390fb3e-c58b-4d73-b02c-eae41ec5e4a5",
                            "593d97dc-9a43-4bc7-9d79-ecde407d7782",
                            "995f3b39-1e01-40d4-9368-ee956343e97c"
                        ]
                    },
                    "lastName": {
                        "description": "Surname/family name of the privileged user according to Entra ID.",
                        "maxLength": 64,
                        "nullable": true,
                        "type": "string"
                    },
                    "upn": {
                        "description": "User principal name of the user object according to Azure Active Directory.",
                        "example": "priv-user@example.com",
                        "format": "email",
                        "maxLength": 113,
                        "minLength": 6,
                        "type": "string"
                    },
                    "securityClass": {
                        "$ref": "#/components/schemas/SecurityClassList"
                    },
                    "siloAssignmentList": {
                        "type": "array",
                        "description": "List of silos that the user is assigned to.",
                        "items": {
                            "type": "string",
                            "format": "uuid"
                        },
                        "example": [
                            "0390fb3e-c58b-4d73-b02c-eae41ec5e4a5",
                            "593d97dc-9a43-4bc7-9d79-ecde407d7782",
                            "995f3b39-1e01-40d4-9368-ee956343e97c"
                        ]
                    },
                    "uiEducation": {
                        "description": "Indicates if user education is enabled in the UI for the specified user. True is on, false is off.",
                        "example": false,
                        "type": "boolean"
                    },
                    "uniqueGroupId": {
                        "description": "ObjectID of the unique user group that the managed user is a member of.",
                        "example": "ad402c42-1bc9-4ba5-9419-7dbfb46a9c4d",
                        "format": "uuid",
                        "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-5][0-9a-f]{3}-[089ab][0-9a-f]{3}-[0-9a-f]{12}$",
                        "readOnly": true,
                        "type": "string"
                    }
                },
                "required": [
                    "creationDate",
                    "securityClass",
                    "id",
                    "intermediaryAssignmentList",
                    "siloAssignmentList",
                    "uiEducation",
                    "uniqueGroupId",
                    "upn"
                ],
                "type": "object"
            },
            "ManagedObject.PrivilegedUser": {
                "title": "Managed User - Privileged",
                "description": "Additional settings that represent a privileged user object. All data in this structure is preserved in the settings engine's permanent storage system.",
                "allOf": [
                    {
                        "$ref": "#/components/schemas/ManagedObject.User"
                    },
                    {
                        "properties": {
                            "deviceAssignmentList": {
                                "type": "array",
                                "description": "List of devices that the privileged users are able to use as endpoints.",
                                "items": {
                                    "type": "string",
                                    "format": "uuid"
                                },
                                "example": [
                                    "0390fb3e-c58b-4d73-b02c-eae41ec5e4a5",
                                    "593d97dc-9a43-4bc7-9d79-ecde407d7782",
                                    "995f3b39-1e01-40d4-9368-ee956343e97c"
                                ]
                            },
                            "generatedPassword": {
                                "description": "The password that was created for the managed user upon managed user creation, this is not stored. This is only available once during user creation. If the password is lost, reset the PWD in Entra ID or have the user perform SSPR.",
                                "example": "GY_w7bZUKRgpIXctD0S2wg",
                                "readOnly": true,
                                "type": "string"
                            },
                            "parentId": {
                                "description": "The Entra ID Object ID of the object that the manged user is tied to. This value is only present on privileged users.",
                                "example": "e59a3a64-dc36-4368-80ec-c205eb176ef6",
                                "format": "uuid",
                                "maxLength": 36,
                                "minLength": 36,
                                "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-5][0-9a-f]{3}-[089ab][0-9a-f]{3}-[0-9a-f]{12}$",
                                "readOnly": true,
                                "type": "string"
                            },
                            "securityClass": {
                                "description": "Security class that indicates this user is a privileged user.",
                                "example": "Privileged",
                                "type": "string",
                                "enum": [
                                    "Privileged"
                                ]
                            },
                            "temporaryAccessPass": {
                                "description": "A TAP that was created for the managed user upon managed user creation, this is not stored. This is only available once during user creation. TAP expires at the configured tenant expiration time.",
                                "example": "BCKTSN#E2R&5",
                                "readOnly": true,
                                "type": "string"
                            }
                        },
                        "required": [
                            "deviceAssignmentList",
                            "parentId",
                            "securityClass"
                        ],
                        "type": "object"
                    }
                ]
            },
            "ObjectPage.Intermediary.Avd": {
                "properties": {
                    "@odata.count": {
                        "nullable": true,
                        "type": "number"
                    },
                    "@odata.nextLink": {
                        "nullable": true,
                        "type": "string"
                    },
                    "value": {
                        "items": {
                            "allOf": [
                                {
                                    "$ref": "#/components/schemas/ManagedObject.Intermediary"
                                },
                                {
                                    "properties": {
                                        "properties": {
                                            "$ref": "#/components/schemas/ManagedObject.AvdIntermediary"
                                        }
                                    },
                                    "type": "object"
                                }
                            ]
                        },
                        "minItems": 0,
                        "type": "array"
                    }
                },
                "required": [
                    "value"
                ],
                "title": "Page of AVD Intermediary Objects",
                "type": "object"
            },
            "ObjectPage.ManagedDevice": {
                "properties": {
                    "@odata.count": {
                        "nullable": true,
                        "type": "number"
                    },
                    "@odata.nextLink": {
                        "nullable": true,
                        "type": "string"
                    },
                    "value": {
                        "items": {
                            "oneOf": [
                                {
                                    "$ref": "#/components/schemas/ManagedObject.Device"
                                },
                                {
                                    "$ref": "#/components/schemas/ManagedObject.PrivilegedDevice"
                                }
                            ]
                        },
                        "minItems": 0,
                        "type": "array"
                    }
                },
                "required": [
                    "value"
                ],
                "title": "Page of Managed Device Objects",
                "type": "object"
            },
            "ObjectPage.ManagedUser": {
                "properties": {
                    "@odata.count": {
                        "nullable": true,
                        "type": "number"
                    },
                    "@odata.nextLink": {
                        "nullable": true,
                        "type": "string"
                    },
                    "value": {
                        "items": {
                            "oneOf": [
                                {
                                    "$ref": "#/components/schemas/ManagedObject.User"
                                },
                                {
                                    "$ref": "#/components/schemas/ManagedObject.PrivilegedUser"
                                }
                            ]
                        },
                        "minItems": 0,
                        "type": "array"
                    }
                },
                "required": [
                    "value"
                ],
                "title": "Page of Managed User Objects",
                "type": "object"
            },
            "SecurityClassList": {
                "description": "Security class types as described in https://learn.microsoft.com/en-us/security/compass/privileged-access-security-levels.",
                "enum": [
                    "Privileged",
                    "Specialized",
                    "Enterprise",
                    "Unmanaged"
                ],
                "example": "Privileged",
                "title": "Type of security class the object(s) belongs to",
                "type": "string"
            }
        },
        "securitySchemes": {
            "EntraID": {
                "type": "http",
                "scheme": "bearer",
                "bearerFormat": "JWT",
                "description": "The Access Token from Entra ID for the `SHIELD - End User Login` Enterprise App (may need to be created from the App Registration)."
            }
        }
    },
    "externalDocs": {
        "description": "Official Documentation",
        "url": "https://docs.shilab.com"
    },
    "info": {
        "contact": {
            "email": "elliot_huffman@shi.com",
            "name": "SHI - Lab"
        },
        "description": "Deprive your threats of practical significance. Deploy the Securing Privilege Access architecture. All in a few seconds.",
        "title": "SHI Environment Lockdown and Defense",
        "version": "3.0.0"
    },
    "openapi": "3.0.0",
    "paths": {
        "/Api/Core/SystemRequirements": {
            "get": {
                "description": "Provides a detailed breakdown of if the system requirements are being met for the various components of the SHIELD.",
                "operationId": "/Api/Core/SystemRequirements/Get",
                "responses": {
                    "200": {
                        "content": {
                            "application/json": {
                                "schema": {
                                    "$ref": "#/components/schemas/Core.SystemRequirements"
                                }
                            }
                        },
                        "description": "OK"
                    }
                },
                "tags": [
                    "Core"
                ],
                "security": [],
                "summary": "Indicates if the System Requirements are met or not."
            }
        },
        "/Api/Auth/Id": {
            "get": {
                "description": "Provides the Tenant ID and the Application ID of the service principal that access tokens need to be issued against. This is also useful for configuring public clients to be able to authenticate to for auth code flows.",
                "operationId": "/Api/Auth/Id/Get",
                "responses": {
                    "200": {
                        "content": {
                            "application/json": {
                                "schema": {
                                    "properties": {
                                        "appId": {
                                            "description": "Application ID that should be used in Access Tokens as the audience and the endpoint necessary for auth code flows.",
                                            "type": "string",
                                            "format": "uuid"
                                        },
                                        "tenantId": {
                                            "description": "Tenant ID necessary for authority host URL configuration and UI customization.",
                                            "type": "string",
                                            "format": "uuid"
                                        }
                                    },
                                    "type": "object",
                                    "required": [
                                        "appId",
                                        "tenantId"
                                    ]
                                }
                            }
                        },
                        "description": "OK"
                    },
                    "525": {
                        "$ref": "#/components/responses/525"
                    }
                },
                "tags": [
                    "Authentication"
                ],
                "security": [],
                "summary": "Retrieves the IDs required to authenticate."
            }
        },
        "/Api/Auth/Authenticator": {
            "get": {
                "summary": "Provides Attestation for Authenticator App",
                "description": "Provides the attestation to the authenticator that this endpoint is authorized for receiving credentials from the authenticator.\n\nThis endpoint requires the `Authentication.Actions.Attest`, or the `Everything.ReadWrite` scope (permission).",
                "operationId": "/Api/Auth/Authenticator/GetAttest",
                "responses": {
                    "200": {
                        "content": {
                            "application/json": {
                                "schema": {
                                    "description": "Access token that SHIELD uses to prove it is a valid recipient of credentials.",
                                    "type": "string",
                                    "example": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik1jN2wzSXo5M2c3dXdnTmVFbW13X1dZR1BrbyJ9.eyJhdWQiOiJjYjU5ZjIyOC0wNjkwLTRhY2ItOWE3Yi0wMGMzNmEyZjRlOGQiLCJpc3MiOiJodHRwczovL2xvZ2luLm1pY3Jvc29mdG9ubGluZS5jb20vMmQxMDJkYTktZDExZS00YTgwLTkwMjItYzQxOGZhNDg1NGM3L3YyLjAiLCJpYXQiOjE3MjczNjgzODQsIm5iZiI6MTcyNzM2ODM4NCwiZXhwIjoxNzI3MzcyMjg0LCJhaW8iOiJBU1FBMi84WUFBQUFSN0hyaW5XTmRwcisvdnoreWlkZER6WVExeFRpc3BSZGY4TG1XNjhRaE0wPSIsImF6cCI6IjRlODU5MTQ2LWY5M2UtNDlmMi05ODZmLWI3MjIyNmZjZDViOSIsImF6cGFjciI6IjEiLCJvaWQiOiJlMmRlNzQ0ZC1hZjVlLTQ4NDEtYmI4Zi02OTRkZDI1ZmVmNGQiLCJyaCI6IjAuQWNvQXFTMFFMUjdSZ0VxUUlzUVkta2hVeHlqeVdjdVFCc3RLbW5zQXcyb3ZUbzM2QUFBLiIsInJvbGVzIjpbIkF1dGhlbnRpY2F0b3IuQXR0ZXN0Il0sInN1YiI6ImUyZGU3NDRkLWFmNWUtNDg0MS1iYjhmLTY5NGRkMjVmZWY0ZCIsInRpZCI6IjJkMTAyZGE5LWQxMWUtNGE4MC05MDIyLWM0MThmYTQ4NTRjNyIsInV0aSI6Il9MaUdVWWxmS2txNFZoR09NeGw4QUEiLCJ2ZXIiOiIyLjAifQ.xlXZfOnDoOVW3_aOiSIZH8uiySeohro-HVnDzDEff2EjmOk9adrTOP5Sw1av6g3vy38r6dSu4tViwNGrb7Z2krgRKKvp-4A9rkPqeJjjd2rhFl2KiOlxL0mmykbroZZ70RJzwHy2GC7wfuLwJwr-5m7POV2grbxIAlTsMdZWDFXYi-AahfDVtLugarWG5-tXAqiPBKjaU6ntAJIbu7Ol1vYZaeYMsNKTs8O1P10YM460zN9OkfoI1gV7_InHEr8RSyQnEPCJ2W1Or4lDhqdey4ohMoP9EzLgMsn9Ckss5g5C6vVE0GQawUoeGozPOBpgb31J8JzZUyB1JyVfi-vKkQ"
                                }
                            }
                        },
                        "description": "OK"
                    }
                },
                "tags": [
                    "Authentication"
                ]
            }
        },
        "/Api/Auth/Authenticator/Cache/Status": {
            "get": {
                "summary": "Indicates if SHIELD is waiting for any credentials.",
                "description": "Provides a breakdown view of if SHIELD is waiting for any specific type of credential or credentials.\n\nThis endpoint requires the `Authentication.Read`, `Authentication.ReadWrite`, or the `Everything.ReadWrite` scope (permission).",
                "operationId": "/Api/Auth/Authenticator/Cache/Status/Get",
                "responses": {
                    "200": {
                        "content": {
                            "application/json": {
                                "examples": {
                                    "Waiting on Nothing": {
                                        "description": "No credentials are being requested at the moment.",
                                        "value": {
                                            "accessToken": false,
                                            "sccAuth": false
                                        }
                                    },
                                    "Waiting on Access Token": {
                                        "description": "Waiting on an Access Token with the Audience of the Legacy Windows Graph API.",
                                        "value": {
                                            "accessToken": {
                                                "audience": "00000002-0000-0000-c000-000000000000"
                                            },
                                            "sccAuth": false
                                        }
                                    },
                                    "Waiting on SccAuth": {
                                        "description": "Waiting on an SCC Auth data from the SHIELD - Authenticator App.",
                                        "value": {
                                            "accessToken": false,
                                            "sccAuth": true
                                        }
                                    }
                                },
                                "schema": {
                                    "$ref": "#/components/schemas/Authenticator.RequestStatus"
                                }
                            }
                        },
                        "description": "OK"
                    }
                },
                "tags": [
                    "Authentication"
                ]
            }
        },
        "/Api/Auth/Authenticator/Cache/SccAuth": {
            "post": {
                "description": "Configure SHIELD to use the specific SCC Auth credentials from the authenticator app to run web requests on behalf of the end user.\n\nThis endpoint requires the `Authentication.ReadWrite`, or the `Everything.ReadWrite` scope (permission).",
                "operationId": "/Api/Auth/Authenticator/Cache/SccAuth/Post",
                "requestBody": {
                    "content": {
                        "application/json": {
                            "schema": {
                                "$ref": "#/components/schemas/Authenticator.Container.Credentials"
                            }
                        }
                    }
                },
                "responses": {
                    "204": {
                        "description": "Credential was successfully stored"
                    }
                },
                "summary": "Provide Your SHIELD Authenticator Credentials - SCC Auth",
                "tags": [
                    "Authentication"
                ]
            }
        },
        "/Api/Auth/Authenticator/Cache/AccessToken": {
            "post": {
                "summary": "Provide Your SHIELD Authenticator Credentials - Access Token",
                "description": "Configure SHIELD to use the specific Access Token credentials from the authenticator app to run web requests on behalf of the end user.\n\nThis endpoint requires the `Authentication.ReadWrite`, or the `Everything.ReadWrite` scope (permission).",
                "operationId": "/Api/Auth/Authenticator/Cache/AccessToken/Post",
                "requestBody": {
                    "content": {
                        "application/json": {
                            "schema": {
                                "description": "Access Token to be stored in the SHIELD authentication engine.",
                                "type": "object",
                                "properties": {
                                    "token": {
                                        "description": "This is transmitted as a property instead of a raw string as the body parser ignores it in Express.JS. Functionally identical though.",
                                        "type": "string",
                                        "example": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik1jN2wzSXo5M2c3dXdnTmVFbW13X1dZR1BrbyJ9.eyJhdWQiOiI0YzQwMjgxYi1hMzA1LTRhYWYtOTBhNC1kNWJiZWU2ZWI4ZWQiLCJpc3MiOiJodHRwczovL2xvZ2luLm1pY3Jvc29mdG9ubGluZS5jb20vMmQxMDJkYTktZDExZS00YTgwLTkwMjItYzQxOGZhNDg1NGM3L3YyLjAiLCJpYXQiOjE3MjczNzUzNzMsIm5iZiI6MTcyNzM3NTM3MywiZXhwIjoxNzI3Mzc5MjczLCJhaW8iOiJrMkJnWU9BM1ByL2lTc2loRmYzeU9uVk40UTZOc1dsZnRnWEhoMW5HYm5saWVuS1hRZ2tBIiwiYXpwIjoiNGU4NTkxNDYtZjkzZS00OWYyLTk4NmYtYjcyMjI2ZmNkNWI5IiwiYXpwYWNyIjoiMSIsIm9pZCI6ImUyZGU3NDRkLWFmNWUtNDg0MS1iYjhmLTY5NGRkMjVmZWY0ZCIsInJoIjoiMC5BY29BcVMwUUxSN1JnRXFRSXNRWS1raFV4eHNvUUV3Rm82OUtrS1RWdS01dXVPMzZBQUEuIiwicm9sZXMiOlsiVGVsZW1ldHJ5LlNvcC5SZWFkV3JpdGUiLCJMaWNlbnNlUmVwb3J0LlJlYWRXcml0ZSJdLCJzdWIiOiJlMmRlNzQ0ZC1hZjVlLTQ4NDEtYmI4Zi02OTRkZDI1ZmVmNGQiLCJ0aWQiOiIyZDEwMmRhOS1kMTFlLTRhODAtOTAyMi1jNDE4ZmE0ODU0YzciLCJ1dGkiOiJfTGlHVVlsZktrcTRWaEdPXzNpRkFBIiwidmVyIjoiMi4wIn0.CZMOfyo5Lo1Km8bgWtOw8f30n1AZ5HJQ-StyIPr_P_eEjanzHVSEiRsHweNATW0GQFfLs0lGH43xztFcNNepu7CctyEzoktJ-9De2mMLIMJviF1rlB19mxH3a3hUSPZuPeYPPONkYtjL4fZj0mCYcALoq-orc0Oswg0l3fatbS7a-DAgxZdLHa6M7OtXksMlMXwooxmocOQeg_zhpko1zyuzSsVwNrz1uMZYpivwaM1ImWZiqgjMc1NWCN2Co1nYNuvxg6Chcr0OOsPRaXayfzrP7IlsZIg5Itg9lrqN0cjT3t8GSejL2P8HmfPcYftlqOobCesjSfBthir5hGUoNA"
                                    }
                                },
                                "example": {
                                    "token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik1jN2wzSXo5M2c3dXdnTmVFbW13X1dZR1BrbyJ9.eyJhdWQiOiI0YzQwMjgxYi1hMzA1LTRhYWYtOTBhNC1kNWJiZWU2ZWI4ZWQiLCJpc3MiOiJodHRwczovL2xvZ2luLm1pY3Jvc29mdG9ubGluZS5jb20vMmQxMDJkYTktZDExZS00YTgwLTkwMjItYzQxOGZhNDg1NGM3L3YyLjAiLCJpYXQiOjE3MjczNzUzNzMsIm5iZiI6MTcyNzM3NTM3MywiZXhwIjoxNzI3Mzc5MjczLCJhaW8iOiJrMkJnWU9BM1ByL2lTc2loRmYzeU9uVk40UTZOc1dsZnRnWEhoMW5HYm5saWVuS1hRZ2tBIiwiYXpwIjoiNGU4NTkxNDYtZjkzZS00OWYyLTk4NmYtYjcyMjI2ZmNkNWI5IiwiYXpwYWNyIjoiMSIsIm9pZCI6ImUyZGU3NDRkLWFmNWUtNDg0MS1iYjhmLTY5NGRkMjVmZWY0ZCIsInJoIjoiMC5BY29BcVMwUUxSN1JnRXFRSXNRWS1raFV4eHNvUUV3Rm82OUtrS1RWdS01dXVPMzZBQUEuIiwicm9sZXMiOlsiVGVsZW1ldHJ5LlNvcC5SZWFkV3JpdGUiLCJMaWNlbnNlUmVwb3J0LlJlYWRXcml0ZSJdLCJzdWIiOiJlMmRlNzQ0ZC1hZjVlLTQ4NDEtYmI4Zi02OTRkZDI1ZmVmNGQiLCJ0aWQiOiIyZDEwMmRhOS1kMTFlLTRhODAtOTAyMi1jNDE4ZmE0ODU0YzciLCJ1dGkiOiJfTGlHVVlsZktrcTRWaEdPXzNpRkFBIiwidmVyIjoiMi4wIn0.CZMOfyo5Lo1Km8bgWtOw8f30n1AZ5HJQ-StyIPr_P_eEjanzHVSEiRsHweNATW0GQFfLs0lGH43xztFcNNepu7CctyEzoktJ-9De2mMLIMJviF1rlB19mxH3a3hUSPZuPeYPPONkYtjL4fZj0mCYcALoq-orc0Oswg0l3fatbS7a-DAgxZdLHa6M7OtXksMlMXwooxmocOQeg_zhpko1zyuzSsVwNrz1uMZYpivwaM1ImWZiqgjMc1NWCN2Co1nYNuvxg6Chcr0OOsPRaXayfzrP7IlsZIg5Itg9lrqN0cjT3t8GSejL2P8HmfPcYftlqOobCesjSfBthir5hGUoNA"
                                }
                            }
                        }
                    }
                },
                "responses": {
                    "204": {
                        "description": "Credential was successfully stored"
                    },
                    "400": {
                        "description": "Invalid Access Token"
                    }
                },
                "tags": [
                    "Authentication"
                ]
            }
        },
        "/Api/Update": {
            "get": {
                "summary": "Check if an Update Is Pending",
                "description": "Provides the state of the update engine. Where `true` means there is an update detected and `false` means there isn't an update available. This endpoint is available to all authorization levels.",
                "operationId": "/Api/Update/Get",
                "responses": {
                    "200": {
                        "content": {
                            "application/json": {
                                "schema": {
                                    "type": "boolean"
                                }
                            }
                        },
                        "description": "OK"
                    }
                },
                "tags": [
                    "Update"
                ]
            }
        },
        "/Api/Update/Check": {
            "get": {
                "summary": "Check for a New Version",
                "description": "Checks with data gateway and compares the reported version to the version that is locally installed. If there is a difference, a new update is marked as available. Always returns the latest version available on data gateway, even if that version is installed locally.\n\nThis endpoint requires the `Update.Read`, `Update.ReadWrite`, or the `Everything.ReadWrite` scope (permission).",
                "operationId": "/Api/Update/Check/Get",
                "responses": {
                    "200": {
                        "content": {
                            "application/json": {
                                "schema": {
                                    "properties": {
                                        "appVersion": {
                                            "description": "Follows symantec versioning as laid out here: https://semver.org/. This number is the version of the application package.",
                                            "example": "1.2.3",
                                            "type": "string"
                                        }
                                    },
                                    "type": "object"
                                }
                            }
                        },
                        "description": "OK"
                    }
                },
                "tags": [
                    "Update"
                ]
            }
        },
        "/Api/Update/Check/Channel/{Update Channel Name}": {
            "get": {
                "summary": "Check for a New Version in Channel",
                "description": "Checks with the SHI Data Gateway in the specified update channel and compares the reported version to the version that is locally installed. If there is a difference, a new update is marked as available. Always returns the latest version available on data gateway, even if that version is installed locally.\n\nThis endpoint requires the `Update.Read`, `Update.ReadWrite`, or the `Everything.ReadWrite` scope (permission).",
                "operationId": "/Api/Update/Check/Channel/UpdateChannelName/Get",
                "parameters": [
                    {
                        "$ref": "#/components/parameters/updateChannelName"
                    }
                ],
                "responses": {
                    "200": {
                        "content": {
                            "application/json": {
                                "schema": {
                                    "properties": {
                                        "appVersion": {
                                            "description": "Follows symantec versioning as laid out here: https://semver.org/. This number is the version of the application package.",
                                            "example": "1.2.3",
                                            "type": "string"
                                        }
                                    },
                                    "type": "object"
                                }
                            }
                        },
                        "description": "OK"
                    }
                },
                "tags": [
                    "Update"
                ]
            }
        },
        "/Api/Update/Install": {
            "post": {
                "summary": "Installs SHIELD Core Update",
                "description": "Installs the latest version that is available from SHI Data Gateway. Even if that version is the same that is installed.\n\nThis endpoint requires the `Update.ReadWrite`, or the `Everything.ReadWrite` scope (permission).",
                "operationId": "/Api/Update/Install/Post",
                "responses": {
                    "204": {
                        "description": "OK: Update Submitted to Azure"
                    }
                },
                "tags": [
                    "Update"
                ]
            }
        },
        "/Api/Update/Install/Channel/{Update Channel Name}": {
            "post": {
                "summary": "Installs SHIELD Core Update from Channel",
                "description": "Installs the latest version that is available from SHI Data Gateway in the specified channel. Even if that version is the same that is installed.\n\nThis endpoint requires the `Update.ReadWrite`, or the `Everything.ReadWrite` scope (permission).",
                "operationId": "/Api/Update/Install/Channel/UpdateChannelName/Post",
                "parameters": [
                    {
                        "$ref": "#/components/parameters/updateChannelName"
                    }
                ],
                "responses": {
                    "204": {
                        "description": "OK: Update Submitted to Azure"
                    }
                },
                "tags": [
                    "Update"
                ]
            }
        },
        "/Api/Update/Upload": {
            "post": {
                "summary": "Upload Custom Update Package",
                "description": "THIS API SHOULD ONLY BE USED IF INSTRUCTED BY SHI EMPLOYEES!\n\nUploads the specified ZIP package, validates signature and installs it if it matches. This ignores version numbers and will allow you to install the same version again if necessary.\n\nThis endpoint requires the `Update.ReadWrite`, or the `Everything.ReadWrite` scope (permission).",
                "operationId": "/Api/Update/Upload/Post",
                "requestBody": {
                    "content": {
                        "application/octet-stream": {
                            "schema": {
                                "type": "string",
                                "format": "binary"
                            }
                        }
                    }
                },
                "responses": {
                    "204": {
                        "description": "OK: Update Submitted to Azure"
                    }
                },
                "tags": [
                    "Update"
                ]
            }
        },
        "/Api/Discover/Status": {
            "get": {
                "summary": "State of the Discover Module.",
                "description": "Provides a detailed breakdown of the current state of the discover module and it progress.\n\nThis endpoint requires the `Discover.Read`, or the `Everything.ReadWrite` scope (permission).",
                "operationId": "/Api/Discover/Status/Get",
                "responses": {
                    "200": {
                        "content": {
                            "application/json": {
                                "schema": {
                                    "$ref": "#/components/schemas/Discover.ExecutionStatus"
                                }
                            }
                        },
                        "description": "OK"
                    }
                },
                "tags": [
                    "Discover"
                ]
            }
        },
        "/Api/Discover/Report": {
            "get": {
                "summary": "Start Discover's Report Generation",
                "description": "Starts the Discover module's report collection engine to create a license report and upload it to the data gateway.\n\nThis endpoint requires the `Discover.Action.Run`, or the `Everything.ReadWrite` scope (permission).",
                "operationId": "/Api/Discover/Report/Start",
                "responses": {
                    "202": {
                        "$ref": "#/components/responses/202"
                    },
                    "409": {
                        "$ref": "#/components/responses/409"
                    }
                },
                "tags": [
                    "Discover"
                ]
            }
        },
        "/Api/Discover/LicenseReport/Correlation": {
            "get": {
                "description": "Retrieves the list of correlation records for the authenticated tenant. Correlation records store the metadata for a specific license report.\n\nThis endpoint requires the `Discover.Read`, or the `Everything.ReadWrite` scope (permission).",
                "operationId": "/Api/Discover/LicenseReport/Correlation/Get",
                "responses": {
                    "200": {
                        "content": {
                            "application/json": {
                                "examples": {
                                    "Example License Report": {
                                        "description": "Sample list of correlation records for the authenticated tenant.",
                                        "summary": "Available Correlation Records",
                                        "value": [
                                            {
                                                "auditTenantAccount": "somebodyThatI@example.com",
                                                "correlationId": "6d7c9271-9e68-4bdf-9ae3-f90c4213f74b",
                                                "reportTenantAccount": "usedToKnow@example.com",
                                                "tenantId": "3d6e7b7e-8d9a-4eb0-8753-67829b3934db",
                                                "createdAt": "2024-08-01T21:14:45.026Z",
                                                "updatedAt": "2024-08-01T21:14:45.026Z"
                                            },
                                            {
                                                "auditTenantAccount": "somebodyThatI@example.com",
                                                "correlationId": "d8095827-a313-40e1-b086-f72636de0edf",
                                                "reportTenantAccount": "usedToKnow@example.com",
                                                "tenantId": "3d6e7b7e-8d9a-4eb0-8753-67829b3934db",
                                                "createdAt": "2024-07-25T21:14:45.026Z",
                                                "updatedAt": "2024-07-25T21:14:45.026Z"
                                            }
                                        ]
                                    }
                                },
                                "schema": {
                                    "type": "array",
                                    "minItems": 0,
                                    "items": {
                                        "$ref": "#/components/schemas/LicenseReport.CorrelationRecord"
                                    }
                                }
                            }
                        },
                        "description": "OK"
                    },
                    "401": {
                        "$ref": "#/components/responses/401"
                    },
                    "403": {
                        "$ref": "#/components/responses/403"
                    }
                },
                "tags": [
                    "License Analytics"
                ],
                "summary": "Retrieve the List of Correlation Records"
            }
        },
        "/Api/Discover/LicenseReport/Correlation/{correlationId}/Data": {
            "get": {
                "description": "Retrieves the full license report for the specified correlation ID in the authenticated tenant. The license report contains all of the license usage and compliance information with the required correlation data.\n\nThis endpoint requires the `Discover.Read`, or the `Everything.ReadWrite` scope (permission).",
                "operationId": "/Api/Discover/LicenseReport/Correlation/:correlationId/Data/Get",
                "parameters": [
                    {
                        "$ref": "#/components/parameters/correlationId"
                    }
                ],
                "responses": {
                    "200": {
                        "content": {
                            "application/json": {
                                "examples": {
                                    "License Report": {
                                        "description": "Sample, truncated report from an example customer environment.",
                                        "summary": "License Report",
                                        "value": {
                                            "availableLicense": {
                                                "3d282045-ec7f-4813-88e2-29b74ee609f7": 123456,
                                                "5888a922-9f5b-45fd-bd5f-de3283d6a79e": 99999999,
                                                "a4b2e176-d63d-4081-9e21-226e2ac624b9": 5,
                                                "547404d4-8734-415f-a7ca-e9c1ffb95e48": 25,
                                                "d76878d6-1495-4243-a334-a82bb9818cd0": 500
                                            },
                                            "correlation": {
                                                "auditTenantAccount": "somebodyThatI@example.com",
                                                "correlationId": "6d7c9271-9e68-4bdf-9ae3-f90c4213f74b",
                                                "reportTenantAccount": "usedToKnow@example.com",
                                                "tenantId": "3d6e7b7e-8d9a-4eb0-8753-67829b3934db"
                                            },
                                            "licenseData": {
                                                "250844e1-a7ab-4f21-8e3f-58f51b5983a3": {
                                                    "assignedLicense": {
                                                        "5888a922-9f5b-45fd-bd5f-de3283d6a79e": null,
                                                        "3d282045-ec7f-4813-88e2-29b74ee609f7": null
                                                    },
                                                    "assignedService": {
                                                        "a4b2e176-d63d-4081-9e21-226e2ac624b9": null,
                                                        "d76878d6-1495-4243-a334-a82bb9818cd0": null
                                                    },
                                                    "consumedService": {
                                                        "e0d101e8-6f1e-40a9-a66f-cad4112c9a59": null,
                                                        "c63b7a2d-6573-4c37-9ca8-e12b954d3198": {
                                                            "Something Here": true,
                                                            "Other Obscure feature": false
                                                        }
                                                    }
                                                },
                                                "04e88835-771a-482b-9d6f-ba06c32cbb67": {
                                                    "assignedLicense": {
                                                        "3d282045-ec7f-4813-88e2-29b74ee609f7": null
                                                    },
                                                    "assignedService": {
                                                        "a4b2e176-d63d-4081-9e21-226e2ac624b9": null,
                                                        "d76878d6-1495-4243-a334-a82bb9818cd0": null
                                                    },
                                                    "consumedService": {
                                                        "9d3603de-b378-4c4a-adcc-ee133cbef914": null,
                                                        "e9a4e3d3-ebe0-405a-a8f4-35a04c4dba1f": {
                                                            "Something Here": true,
                                                            "Other Obscure feature": false
                                                        }
                                                    }
                                                }
                                            }
                                        }
                                    }
                                },
                                "schema": {
                                    "$ref": "#/components/schemas/LicenseReport"
                                }
                            }
                        },
                        "description": "OK"
                    },
                    "400": {
                        "$ref": "#/components/responses/400"
                    },
                    "401": {
                        "$ref": "#/components/responses/401"
                    },
                    "403": {
                        "$ref": "#/components/responses/403"
                    }
                },
                "tags": [
                    "License Analytics"
                ],
                "summary": "Retrieve the Specified License Report"
            }
        },
        "/Api/Deploy": {
            "get": {
                "description": "Has the core infrastructure engine check if the config engine can initialize properly.\n\nThis endpoint requires the `Deploy.Read`, `Deploy.ReadWrite`, or the `Everything.ReadWrite` scope (permission).",
                "operationId": "/Api/Deploy/Get",
                "responses": {
                    "200": {
                        "content": {
                            "application/json": {
                                "examples": {
                                    "infra deployed": {
                                        "description": "All API calls should be available since the core infrastructure is deployed.",
                                        "summary": "Infrastructure is deployed",
                                        "value": true
                                    },
                                    "Infra not deployed": {
                                        "description": "Infrastructure is not deployed. Please run the deployment before attempting different API calls.",
                                        "summary": "Infrastructure is not deployed",
                                        "value": false
                                    }
                                },
                                "schema": {
                                    "type": "boolean"
                                }
                            }
                        },
                        "description": "OK"
                    },
                    "401": {
                        "$ref": "#/components/responses/401"
                    }
                },
                "summary": "Get the current status of the infrastructure deployment",
                "tags": [
                    "Infrastructure Deployment"
                ]
            },
            "post": {
                "description": "After the user consents, deploy the core security groups, scope tag, configurations and metadata.\n\nThis endpoint requires the `Deploy.ReadWrite`, or the `Everything.ReadWrite` scope (permission).",
                "operationId": "/Api/Deploy/Post",
                "requestBody": {
                    "content": {
                        "application/json": {
                            "examples": {
                                "Ignorant Deploy Request": {
                                    "description": "Clueless dev trying to automate this application without reading the docs. RTFM!",
                                    "summary": "Ignorant Deploy Request",
                                    "value": {}
                                },
                                "No User Consent": {
                                    "description": "User did not agree to the terms and conditions. This post should not have been sent.",
                                    "summary": "User Did Not Consent",
                                    "value": {
                                        "deploymentConsent": false
                                    }
                                },
                                "User Consented": {
                                    "description": "User agreed to the terms and conditions and pressed the deploy button.",
                                    "summary": "User Consented",
                                    "value": {
                                        "deploymentConsent": true
                                    }
                                }
                            },
                            "schema": {
                                "properties": {
                                    "deploymentConsent": {
                                        "type": "boolean"
                                    }
                                },
                                "type": "object"
                            }
                        }
                    }
                },
                "responses": {
                    "204": {
                        "content": {
                            "application/json": {
                                "examples": {
                                    "Successful Deployment": {
                                        "description": "When a deployment request is successfully executed, a boolean true is returned.",
                                        "summary": "Successful Deployment",
                                        "value": true
                                    }
                                },
                                "schema": {
                                    "type": "boolean"
                                }
                            }
                        },
                        "description": "OK"
                    },
                    "401": {
                        "$ref": "#/components/responses/401"
                    }
                },
                "summary": "Deploy the core infrastructure architecture specification",
                "tags": [
                    "Infrastructure Deployment"
                ],
                "security": []
            }
        },
        "/Api/Deploy/Version": {
            "get": {
                "description": "Gets the version of the API server and the architecture version deployed as well as the supported version of the architecture spec from the server.\n\nThis endpoint requires the `Deploy.Read`, `Deploy.ReadWrite`, or the `Everything.ReadWrite` scope (permission).",
                "operationId": "/Api/Deploy/Version/Get",
                "responses": {
                    "200": {
                        "content": {
                            "application/json": {
                                "schema": {
                                    "properties": {
                                        "apiVersion": {
                                            "description": "Follows symantec versioning as laid out here: https://semver.org/. This number is the version of the API server.",
                                            "example": "1.2.3",
                                            "type": "string"
                                        },
                                        "archSpecVersion": {
                                            "description": "An incrementing number that describes the version of the architecture specification that the API supports.",
                                            "example": 123,
                                            "type": "number"
                                        },
                                        "deployedArchVersion": {
                                            "description": "The version of the architecture specification that is currently deployed.",
                                            "example": 25,
                                            "type": "number"
                                        }
                                    },
                                    "type": "object"
                                }
                            }
                        },
                        "description": "OK"
                    },
                    "401": {
                        "$ref": "#/components/responses/401"
                    }
                },
                "summary": "Gets the version of SHIELDs components",
                "tags": [
                    "Infrastructure Deployment"
                ]
            }
        },
        "/Api/Defend/Intermediary/Type/{securityClass}/Offering/8a921026-ec06-4e08-af19-8812e161e61f": {
            "get": {
                "description": "Retrieves a list of all AVD intermediaries for the specified security class filter. Next links may be provided for pagination to allow for good performance on larger environments. If a nextLink is return, not all data was returned on this query and the next link can be sent back to the API to get the next page of data.\n\nThis endpoint requires the `Intermediary.Privileged.Read`, `Intermediary.Privileged.ReadWrite`, `Intermediary.Specialized.Read`, `Intermediary.Specialized.ReadWrite`, `Intermediary.Enterprise.ReadWrite`, `Intermediary.Enterprise.Read`, or the `Everything.ReadWrite` scope (permission). The security class parameter in the URL path corresponds to the same permission in the scope. That means if you are granted a privileged role, you can only call the privilege class URL.",
                "operationId": "/Api/Defend/Intermediary/Type/:securityClass/Offering/AVD/Get",
                "parameters": [
                    {
                        "$ref": "#/components/parameters/securityClass"
                    },
                    {
                        "$ref": "#/components/parameters/nextLink"
                    },
                    {
                        "$ref": "#/components/parameters/search"
                    }
                ],
                "responses": {
                    "200": {
                        "content": {
                            "application/json": {
                                "schema": {
                                    "$ref": "#/components/schemas/ObjectPage.Intermediary.Avd"
                                }
                            }
                        },
                        "description": "OK"
                    },
                    "401": {
                        "$ref": "#/components/responses/401"
                    },
                    "525": {
                        "$ref": "#/components/responses/525"
                    }
                },
                "summary": "Retrieves all AVD Intermediary Instances",
                "tags": [
                    "Intermediary"
                ]
            }
        },
        "/Api/Defend/Intermediary/{intermediaryId}/Type/{securityClass}/Offering/8a921026-ec06-4e08-af19-8812e161e61f": {
            "delete": {
                "description": "Deletes the specified intermediary (by the parent group's Entra ID Object ID) using the requested security class as a filter.\n\nThis endpoint requires the `Intermediary.Privileged.ReadWrite`, `Intermediary.Specialized.ReadWrite`, `Intermediary.Enterprise.ReadWrite`, or the `Everything.ReadWrite` scope (permission). The security class parameter in the URL path corresponds to the same permission in the scope. That means if you are granted a privileged role, you can only call the privilege class URL.",
                "operationId": "/Api/Defend/Intermediary/:intermediaryId/Type/:securityClass/Offering/AVD/Delete",
                "parameters": [
                    {
                        "$ref": "#/components/parameters/securityClass"
                    },
                    {
                        "$ref": "#/components/parameters/intermediaryId"
                    }
                ],
                "responses": {
                    "204": {
                        "description": "OK: Deleted successfully"
                    },
                    "401": {
                        "$ref": "#/components/responses/401"
                    },
                    "404": {
                        "$ref": "#/components/responses/404"
                    },
                    "525": {
                        "$ref": "#/components/responses/525"
                    }
                },
                "summary": "Deletes a Single AVD Intermediary Instance",
                "tags": [
                    "Intermediary"
                ]
            },
            "get": {
                "description": "Retrieves the specified intermediary (by the parent group's Entra ID Object ID) using the requested security class as a filter.\n\nThis endpoint requires the `Intermediary.Privileged.Read`, `Intermediary.Privileged.ReadWrite`, `Intermediary.Specialized.Read`, `Intermediary.Specialized.ReadWrite`, `Intermediary.Enterprise.ReadWrite`, `Intermediary.Enterprise.Read`, or the `Everything.ReadWrite` scope (permission). The security class parameter in the URL path corresponds to the same permission in the scope. That means if you are granted a privileged role, you can only call the privilege class URL.",
                "operationId": "/Api/Defend/Intermediary/:intermediaryId/Type/:securityClass/Offering/AVD/Get",
                "parameters": [
                    {
                        "$ref": "#/components/parameters/securityClass"
                    },
                    {
                        "$ref": "#/components/parameters/intermediaryId"
                    }
                ],
                "responses": {
                    "200": {
                        "content": {
                            "application/json": {
                                "schema": {
                                    "$ref": "#/components/schemas/ObjectPage.Intermediary.Avd"
                                }
                            }
                        },
                        "description": "OK"
                    },
                    "401": {
                        "$ref": "#/components/responses/401"
                    },
                    "404": {
                        "$ref": "#/components/responses/404"
                    },
                    "525": {
                        "$ref": "#/components/responses/525"
                    }
                },
                "summary": "Retrieves a Single AVD Intermediary Instance",
                "tags": [
                    "Intermediary"
                ]
            }
        },
        "/Api/Defend/Intermediary/{intermediaryId}/Type/{securityClass}/Offering/8a921026-ec06-4e08-af19-8812e161e61f/Assign": {
            "delete": {
                "description": "Removes the specified user(s) as identified by their Object ID from the AVD cluster and deletes their corresponding session host(s).\n\nThis endpoint requires the `Intermediary.Privileged.ReadWrite`, `Intermediary.Specialized.ReadWrite`, `Intermediary.Enterprise.ReadWrite`, or the `Everything.ReadWrite` scope (permission). The security class parameter in the URL path corresponds to the same permission in the scope. That means if you are granted a privileged role, you can only call the privilege class URL.",
                "operationId": "/Api/Defend/Intermediary/:intermediaryId/Type/:securityClass/Offering/AVD/Assign/Delete",
                "parameters": [
                    {
                        "$ref": "#/components/parameters/securityClass"
                    },
                    {
                        "$ref": "#/components/parameters/intermediaryId"
                    }
                ],
                "requestBody": {
                    "content": {
                        "application/json": {
                            "examples": {
                                "One user": {
                                    "description": "Removes 1 session host, and removed the requested user from the assignments security group.",
                                    "summary": "Remove Single User",
                                    "value": {
                                        "userList": [
                                            "cf5b12a9-b939-4d5c-a380-fb62e4fe88ef"
                                        ]
                                    }
                                },
                                "Two users": {
                                    "description": "Removes 3 session hosts, and removed the requested users from the assignments security group.",
                                    "summary": "Remove Multiple Users",
                                    "value": {
                                        "userList": [
                                            "0c56b055-9042-4f54-8e6e-6510e12a81dc",
                                            "dd27937c-6287-45b3-98de-387725b068f3",
                                            "989d3dc1-43f4-4ff7-82ba-43661f94a428"
                                        ]
                                    }
                                }
                            },
                            "schema": {
                                "properties": {
                                    "userList": {
                                        "items": {
                                            "format": "uuid",
                                            "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-5][0-9a-f]{3}-[089ab][0-9a-f]{3}-[0-9a-f]{12}$",
                                            "type": "string"
                                        },
                                        "type": "array"
                                    }
                                },
                                "type": "object"
                            }
                        }
                    }
                },
                "responses": {
                    "204": {
                        "description": "OK: Deleted successfully"
                    },
                    "401": {
                        "$ref": "#/components/responses/401"
                    },
                    "404": {
                        "$ref": "#/components/responses/404"
                    },
                    "525": {
                        "$ref": "#/components/responses/525"
                    }
                },
                "summary": "Removes the assignment of the specified users",
                "tags": [
                    "Intermediary"
                ]
            },
            "get": {
                "description": "Gets the list of assigned user from the specified AVD Intermediary.\n\nThis endpoint requires the `Intermediary.Privileged.Read`, `Intermediary.Privileged.ReadWrite`, `Intermediary.Specialized.Read`, `Intermediary.Specialized.ReadWrite`, `Intermediary.Enterprise.ReadWrite`, `Intermediary.Enterprise.Read`, or the `Everything.ReadWrite` scope (permission). The security class parameter in the URL path corresponds to the same permission in the scope. That means if you are granted a privileged role, you can only call the privilege class URL.",
                "operationId": "/Api/Defend/Intermediary/:intermediaryId/Type/:securityClass/Offering/AVD/Assign/Get",
                "parameters": [
                    {
                        "$ref": "#/components/parameters/securityClass"
                    },
                    {
                        "$ref": "#/components/parameters/intermediaryId"
                    },
                    {
                        "$ref": "#/components/parameters/nextLink"
                    }
                ],
                "responses": {
                    "200": {
                        "content": {
                            "application/json": {
                                "schema": {
                                    "$ref": "#/components/schemas/ObjectPage.ManagedUser"
                                }
                            }
                        },
                        "description": "OK"
                    },
                    "401": {
                        "$ref": "#/components/responses/401"
                    },
                    "404": {
                        "$ref": "#/components/responses/404"
                    },
                    "525": {
                        "$ref": "#/components/responses/525"
                    }
                },
                "summary": "List all assigned users (paginated)",
                "tags": [
                    "Intermediary"
                ]
            },
            "post": {
                "description": "Assigns the specified user(s) as identified by their Object ID to the AVD cluster and create corresponding session host(s) for them.\n\nThis endpoint requires the `Intermediary.Privileged.ReadWrite`, `Intermediary.Specialized.ReadWrite`, `Intermediary.Enterprise.ReadWrite`, or the `Everything.ReadWrite` scope (permission). The security class parameter in the URL path corresponds to the same permission in the scope. That means if you are granted a privileged role, you can only call the privilege class URL.",
                "operationId": "/Api/Defend/Intermediary/:intermediaryId/Type/:securityClass/Offering/AVD/Assign/Post",
                "parameters": [
                    {
                        "$ref": "#/components/parameters/securityClass"
                    },
                    {
                        "$ref": "#/components/parameters/intermediaryId"
                    }
                ],
                "requestBody": {
                    "content": {
                        "application/json": {
                            "examples": {
                                "One user": {
                                    "description": "Creates 1 session host, and added the requested user to the assignments security group.",
                                    "summary": "Assign Single User",
                                    "value": {
                                        "userList": [
                                            "cf5b12a9-b939-4d5c-a380-fb62e4fe88ef"
                                        ]
                                    }
                                },
                                "Two users": {
                                    "description": "Creates 3 session hosts, and added the requested users to the assignments security group.",
                                    "summary": "Assign Multiple Users",
                                    "value": {
                                        "userList": [
                                            "0c56b055-9042-4f54-8e6e-6510e12a81dc",
                                            "dd27937c-6287-45b3-98de-387725b068f3",
                                            "989d3dc1-43f4-4ff7-82ba-43661f94a428"
                                        ]
                                    }
                                }
                            },
                            "schema": {
                                "properties": {
                                    "userList": {
                                        "items": {
                                            "format": "uuid",
                                            "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-5][0-9a-f]{3}-[089ab][0-9a-f]{3}-[0-9a-f]{12}$",
                                            "type": "string"
                                        },
                                        "type": "array"
                                    }
                                },
                                "type": "object"
                            }
                        }
                    }
                },
                "responses": {
                    "200": {
                        "content": {
                            "application/json": {
                                "schema": {
                                    "items": {
                                        "$ref": "#/components/schemas/ManagedObject.User"
                                    },
                                    "minItems": 0,
                                    "type": "array"
                                }
                            }
                        },
                        "description": "OK"
                    },
                    "401": {
                        "$ref": "#/components/responses/401"
                    },
                    "404": {
                        "$ref": "#/components/responses/404"
                    },
                    "525": {
                        "$ref": "#/components/responses/525"
                    }
                },
                "summary": "Assigns the list of specified users",
                "tags": [
                    "Intermediary"
                ]
            }
        },
        "/Api/Defend/Intermediary/{intermediaryId}/Type/{securityClass}/Offering/8a921026-ec06-4e08-af19-8812e161e61f/Assign/{userId}": {
            "get": {
                "description": "Get the specified managed user's from the specified AVD intermediary assignment list.\n\nThis endpoint requires the `Intermediary.Privileged.Read`, `Intermediary.Privileged.ReadWrite`, `Intermediary.Specialized.Read`, `Intermediary.Specialized.ReadWrite`, `Intermediary.Enterprise.ReadWrite`, `Intermediary.Enterprise.Read`, or the `Everything.ReadWrite` scope (permission). The security class parameter in the URL path corresponds to the same permission in the scope. That means if you are granted a privileged role, you can only call the privilege class URL.",
                "operationId": "/Api/Defend/Intermediary/:intermediaryId/Type/:securityClass/Offering/AVD/Assign/:userId/Get",
                "parameters": [
                    {
                        "$ref": "#/components/parameters/securityClass"
                    },
                    {
                        "$ref": "#/components/parameters/intermediaryId"
                    },
                    {
                        "$ref": "#/components/parameters/userId"
                    }
                ],
                "responses": {
                    "200": {
                        "content": {
                            "application/json": {
                                "schema": {
                                    "$ref": "#/components/schemas/ObjectPage.ManagedUser"
                                }
                            }
                        },
                        "description": "OK"
                    },
                    "401": {
                        "$ref": "#/components/responses/401"
                    },
                    "404": {
                        "$ref": "#/components/responses/404"
                    },
                    "525": {
                        "$ref": "#/components/responses/525"
                    }
                },
                "summary": "Get a specific assigned user",
                "tags": [
                    "Intermediary"
                ]
            }
        },
        "/Api/Defend/Device/{deviceId}/Type/Privileged/Assign": {
            "delete": {
                "description": "Remove the specified user list from the device.\n\nThis endpoint requires the `Device.Privileged.ReadWrite`, or the `Everything.ReadWrite` scope (permission).",
                "operationId": "/Api/Defend/Device/:deviceId/Type/Privileged/Assign/Delete",
                "parameters": [
                    {
                        "$ref": "#/components/parameters/deviceId"
                    }
                ],
                "requestBody": {
                    "content": {
                        "application/json": {
                            "examples": {
                                "Multiple Users": {
                                    "description": "Remove multiple user assignments from a managed device.",
                                    "summary": "Unassign multiple users",
                                    "value": {
                                        "userList": [
                                            "0674276a-31e8-4773-8ed9-6fb49dbd0fa8",
                                            "66714224-b1a6-4fd6-b9d8-5263fdf755fc"
                                        ]
                                    }
                                },
                                "Single User": {
                                    "description": "Remove a single user assignment from a managed device.",
                                    "summary": "Unassign one user",
                                    "value": {
                                        "userList": [
                                            "01ebf268-cf28-4607-954a-261dfd480453"
                                        ]
                                    }
                                }
                            },
                            "schema": {
                                "properties": {
                                    "userList": {
                                        "items": {
                                            "example": "d1bc9d1a-5a30-4d66-898a-1dd300e707bc",
                                            "format": "uuid",
                                            "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-5][0-9a-f]{3}-[089ab][0-9a-f]{3}-[0-9a-f]{12}$",
                                            "type": "string"
                                        },
                                        "type": "array"
                                    }
                                },
                                "type": "object"
                            }
                        }
                    }
                },
                "responses": {
                    "200": {
                        "content": {
                            "application/json": {
                                "schema": {
                                    "items": {
                                        "$ref": "#/components/schemas/ManagedObject.User"
                                    },
                                    "minItems": 0,
                                    "type": "array"
                                }
                            }
                        },
                        "description": "OK"
                    },
                    "401": {
                        "$ref": "#/components/responses/401"
                    },
                    "525": {
                        "$ref": "#/components/responses/525"
                    }
                },
                "summary": "Remove User Assignments",
                "tags": [
                    "Device Management"
                ]
            },
            "get": {
                "description": "Lists all of the users that are currently assigned to the specified device.\n\nThis endpoint requires the `Device.Privileged.Read`, `Device.Privileged.ReadWrite`, or the `Everything.ReadWrite` scope (permission).",
                "operationId": "/Api/Defend/Device/:deviceId/Type/Privileged/Assign/Get",
                "parameters": [
                    {
                        "$ref": "#/components/parameters/deviceId"
                    }
                ],
                "responses": {
                    "200": {
                        "content": {
                            "application/json": {
                                "schema": {
                                    "$ref": "#/components/schemas/ObjectPage.ManagedUser"
                                }
                            }
                        },
                        "description": "OK"
                    },
                    "401": {
                        "$ref": "#/components/responses/401"
                    },
                    "525": {
                        "$ref": "#/components/responses/525"
                    }
                },
                "summary": "List User Assignments",
                "tags": [
                    "Device Management"
                ]
            },
            "post": {
                "description": "Adds the specified list of users to the list of users that are allowed to log in on the specific privileged device.\n\nThis endpoint requires the `Device.Privileged.ReadWrite`, or the `Everything.ReadWrite` scope (permission).",
                "operationId": "/Api/Defend/Device/:deviceId/Type/Privileged/Assign/Post",
                "parameters": [
                    {
                        "$ref": "#/components/parameters/deviceId"
                    }
                ],
                "requestBody": {
                    "content": {
                        "application/json": {
                            "examples": {
                                "1:1 map": {
                                    "description": "This example is the security best practice of having only one user mapped to a managed device.",
                                    "summary": "1:1 User Mapping",
                                    "value": {
                                        "userList": [
                                            "user@contoso.com"
                                        ]
                                    }
                                },
                                "Multi-User Managed Device": {
                                    "description": "This example is the security best practice of having only one user mapped to a managed device.",
                                    "summary": "Multi-User Assignment",
                                    "value": {
                                        "userList": [
                                            "user@contoso.com",
                                            "anotherUser@contoso.com"
                                        ]
                                    }
                                }
                            },
                            "schema": {
                                "properties": {
                                    "userList": {
                                        "items": {
                                            "example": "d1bc9d1a-5a30-4d66-898a-1dd300e707bc",
                                            "format": "uuid",
                                            "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-5][0-9a-f]{3}-[089ab][0-9a-f]{3}-[0-9a-f]{12}$",
                                            "type": "string"
                                        },
                                        "type": "array"
                                    }
                                },
                                "type": "object"
                            }
                        }
                    }
                },
                "responses": {
                    "200": {
                        "content": {
                            "application/json": {
                                "schema": {
                                    "items": {
                                        "$ref": "#/components/schemas/ManagedObject.User"
                                    },
                                    "minItems": 0,
                                    "type": "array"
                                }
                            }
                        },
                        "description": "OK"
                    },
                    "401": {
                        "$ref": "#/components/responses/401"
                    },
                    "525": {
                        "$ref": "#/components/responses/525"
                    }
                },
                "summary": "Add User Assignments",
                "tags": [
                    "Device Management"
                ]
            }
        },
        "/Api/Defend/Device/Type/{securityClass}": {
            "get": {
                "description": "Returns a list of all devices managed or unmanaged.\n\nThis endpoint requires the `Device.Privileged.Read`, `Device.Privileged.ReadWrite`, `Device.Specialized.Read`, `Device.Specialized.ReadWrite`, `Device.Enterprise.ReadWrite`, `Device.Enterprise.Read`, or the `Everything.ReadWrite` scope (permission). The security class parameter in the URL path corresponds to the same permission in the scope. That means if you are granted a privileged role, you can only call the privilege class URL. When reading the `unmanaged` objects, any security class permission can read them, no need for a specific `unmanaged` class assignment.",
                "operationId": "/Api/Defend/Device/Type/:securityClass/Get",
                "parameters": [
                    {
                        "$ref": "#/components/parameters/securityClass"
                    },
                    {
                        "$ref": "#/components/parameters/nextLink"
                    },
                    {
                        "$ref": "#/components/parameters/search"
                    }
                ],
                "responses": {
                    "200": {
                        "content": {
                            "application/json": {
                                "schema": {
                                    "$ref": "#/components/schemas/ObjectPage.ManagedDevice"
                                }
                            }
                        },
                        "description": "OK"
                    },
                    "401": {
                        "$ref": "#/components/responses/401"
                    },
                    "525": {
                        "$ref": "#/components/responses/525"
                    }
                },
                "summary": "Get All Devices",
                "tags": [
                    "Device Management"
                ]
            },
            "post": {
                "description": "Commissions a new device, into the device hierarchy and appends appropriate metadata and initial policies. Appends required metadata to proper locations.\n\nThis endpoint requires the `Device.Privileged.ReadWrite`, `Device.Specialized.ReadWrite`, `Device.Enterprise.ReadWrite`, or the `Everything.ReadWrite` scope (permission). The security class parameter in the URL path corresponds to the same permission in the scope. That means if you are granted a privileged role, you can only call the privilege class URL.",
                "operationId": "/Api/Defend/Device/Type/:securityClass/Post",
                "parameters": [
                    {
                        "$ref": "#/components/parameters/securityClass"
                    }
                ],
                "requestBody": {
                    "content": {
                        "application/json": {
                            "example": {
                                "deviceId": "f7e1a66f-ce2e-4351-83df-2776813ef95d"
                            },
                            "schema": {
                                "properties": {
                                    "deviceId": {
                                        "description": "The SHIELD ID (Entra ID Device ID) of the device to target.",
                                        "example": "75da7fa4-4a04-44c8-8f2c-c1b2fa29aa51",
                                        "format": "uuid",
                                        "maxLength": 36,
                                        "minLength": 36,
                                        "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-5][0-9a-f]{3}-[089ab][0-9a-f]{3}-[0-9a-f]{12}$",
                                        "type": "string"
                                    }
                                },
                                "required": [
                                    "deviceId"
                                ],
                                "type": "object"
                            }
                        }
                    }
                },
                "responses": {
                    "200": {
                        "content": {
                            "application/json": {
                                "schema": {
                                    "$ref": "#/components/schemas/ManagedObject.Device"
                                }
                            }
                        },
                        "description": "OK"
                    },
                    "401": {
                        "$ref": "#/components/responses/401"
                    },
                    "404": {
                        "$ref": "#/components/responses/404"
                    },
                    "525": {
                        "$ref": "#/components/responses/525"
                    }
                },
                "summary": "Commission a New Device",
                "tags": [
                    "Device Management"
                ]
            }
        },
        "/Api/Defend/Device/{deviceId}/Type/{securityClass}": {
            "delete": {
                "description": "Removes the device from the management hierarchy, removes metadata tagging and issues the wipe command to the devices.\n\nThis endpoint requires the `Device.Privileged.ReadWrite`, `Device.Specialized.ReadWrite`, `Device.Enterprise.ReadWrite`, or the `Everything.ReadWrite` scope (permission). The security class parameter in the URL path corresponds to the same permission in the scope. That means if you are granted a privileged role, you can only call the privilege class URL.",
                "operationId": "/Api/Defend/Device/:deviceId/Type/:securityClass/Delete",
                "parameters": [
                    {
                        "$ref": "#/components/parameters/securityClass"
                    },
                    {
                        "$ref": "#/components/parameters/deviceId"
                    }
                ],
                "responses": {
                    "204": {
                        "description": "OK: Deleted successfully"
                    },
                    "401": {
                        "$ref": "#/components/responses/401"
                    },
                    "404": {
                        "$ref": "#/components/responses/404"
                    },
                    "525": {
                        "$ref": "#/components/responses/525"
                    }
                },
                "summary": "Decommission Specified Device",
                "tags": [
                    "Device Management"
                ]
            },
            "get": {
                "description": "Get the specified managed device by its Entra ID Device ID.\n\nThis endpoint requires the `Device.Privileged.Read`, `Device.Privileged.ReadWrite`, `Device.Specialized.Read`, `Device.Specialized.ReadWrite`, `Device.Enterprise.ReadWrite`, `Device.Enterprise.Read`, or the `Everything.ReadWrite` scope (permission). The security class parameter in the URL path corresponds to the same permission in the scope. That means if you are granted a privileged role, you can only call the privilege class URL.",
                "operationId": "/Api/Defend/Device/:deviceId/Type/:securityClass/Get",
                "parameters": [
                    {
                        "$ref": "#/components/parameters/securityClass"
                    },
                    {
                        "$ref": "#/components/parameters/deviceId"
                    }
                ],
                "responses": {
                    "200": {
                        "content": {
                            "application/json": {
                                "schema": {
                                    "$ref": "#/components/schemas/ManagedObject.Device"
                                }
                            }
                        },
                        "description": "OK"
                    },
                    "401": {
                        "$ref": "#/components/responses/401"
                    },
                    "404": {
                        "$ref": "#/components/responses/404"
                    },
                    "525": {
                        "$ref": "#/components/responses/525"
                    }
                },
                "summary": "Get Specified Device by ID",
                "tags": [
                    "Device Management"
                ]
            }
        },
        "/Api/Defend/User/Type/{securityClass}": {
            "get": {
                "description": "Returns a list of all devices managed or unmanaged.\n\nThis endpoint requires the `User.Privileged.Read`, `User.Privileged.ReadWrite`, `User.Specialized.Read`, `User.Specialized.ReadWrite`, `User.Enterprise.ReadWrite`, `User.Enterprise.Read`, or the `Everything.ReadWrite` scope (permission). The security class parameter in the URL path corresponds to the same permission in the scope. That means if you are granted a privileged role, you can only call the privilege class URL. When reading the `unmanaged` objects, any security class permission can read them, no need for a specific `unmanaged` class assignment.",
                "operationId": "/Api/Defend/User/Type/:securityClass/Get",
                "parameters": [
                    {
                        "$ref": "#/components/parameters/securityClass"
                    },
                    {
                        "$ref": "#/components/parameters/nextLink"
                    },
                    {
                        "$ref": "#/components/parameters/search"
                    }
                ],
                "responses": {
                    "200": {
                        "content": {
                            "application/json": {
                                "schema": {
                                    "$ref": "#/components/schemas/ObjectPage.ManagedUser"
                                }
                            }
                        },
                        "description": "OK"
                    },
                    "401": {
                        "$ref": "#/components/responses/401"
                    },
                    "525": {
                        "$ref": "#/components/responses/525"
                    }
                },
                "summary": "Get All Users",
                "tags": [
                    "User Management"
                ]
            },
            "post": {
                "description": "For Specialized or Enterprise, adds existing user into management. For Privileged, securely clones the specified user's properties into a new managed user object in the privileged baselines.\n\nThis endpoint requires the `User.Privileged.ReadWrite`, `User.Specialized.ReadWrite`, `User.Enterprise.ReadWrite`, or the `Everything.ReadWrite` scope (permission). The security class parameter in the URL path corresponds to the same permission in the scope. That means if you are granted a privileged role, you can only call the privilege class URL.",
                "operationId": "/Api/Defend/User/Type/:securityClass/Post",
                "parameters": [
                    {
                        "$ref": "#/components/parameters/securityClass"
                    }
                ],
                "requestBody": {
                    "content": {
                        "application/json": {
                            "example": {
                                "userId": "d886680d-a283-4fc2-803f-370d81d62366"
                            },
                            "schema": {
                                "properties": {
                                    "userId": {
                                        "description": "The Entra ID object ID of the user to clone.",
                                        "example": "264a8bed-0714-48fd-8b9d-0e4c4715cee5",
                                        "format": "uuid",
                                        "maxLength": 36,
                                        "minLength": 36,
                                        "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-5][0-9a-f]{3}-[089ab][0-9a-f]{3}-[0-9a-f]{12}$",
                                        "type": "string"
                                    }
                                },
                                "required": [
                                    "userId"
                                ],
                                "type": "object"
                            }
                        }
                    }
                },
                "responses": {
                    "200": {
                        "content": {
                            "application/json": {
                                "schema": {
                                    "$ref": "#/components/schemas/ManagedObject.User"
                                }
                            }
                        },
                        "description": "OK"
                    },
                    "401": {
                        "$ref": "#/components/responses/401"
                    },
                    "404": {
                        "$ref": "#/components/responses/404"
                    },
                    "409": {
                        "description": "User is already managed."
                    },
                    "525": {
                        "$ref": "#/components/responses/525"
                    }
                },
                "summary": "Create/Bring User Into Management",
                "tags": [
                    "User Management"
                ]
            }
        },
        "/Api/Defend/User/{userId}/Type/{securityClass}": {
            "delete": {
                "description": "Deletes the user account and removes the management artifacts.\n\nThis endpoint requires the `User.Privileged.ReadWrite`, `User.Specialized.ReadWrite`, `User.Enterprise.ReadWrite`, or the `Everything.ReadWrite` scope (permission). The security class parameter in the URL path corresponds to the same permission in the scope. That means if you are granted a privileged role, you can only call the privilege class URL.",
                "operationId": "/Api/Defend/User/:userId/Type/:securityClass/Delete",
                "parameters": [
                    {
                        "$ref": "#/components/parameters/securityClass"
                    },
                    {
                        "$ref": "#/components/parameters/userId"
                    }
                ],
                "responses": {
                    "204": {
                        "description": "OK: Deleted successfully"
                    },
                    "401": {
                        "$ref": "#/components/responses/401"
                    },
                    "404": {
                        "$ref": "#/components/responses/404"
                    },
                    "525": {
                        "$ref": "#/components/responses/525"
                    }
                },
                "summary": "Delete Managed User by ID",
                "tags": [
                    "User Management"
                ]
            },
            "get": {
                "description": "Retrieves the specified managed user by its Entra ID User ID.\n\nThis endpoint requires the `User.Privileged.Read`, `User.Privileged.ReadWrite`, `User.Specialized.Read`, `User.Specialized.ReadWrite`, `User.Enterprise.ReadWrite`, `User.Enterprise.Read`, or the `Everything.ReadWrite` scope (permission). The security class parameter in the URL path corresponds to the same permission in the scope. That means if you are granted a privileged role, you can only call the privilege class URL.",
                "operationId": "/Api/Defend/User/:userId/Type/:securityClass/Get",
                "parameters": [
                    {
                        "$ref": "#/components/parameters/securityClass"
                    },
                    {
                        "$ref": "#/components/parameters/userId"
                    }
                ],
                "responses": {
                    "200": {
                        "content": {
                            "application/json": {
                                "schema": {
                                    "$ref": "#/components/schemas/ManagedObject.User"
                                }
                            }
                        },
                        "description": "OK"
                    },
                    "401": {
                        "$ref": "#/components/responses/401"
                    },
                    "404": {
                        "$ref": "#/components/responses/404"
                    },
                    "525": {
                        "$ref": "#/components/responses/525"
                    }
                },
                "summary": "Gets Managed User by ID",
                "tags": [
                    "User Management"
                ]
            }
        },
        "/Api/Defend/Marketplace/Type/{securityClass}/Offering/{offeringId}": {
            "post": {
                "description": "Creates the offering with the requested settings. In the body payload, the `type` property in the `property` object is ignored. See the AVD example.\n\nThis endpoint requires the `Intermediary.Privileged.ReadWrite`, `Intermediary.Specialized.ReadWrite`, `Intermediary.Enterprise.ReadWrite`, or the `Everything.ReadWrite` scope (permission). The security class parameter in the URL path corresponds to the same permission in the scope. That means if you are granted a privileged role, you can only call the privilege class URL.",
                "operationId": "/Api/Defend/Marketplace/Type/:securityClass/Offering/:offeringId/Post",
                "parameters": [
                    {
                        "$ref": "#/components/parameters/securityClass"
                    },
                    {
                        "$ref": "#/components/parameters/offeringId"
                    }
                ],
                "requestBody": {
                    "content": {
                        "application/json": {
                            "examples": {
                                "Azure Bastion": {
                                    "description": "lorem ipsum!",
                                    "summary": "Azure Bastion",
                                    "value": "lorem ipsum!"
                                },
                                "Azure Virtual Desktop": {
                                    "description": "Deploys an AVD cluster that is connected to the device configurations system in SHIELD. The type property can be omitted because it is passed via path parameter.",
                                    "summary": "Azure Virtual Desktop",
                                    "value": {
                                        "name": "Legacy Reach Back",
                                        "properties": {
                                            "addressRangeCIDR": "172.16.1.0/24",
                                            "index": 0,
                                            "location": "East US 2",
                                            "sessionHostPrefix": "Reach",
                                            "vmSku": "Standard_D2s_v5"
                                        }
                                    }
                                }
                            },
                            "schema": {
                                "allOf": [
                                    {
                                        "$ref": "#/components/schemas/ManagedObject.Intermediary"
                                    },
                                    {
                                        "properties": {
                                            "properties": {
                                                "$ref": "#/components/schemas/ManagedObject.AvdIntermediary"
                                            }
                                        },
                                        "type": "object"
                                    }
                                ]
                            }
                        }
                    }
                },
                "responses": {
                    "200": {
                        "content": {
                            "application/json": {
                                "schema": {
                                    "$ref": "#/components/schemas/ManagedObject.AvdIntermediary"
                                }
                            }
                        },
                        "description": "OK"
                    },
                    "401": {
                        "$ref": "#/components/responses/401"
                    },
                    "404": {
                        "$ref": "#/components/responses/404"
                    },
                    "525": {
                        "$ref": "#/components/responses/525"
                    }
                },
                "summary": "Deploy Marketplace Offering",
                "tags": [
                    "Marketplace"
                ]
            }
        }
    },
    "security": [
        {
            "EntraID": []
        }
    ],
    "servers": [
        {
            "description": "The service",
            "url": "/"
        }
    ],
    "tags": [
        {
            "description": "Configures the specified web server to support and process the authentication API routes.",
            "name": "Core"
        },
        {
            "description": "Used to manage UI and API authentication.",
            "name": "Authentication"
        },
        {
            "description": "License Analytics info.",
            "name": "Discover"
        },
        {
            "description": "Device lifecycle management.",
            "name": "Device Management"
        },
        {
            "description": "User lifecycle management.",
            "name": "User Management"
        },
        {
            "description": "Manages the lifecycle of the various intermediary system types.",
            "name": "Intermediary"
        },
        {
            "description": "Metadata and deployment management for market offerings. Lifecycle management is not handled in this route.",
            "name": "Marketplace"
        },
        {
            "description": "Checks the status and starts deployment of the core infrastructure.",
            "name": "Infrastructure Deployment"
        },
        {
            "description": "Manage the updates for SHIELD and the policies deployed into the managed environment.",
            "name": "Update"
        },
        {
            "description": "WARNING AUTHENTICATION IS DISABLED WHEN DEBUG MODE IS ENABLED!!! Endpoints that are exposed only in debug mode. You can use these to see as the app sees.",
            "name": "Debug Mode"
        }
    ]
}