API Spec: identify endpoints and projections that are valid only for elevated requests (ie. Collections projection for GET user-groups)

[Matte22]

The following endpoints require elevation to be used under any circumstances:

• createUser
• getUserByUserId
• updateUser
• replaceUser
• deleteUser
• createUserGroup
• patchUserGroup
• putUserGroup
• deleteUserGroup
• importBenchmark
• deleteRevisionByString
• deleteStigById
• getUsers: Requires elevation to use any projections.
• getUserGroups: Elevation required for "collections" projection.
• getUserGroup: Elevation required for "collections" projection.

---

Notes about how elevation effects other endpoints (please dont take this as 100% correct):

1. getCollections

   • "statistics" projection: Response data changes, object is the same.
   • output varies depending on elevation.

2. createCollection

   • Requires elevation if the user lacks the create_collection privilege.

3. getCollection

   • Projections whos output is affected by elevation:
     • "statistics"
     • "assets"
     • "stigs"
     • "labels"

4. updateCollection

   • Requires elevation for:
     • Modifying owner grants.
     • same rules for projections as getCollection

5. replaceCollection

   • Same elevation requirements as updateCollection.
   • same rules for projections as getCollection

6. deleteCollection

   • Elevation affects functionality in the same way as getCollection.

7. getGrantsByCollection

   • Requires elevation for users with access level < 3.

8. postGrantsByCollection

   • Requires elevation for users with access level < 3.
   • Requires elevation and level 4 access to create level 4 grants.

9. getGrantByCollectionGrant

   • Requires elevation for users with access level < 3.

10. putGrantByCollectionGrant

    • Requires elevation for users with access level < 3.
    • Requires elevation and level 4 access to modify level 4 grants.

11. deleteGrantByCollectionGrant

    • Requires elevation for users with access level < 3.
    • Requires elevation and level 4 access to remove level 4 grants.

12. getSTIGs

    • Elevation alters the output.

13. getStigById

    • Elevation alters the output.

14. getRevisionsByBenchmarkId

    • Elevation alters the output.

15. getRevisionByString

    • Elevation alters the output.

---

These endpoints specify elevate as a parameter in the OAS, but elevate is ignored in implementation. They require level 3 or 4 access though it is an option in the api:

• getCollectionMetadata
• patchCollectionMetadata
• putCollectionMetadata
• getCollectionMetadataKeys
• getCollectionMetadataValue
• putCollectionMetadataValue
• deleteCollectionMetadataKey