Description

Give basic info, can be used for healthcheck of service

Access

• No identification

Description

Give metrics informations for HTTP Api of this service

Access

• Admin
• Application
• Customer

Description

Give circuit breakers informations for downstream connections of this service

Access

• Admin
• Application
• Customer

Description

Give process metrics for this service

Access

• Admin
• Application
• Customer

Description

Give metrics informations for parsing

Access

• Admin
• Application
• Customer

Description

Give metrics information collected by alerting probes in Prometheus format.

Access

• Free

Description

Give summary of probes status

Access

• Free
• Exposed

Description

Create a new controller, and associate it to the owner customer.

Access

• Customer, with controllers creation rights
• Admin

Description

Search for controllers

Rules

If client is not admin, the search will be limited to the Controllers owned by this customer or shared with him, directly or by the team.

Access

• Admin
• Customer

Description

Get a controller's details.

Access

• Customer owning the controller
• The own controller
• Client being shared access to this controller
• Client of the team owning the controller with controllers right
• Customer application
• Admin

Description

Updates a customer. You can:

• Update controller's name
• Change sharing settings: teams, users and users rights on this controller

Rules

• Can do any change:
  • Admin
  • Client owning the controller
• Client being shared access to this controller with share rights can:
  • Add or remove users from the sharing settings
• Client being shared access to this controller with rights change rights can:
  • Change rights of users in the sharing settings

Access

• Customer owning the controller
• Client of a team having shared access to the controller
• Client being shared access to this controller with config, share or rights modification rights
• Admin

Description

Delete a controller.

• Put it to technicalStatus DELETED.

Access

• Customer owning the controller
• Client being shared access to this controller and with delete right
• Admin

Description

Create/Replace the controller API key used for controller connection to Spider.

The API key is a public/private key pair.

• The public key is stored in controller's settings.
• The private key is sent in response to this call.

Any call to this API (if authorized) will overwrite the previous API key, and the controller will not be able to use the previous one. A connected controller will be disconnected when its current JWT token will expire. The API key is taken as a configuration AT START of controllers, and need a restart to be changed.

Output

The API can supports two outputs:

• application/json:
  • Provides a file with the private key, Spider's URL, and the controller's id This file is the only expected configuration file at controller start.
• application/x-pem-file
  • Provides only the private key as a PEM file

Access

• Customer owning the controller
• Admin

Description

This endpoint is for testing purposes only:

• It allows testing the API key or the controllers API without a controller
• It generates a valid signature for the controller to call the configuration endpoint
• However, IT REQUIRES YOUR PRIVATE KEY IN INPUT
• After testing, please, reset your API key

Output

• The signature for this controller, timestamp and private API key
• A validation of this signature with the controller registered public API key

Access

• Customer owning the controller
• Admin

Description

Get the configuration of this Controller Usages:

• Called by controller at start (or before token expiration) with their API key
• Called by controllers regularly to check for configuration change
• Called by UI to get configuration

API key

The first call from controllers is made by:

• building a json payload with current time and controller id,
• then signing it with SHA256 algorithm using controller's private key

const timeStamp = moment().toISOString();
const info = {
    timeStamp,
    controllerId
};
const privKey = new NodeRSA(privatePem);
const signature = privKey.sign(Buffer.from(JSON.stringify(info)), 'base64');

• and then calling this API with specific headers:

  Spider-TimeStamp: timeStamp
  Spider-Signature: signature //base 64 encoded

Output

• The configuration
• A JWT token to use on further calls in Spider-Token header
  • If no token provided, or if called from a Customer
  • A Customer may call to get the configuration of one of its controllers and use the generated token to upload data (as on the UI)

Access

• The own controller
• Customer owning the controller
• Client being shared access to this controller
• Client of the team being shared access to this controller
• Admin

Description

Get the list of namespaces names from the cluster.

Output

• An array of string

Returns 404 if the controller is not connected.

Access

• Customer owning the controller
• Client being shared access to this controller
• Client of the team being shared access to this controller
• Admin

Description

Get the list of objects from the cluster.

Output

• An array of items

Returns 404 if the controller is not connected.

Access

• Customer owning the controller
• Client being shared access to this controller
• Client of the team being shared access to this controller
• Admin

Description

Create a new attachment, asking, by it, to spawn a Whisperer to each linked Pod

• The attachment is first saved in DB, and it will be fetched by the Controller next time with its configuration.
• Then, an attachment request is sent to the Controller for an immediate attachment (if Controller is connected)

Access

• Customer owning the controller
• Client being shared access to this controller
• Client of the team being shared access to this controller
• Admin

Description

Ask for the attachment to be terminated.

The Whisperers connected to the worload linked to this attachment will terminate the next time they check their status.

Access

• Customer owning the controller
• Client being shared access to this controller
• Client of the team being shared access to this controller
• Admin

Description

Returns the list of Whisperers that the Controller knows and manages.

Access

• Customer owning the controller
• Client being shared access to this controller
• Client of the team being shared access to this controller
• Admin

Description

Returns the list of Attachments linked to a Whisperer.

The service will calls all referenced and connected Controllers to get the status of the Whisperers.

Access

• Customer owning the controller
• Client being shared access to this controller
• Client of the team being shared access to this controller
• Admin

Description

Connects a customer and returns a JWT token

Rules

• After many unsuccessful attempts, the email will be blocked for some time.

Access

• No identification required

Description

Connects a customer using OIDC and returns a JWT token.
Takes in input the code provided by the Identity Provider and the name of the IP, as set in configuration.

Access

• No identification required

Description

Create a new customer.

Rules

• If a customer with same email already exists, creation is cancelled.
• Depending on system settings, a self created customer (no token) will be:
  • Created as Draft but checked for all fields when admin activation is required
  • Created as Active when no activation is required

Draft customer

All fields are optional at start, but checked for correctness.

• It then creates a DRAFT resource.
• To update it to ACTIVE
  • Some fields are required.
  • Use PATCH.

Active customer

To create an ACTIVE customer, all mandatory fields must be set. Status must be set as ACTIVE.

Access

Either:

• Self creation and no identification is required
• Creation by someone else:
  • An admin user or user with users creation rights
  • Only a user with rights modification rights can create a user with rights
  • Only an admin can create an admin
• Creation by a userTrainer, with trainee rights set.

Description

Search for customers.

Also available by GET method on the collection

Access

• Admin
• User with user management rights
• userTrainer (but may only search on HIS trainees)

Description

Get a customer's details.

• _password field is always stripped out.
• Deleted customers are only visible by admins.
• Depending on access rights, returns diverse representations.

Clients getting full details

• The own client
• Admins
• Clients with users administration rights

Response is:

• Full content
• Minus _* fields (password, admin...)

Clients getting system details

• Whisp application (to update linked whisperers)

Response is limited to:

• @id
• email
• rights
• whisperers

Clients getting shortened info

• Any other client

Response is limited to:

• @id
• email

Access

• Customer, expect when using public links
• Admin
• User with users management right
• User impersonating the user to open
• User with userTrainer rights opening one of its trainee
• Whisp application (to update linked whisperers)

Description

Updates a customer. You can:

• Update customer details
• Change password
• Set new rights (and admin flag)
• Change Whisperer names (for synchro)
• Change its state from DRAFT to ACTIVE

Rules

• Patch must be done with resource previous eTag

  • eTag must be given in ifMatch header (* not authorized)
  • eTag must match current eTag

• Technical fields are protected (@id, creator, dateCreated, @type)

• For a customer to change its password or email, patch operations must include previous password value inside a test operation

  • { "op":"test", "path":"_password", "value":"xxx" }

• When customer changes email:

  • If a customer with same email already exists, operation is cancelled.
  • A confirmation email challenge is sent. The account is blocked at connection until the mail is confirmed.
  • A mail is sent to old email

• When customer changes password:

  • A confirmation mail is sent

• When a customer changes from Draft to Active

  • A information mail is sent

• Customer cannot change its own Whisperers list

• Admins can:

  • Update a customer's details ONLY when DRAFT
    • Also clients with creation right
  • Update rights
    • Also clients with rights admin right
  • Reinit password without providing old one
    • Also clients with password admin right
  • Set a customer as admin
  • Change a DELETED user back to ACTIVE

• Customer details, once in ACTIVE state, can only be modified by own customer

• Whisp & Maintenance services can:

  • Update associated whisperers

• _password and _admin field cannot be removed, copied or moved

• email field cannot be removed or moved