openapi: 3.0.0
info:
  title: Firebox Management API
  description: REST API to configure and manage Fireboxes.
  version: 1.28.0
  contact:
    name: API Support
    url: https://www.watchguard.com/wgrd-support/contact-support
  termsOfService: 
    https://www.watchguard.com/help/docs/api/Content/en-US/license_agreement.html?cshid=18007
paths:
  /health:
    get:
      description: HealthCheck URL
      summary: Check API health
      tags:
        - API Health
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Health'

  /v1/configuration/{accountid}/exceptions:
    parameters:
      - $ref: '#/components/parameters/accountid'
    get:
      deprecated: true
      summary: Retrieves exceptions saved in the specified WatchGuard Cloud 
        account.
      tags:
        - Exceptions
      parameters:
        - in: query
          name: query
          schema:
            type: string
          description: Query string that specifies which exceptions to retrieve 
            from WatchGuard Cloud, written in Lucene query syntax.
          example: object:"botnet_exception" AND address.value:"www.example.com"
      responses:
        '200':
          description: A list of all exceptions.
          content:
            application/json:
              schema:
                type: array
                items:
                  anyOf:
                    - $ref: '#/components/schemas/blocked_site_exception'
                    - $ref: '#/components/schemas/botnet_exception'
                    - $ref: '#/components/schemas/file_exception'
                    - $ref: '#/components/schemas/geolocation_exception'
                    - $ref: '#/components/schemas/ips_exception'
                    - $ref: '#/components/schemas/webblocker_exception'
        '403':
          $ref: '#/components/responses/access_denied'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v2/configuration/{accountid}/exceptions:
    parameters:
      - $ref: '#/components/parameters/accountid'
    get:
      summary: Retrieves exceptions saved in the specified WatchGuard Cloud 
        account.
      tags:
        - Exceptions
      parameters:
        - $ref: '#/components/parameters/limit'
        - in: query
          name: query
          schema:
            type: string
          description: Query string that specifies which exceptions to retrieve 
            from WatchGuard Cloud, written in Lucene query syntax.
          example: object:"botnet_exception" AND address.value:"www.example.com"
        - in: query
          name: start_after
          required: false
          schema:
            type: string
          description: ID of the first exception to return in the response.
          example: bse_12345_ARBHLJ70Y78rGOIGBS
      responses:
        '200':
          description: A list of all exceptions.
          content:
            application/json:
              schema:
                type: object
                properties:
                  count:
                    type: integer
                  more:
                    type: boolean
                  objects:
                    type: array
                    items:
                      anyOf:
                        - $ref: '#/components/schemas/blocked_site_exception'
                        - $ref: '#/components/schemas/botnet_exception'
                        - $ref: '#/components/schemas/file_exception'
                        - $ref: '#/components/schemas/geolocation_exception'
                        - $ref: '#/components/schemas/ips_exception'
                        - $ref: '#/components/schemas/webblocker_exception'
                  start_after:
                    type: string
                    example: bse_12345_ARBHLJ70Y78rGOIGBS
                required: [count, objects]
        '403':
          $ref: '#/components/responses/access_denied'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/exceptions/blockedsite:
    parameters:
      - $ref: '#/components/parameters/accountid'
    get:
      deprecated: true
      summary: Retrieves blocked sites exceptions saved in the specified 
        WatchGuard Cloud account.
      tags:
        - Exceptions (Blocked Sites)
      parameters:
        - in: query
          name: query
          required: false
          schema:
            type: string
          description: Query string that specifies which blocked sites 
            exceptions to retrieve from WatchGuard Cloud, written in Lucene 
            query syntax.
          example: action:"block" AND address.type:"ipv4_range"
      responses:
        '200':
          description: A list of blocked sites exceptions.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/blocked_site_exception'
        '403':
          $ref: '#/components/responses/access_denied'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'
    post:
      summary: Creates a new blocked sites exception. The value of the action 
        parameter specifies whether the Firebox allows or blocks traffic for the
        site.
      tags:
        - Exceptions (Blocked Sites)
      requestBody:
        required: true
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/new_object_attributes'
                - $ref: '#/components/schemas/blocked_site_exception_base'
            example:
              device: 12345
              description: Block example.com
              address:
                type: fqdn
                value: example.com
              action: block
      responses:
        '201':
          description: The created blocked sites exception object.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/blocked_site_exception'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '405':
          $ref: '#/components/responses/method_denied'
        '409':
          $ref: '#/components/responses/conflict'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/exceptions/blockedsite/{objectid}:
    parameters:
      - $ref: '#/components/parameters/accountid'
    get:
      summary: Retrieves the specified blocked sites exception.
      tags:
        - Exceptions (Blocked Sites)
      parameters:
        - in: path
          name: objectid
          required: true
          schema:
            type: string
          description: ID of the blocked sites exception to retrieve.
          example: bse_12345_ARBHLJ70Y78rGOIGBS
      responses:
        '200':
          description: The specified blocked sites exception object.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/blocked_site_exception'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'
    put:
      summary: Updates the specified blocked sites exception.
      tags:
        - Exceptions (Blocked Sites)
      parameters:
        - in: path
          name: objectid
          required: true
          schema:
            type: string
          description: ID of the blocked site or blocked sites exception to 
            update in your WatchGuard Cloud account.
          example: bse_12345_ARBHLJ70Y78rGOIGBS
      requestBody:
        required: true
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/object_update_attributes'
                - $ref: '#/components/schemas/blocked_site_exception_base'
              example:
                version: 1
                description: Block example.com
                address:
                  type: fqdn
                  value: example.com
                action: block
      responses:
        '201':
          description: The updated blocked sites exception object.
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/object_metadata'
                  - $ref: '#/components/schemas/new_object_attributes'
                  - $ref: '#/components/schemas/blocked_site_exception_base'
                example:
                  id: bse_12345_ARBHLJ70Y78rGOIGBS
                  object: blockedsite_exception
                  version: 2
                  account: WGC-1-123abc456
                  created: 1579907960
                  device: 12345
                  author: testuser
                  description: Block example.com
                  address:
                    type: fqdn
                    value: example.com
                  action: block
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '409':
          $ref: '#/components/responses/conflict'
        '500':
          $ref: '#/components/responses/internal_error'
    delete:
      summary: Deletes the specified blocked sites exception.
      tags:
        - Exceptions (Blocked Sites)
      parameters:
        - in: path
          name: objectid
          required: true
          schema:
            type: string
          description: ID of the blocked sites exception to delete from your 
            WatchGuard Cloud account.
          example: bse_12345_ARBHLJ70Y78rGOIGBS
      responses:
        '201':
          description: The deleted blocked sites exception object.
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/object_metadata'
                  - $ref: '#/components/schemas/new_object_attributes'
                  - $ref: '#/components/schemas/blocked_site_exception_base'
                  - type: object
                    properties:
                      inactive:
                        type: boolean
                        description: Object is inactive.
                        example: true
                    required: [inactive]
                example:
                  id: bse_12345_ARBHLJ70Y78rGOIGBS
                  object: blockedsite_exception
                  version: 2
                  account: WGC-1-123abc456
                  created: 1579907960
                  device: 12345
                  author: testuser
                  description: Block example.com
                  address:
                    type: fqdn
                    value: example.com
                  action: block
                  inactive: true
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v2/configuration/{accountid}/exceptions/blockedsite:
    parameters:
      - $ref: '#/components/parameters/accountid'
    get:
      summary: Retrieves blocked sites exceptions saved in the specified 
        WatchGuard Cloud account.
      tags:
        - Exceptions (Blocked Sites)
      parameters:
        - $ref: '#/components/parameters/limit'
        - in: query
          name: query
          required: false
          schema:
            type: string
          description: Query string that specifies which blocked sites 
            exceptions to retrieve from WatchGuard Cloud, written in Lucene 
            query syntax.
          example: action:"block" AND address.type:"ipv4_range"
        - in: query
          name: start_after
          required: false
          schema:
            type: string
          description: ID of the first blocked sites exception to return in the 
            response.
          example: bse_12345_ARBHLJ70Y78rGOIGBS
      responses:
        '200':
          description: A list of blocked sites exceptions.
          content:
            application/json:
              schema:
                type: object
                properties:
                  count:
                    type: integer
                    example: 1
                  more:
                    type: boolean
                  objects:
                    type: array
                    items:
                      $ref: '#/components/schemas/blocked_site_exception'
                  start_after:
                    type: string
                    example: bse_12345_ARBHLJ70Y78rGOIGBS
                required: [count, objects]
        '403':
          $ref: '#/components/responses/access_denied'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/exceptions/botnet:
    parameters:
      - $ref: '#/components/parameters/accountid'
    get:
      deprecated: true
      parameters:
        - in: query
          name: query
          required: false
          schema:
            type: string
          description: Query string that specifies which botnet site exceptions 
            to retrieve from WatchGuard Cloud, written in Lucene query syntax.
          example: device:12345 AND address.type:"ipv4_range"
      summary: Retrieves botnet site exceptions saved in the specified 
        WatchGuard Cloud account.
      tags:
        - Exceptions (Botnet)
      responses:
        '200':
          description: A list of botnet site exceptions.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/botnet_exception'
        '403':
          $ref: '#/components/responses/access_denied'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'
    post:
      summary: Creates a new botnet site exception.
      tags:
        - Exceptions (Botnet)
      requestBody:
        required: true
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/new_object_attributes'
                - $ref: '#/components/schemas/botnet_exception_base'
              example:
                device: 12345
                description: Allow example.com
                address:
                  type: fqdn
                  value: example.com
      responses:
        '201':
          description: The created botnet site exception.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/botnet_exception'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '405':
          $ref: '#/components/responses/method_denied'
        '409':
          $ref: '#/components/responses/conflict'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/exceptions/botnet/{objectid}:
    parameters:
      - $ref: '#/components/parameters/accountid'
    get:
      summary: Retrieves the specified botnet site exception.
      tags:
        - Exceptions (Botnet)
      parameters:
        - in: path
          name: objectid
          required: true
          schema:
            type: string
          description: ID of the botnet site exception to retrieve.
          example: bote_12345_8LBasn0hDNXnli4V0
      responses:
        '200':
          description: The botnet site exception object.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/botnet_exception'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'
    put:
      summary: Updates the specified botnet site exception.
      tags:
        - Exceptions (Botnet)
      parameters:
        - in: path
          name: objectid
          required: true
          schema:
            type: string
          description: ID of the botnet site exception to update in your 
            WatchGuard Cloud account.
          example: bote_12345_8LBasn0hDNXnli4V0
      requestBody:
        required: true
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/object_update_attributes'
                - $ref: '#/components/schemas/botnet_exception_base'
              example:
                version: 1
                description: Allow example.com
                address:
                  type: fqdn
                  value: example.com
      responses:
        '201':
          description: The updated botnet site exception object.
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/object_metadata'
                  - $ref: '#/components/schemas/new_object_attributes'
                  - $ref: '#/components/schemas/blocked_site_exception_base'
                example:
                  id: bote_12345_8LBasn0hDNXnli4V0
                  object: botnet_exception
                  version: 2
                  account: WGC-1-123abc456
                  created: 1579907960
                  device: 12345
                  author: testuser
                  description: Allow example.com
                  address:
                    type: fqdn
                    value: example.com
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '409':
          $ref: '#/components/responses/conflict'
        '500':
          $ref: '#/components/responses/internal_error'
    delete:
      summary: Deletes the specified botnet site exception.
      tags:
        - Exceptions (Botnet)
      parameters:
        - in: path
          name: objectid
          required: true
          schema:
            type: string
          description: ID of the botnet site exception to delete from your 
            WatchGuard Cloud account.
          example: bote_12345_8LBasn0hDNXnli4V0
      responses:
        '201':
          description: The deleted botnet site exception object.
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/object_metadata'
                  - $ref: '#/components/schemas/new_object_attributes'
                  - $ref: '#/components/schemas/blocked_site_exception_base'
                  - type: object
                    properties:
                      inactive:
                        type: boolean
                        description: Object is inactive.
                        example: true
                    required: [inactive]
                example:
                  id: bote_12345_8LBasn0hDNXnli4V0
                  object: botnet_exception
                  version: 2
                  account: WGC-1-123abc456
                  created: 1579907960
                  device: 12345
                  author: testuser
                  description: Allow example.com
                  address:
                    type: fqdn
                    value: example.com
                  inactive: true
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v2/configuration/{accountid}/exceptions/botnet:
    parameters:
      - $ref: '#/components/parameters/accountid'
    get:
      parameters:
        - $ref: '#/components/parameters/limit'
        - in: query
          name: query
          required: false
          schema:
            type: string
          description: Query string that specifies which botnet site exceptions 
            to retrieve from WatchGuard Cloud, written in Lucene query syntax.
          example: device:12345 AND address.type:"ipv4_range"
        - in: query
          name: start_after
          required: false
          schema:
            type: string
          description: ID of the first botnet exception to return in the 
            response.
          example: bote_12345_8LBasn0hDNXnli4V0
      summary: Retrieves botnet site exceptions saved in the specified 
        WatchGuard Cloud account.
      tags:
        - Exceptions (Botnet)
      responses:
        '200':
          description: A list of botnet site exceptions.
          content:
            application/json:
              schema:
                type: object
                properties:
                  count:
                    type: integer
                  more:
                    type: boolean
                  objects:
                    type: array
                    items:
                      $ref: '#/components/schemas/botnet_exception'
                  start_after:
                    type: string
                    example: bote_12345_8LBasn0hDNXnli4V0
                required: [count, objects]
        '403':
          $ref: '#/components/responses/access_denied'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/exceptions/file:
    parameters:
      - $ref: '#/components/parameters/accountid'
    get:
      deprecated: true
      summary: Retrieves file exceptions saved in the specified WatchGuard Cloud
        account.
      tags:
        - Exceptions (File)
      parameters:
        - in: query
          name: query
          required: false
          schema:
            type: string
          description: Query string that specifies which file exceptions to 
            retrieve from WatchGuard Cloud, written in Lucene query syntax.
          example: device:12345 AND action:"allow"
      responses:
        '200':
          description: A list of file exceptions.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/file_exception'
        '403':
          $ref: '#/components/responses/access_denied'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'
    post:
      summary: Creates a new file exception.
      tags:
        - Exceptions (File)
      requestBody:
        required: true
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/new_object_attributes'
                - $ref: '#/components/schemas/file_exception_base'
              example:
                device: 12345
                description: Allow Sales Presentation.
                md5: d2ffd57b48ee2ac34a4797ea44571a05
                action: allow
      responses:
        '201':
          description: The created file exception object.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/file_exception'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '405':
          $ref: '#/components/responses/method_denied'
        '409':
          $ref: '#/components/responses/conflict'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/exceptions/file/{objectid}:
    parameters:
      - $ref: '#/components/parameters/accountid'
    get:
      summary: Retrieves the specified file exception.
      tags:
        - Exceptions (File)
      parameters:
        - in: path
          name: objectid
          required: true
          schema:
            type: string
          description: ID of the file exception to retrieve.
          example: file_12345_UqhDVIdx8D5iwivAX
      responses:
        '200':
          description: The file exception object.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/file_exception'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'
    put:
      summary: Updates the specified file exception.
      tags:
        - Exceptions (File)
      parameters:
        - in: path
          name: objectid
          required: true
          schema:
            type: string
          description: ID of the file exception to update in your WatchGuard 
            Cloud account.
          example: file_12345_UqhDVIdx8D5iwivAX
      requestBody:
        required: true
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/object_update_attributes'
                - $ref: '#/components/schemas/file_exception_base'
              example:
                version: 1
                description: Allow Sales Presentation.
                md5: d2ffd57b48ee2ac34a4797ea44571a05
                action: allow
      responses:
        '201':
          description: The updated file exception object.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/file_exception'
              example:
                id: file_12345_UqhDVIdx8D5iwivAX
                object: file_exception
                version: 2
                account: WGC-1-123abc456
                created: 1579907960
                device: 12345
                description: Allow Sales Presentation.
                md5: d2ffd57b48ee2ac34a4797ea44571a05
                action: allow
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '409':
          $ref: '#/components/responses/conflict'
        '500':
          $ref: '#/components/responses/internal_error'
    delete:
      summary: Deletes the specified file exception.
      tags:
        - Exceptions (File)
      parameters:
        - in: path
          name: objectid
          required: true
          schema:
            type: string
          description: ID of the file exception to delete from your WatchGuard 
            Cloud account.
          example: file_12345_UqhDVIdx8D5iwivAX
      responses:
        '201':
          description: The deleted file exception object.
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/object_metadata'
                  - $ref: '#/components/schemas/new_object_attributes'
                  - $ref: '#/components/schemas/file_exception_base'
                  - type: object
                    properties:
                      inactive:
                        type: boolean
                        description: Object is inactive.
                        example: true
                    required: [inactive]
                example:
                  id: file_12345_UqhDVIdx8D5iwivAX
                  object: file_exception
                  version: 2
                  account: WGC-1-123abc456
                  created: 1579907960
                  device: 12345
                  description: Allow Sales Presentation.
                  md5: d2ffd57b48ee2ac34a4797ea44571a05
                  action: allow
                  inactive: true
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v2/configuration/{accountid}/exceptions/file:
    parameters:
      - $ref: '#/components/parameters/accountid'
    get:
      summary: Retrieves file exceptions saved in the specified WatchGuard Cloud
        account.
      tags:
        - Exceptions (File)
      parameters:
        - $ref: '#/components/parameters/limit'
        - in: query
          name: query
          required: false
          schema:
            type: string
          description: Query string that specifies which file exceptions to 
            retrieve from WatchGuard Cloud, written in Lucene query syntax.
          example: device:12345 AND action:"allow"
        - in: query
          name: start_after
          required: false
          schema:
            type: string
          description: ID of the first file exception to return in the response.
          example: file_12345_UqhDVIdx8D5iwivAX
      responses:
        '200':
          description: A list of file exceptions.
          content:
            application/json:
              schema:
                type: object
                properties:
                  count:
                    type: integer
                  more:
                    type: boolean
                  objects:
                    type: array
                    items:
                      $ref: '#/components/schemas/file_exception'
                  start_after:
                    type: string
                    example: file_12345_UqhDVIdx8D5iwivAX
                required: [count, objects]
        '403':
          $ref: '#/components/responses/access_denied'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/exceptions/geolocation:
    parameters:
      - $ref: '#/components/parameters/accountid'
    get:
      deprecated: true
      summary: Retrieves all Geolocation exceptions saved in the specified 
        WatchGuard Cloud account.
      tags:
        - Exceptions (Geolocation)
      parameters:
        - in: query
          name: query
          required: false
          schema:
            type: string
          description: Query string that specifies which Geolocation exceptions 
            to retrieve from WatchGuard Cloud, written in Lucene query syntax.
          example: device:12345 AND address.type:"ipv4_range"
      responses:
        '200':
          description: A list of geolocation exceptions.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/geolocation_exception'
        '403':
          $ref: '#/components/responses/access_denied'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'
    post:
      summary: Creates a new Geolocation exception.
      tags:
        - Exceptions (Geolocation)
      requestBody:
        required: true
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/new_object_attributes'
                - $ref: '#/components/schemas/geolocation_exception_base'
              example:
                device: 12345
                description: Allow example.com
                address:
                  type: fqdn
                  value: example.com
      responses:
        '201':
          description: The created geolocation exception object.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/geolocation_exception'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '405':
          $ref: '#/components/responses/method_denied'
        '409':
          $ref: '#/components/responses/conflict'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/exceptions/geolocation/{objectid}:
    parameters:
      - $ref: '#/components/parameters/accountid'
    get:
      summary: Retrieves the specified Geolocation exception.
      tags:
        - Exceptions (Geolocation)
      parameters:
        - in: path
          name: objectid
          required: true
          schema:
            type: string
          description: ID of the Geolocation exception to retrieve.
          example: geoe_12345_aHbWC5IuWO3qzyV2t
      responses:
        '200':
          description: The geolocation exception object.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/geolocation_exception'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'
    put:
      summary: Updates the specified Geolocation exception.
      tags:
        - Exceptions (Geolocation)
      parameters:
        - in: path
          name: objectid
          required: true
          schema:
            type: string
          description: ID of the Geolocation exception to update in your 
            WatchGuard Cloud account.
          example: geoe_12345_aHbWC5IuWO3qzyV2t
      requestBody:
        required: true
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/object_update_attributes'
                - $ref: '#/components/schemas/geolocation_exception_base'
              example:
                version: 1
                description: Allow example.com
                address:
                  type: fqdn
                  value: example.com
      responses:
        '201':
          description: The updated geolocation exception object.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/geolocation_exception'
              example:
                id: geoe_12345_aHbWC5IuWO3qzyV2t
                object: geolocation_exception
                version: 2
                account: WGC-1-123abc456
                created: 1579907960
                device: 12345
                author: testuser
                description: Allow example.com
                address:
                  type: fqdn
                  value: example.com
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '409':
          $ref: '#/components/responses/conflict'
        '500':
          $ref: '#/components/responses/internal_error'
    delete:
      summary: Deletes the specified Geolocation exception.
      tags:
        - Exceptions (Geolocation)
      parameters:
        - in: path
          name: objectid
          required: true
          schema:
            type: string
          description: ID of the Geolocation exception to delete from your 
            WatchGuard Cloud account.
          example: geoe_12345_aHbWC5IuWO3qzyV2t
      responses:
        '201':
          description: The deleted geolocation exception object.
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/object_metadata'
                  - $ref: '#/components/schemas/new_object_attributes'
                  - $ref: '#/components/schemas/geolocation_exception_base'
                  - type: object
                    properties:
                      inactive:
                        type: boolean
                        description: Object is inactive.
                        example: true
                    required: [inactive]
                example:
                  id: geoe_12345_aHbWC5IuWO3qzyV2t
                  object: geolocation_exception
                  version: 2
                  account: WGC-1-123abc456
                  created: 1579907960
                  device: 12345
                  author: testuser
                  description: Allow example.com
                  address:
                    type: fqdn
                    value: example.com
                  inactive: true
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v2/configuration/{accountid}/exceptions/geolocation:
    parameters:
      - $ref: '#/components/parameters/accountid'
    get:
      summary: Retrieves all Geolocation exceptions saved in the specified 
        WatchGuard Cloud account.
      tags:
        - Exceptions (Geolocation)
      parameters:
        - $ref: '#/components/parameters/limit'
        - in: query
          name: query
          required: false
          schema:
            type: string
          description: Query string that specifies which Geolocation exceptions 
            to retrieve from WatchGuard Cloud, written in Lucene query syntax.
          example: device:12345 AND address.type:"ipv4_range"
        - in: query
          name: start_after
          required: false
          schema:
            type: string
          description: ID of the first Geolocation exception to return in the 
            response.
          example: geoe_12345_aHbWC5IuWO3qzyV2t
      responses:
        '200':
          description: A list of Geolocation exceptions.
          content:
            application/json:
              schema:
                type: object
                properties:
                  count:
                    type: integer
                  more:
                    type: boolean
                  objects:
                    type: array
                    items:
                      $ref: '#/components/schemas/geolocation_exception'
                  start_after:
                    type: string
                    example: geoe_12345_aHbWC5IuWO3qzyV2t
                required: [count, objects]
        '403':
          $ref: '#/components/responses/access_denied'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/exceptions/ips:
    parameters:
      - $ref: '#/components/parameters/accountid'
    get:
      deprecated: true
      summary: Retrieves all IPS signature exceptions.
      tags:
        - Exceptions (Intrusion Prevention)
      parameters:
        - in: query
          name: query
          required: false
          schema:
            type: string
          description: Query string that specifies which IPS signature 
            exceptions to retrieve from WatchGuard Cloud, written in Lucene 
            query syntax.
          example: device:12345 AND signature_id:"1054265"
      responses:
        '200':
          description: A list of IPS signature exceptions.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/ips_exception'
        '403':
          $ref: '#/components/responses/access_denied'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'
    post:
      summary: Creates a new IPS signature exception.
      tags:
        - Exceptions (Intrusion Prevention)
      requestBody:
        required: true
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/new_object_attributes'
                - $ref: '#/components/schemas/ips_exception_base'
              example:
                device: 12345
                description: Drop signature 1055124
                signature_id: 1054265
                action: drop
      responses:
        '201':
          description: The created IPS signature exception object.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ips_exception'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '405':
          $ref: '#/components/responses/method_denied'
        '409':
          $ref: '#/components/responses/conflict'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/exceptions/ips/{objectid}:
    parameters:
      - $ref: '#/components/parameters/accountid'
    get:
      summary: Retrieves the specified IPS signature exception.
      tags:
        - Exceptions (Intrusion Prevention)
      parameters:
        - in: path
          name: objectid
          required: true
          schema:
            type: string
          description: ID of the IPS signature exception to retrieve.
          example: ipse_12345_eY5Jwxv1nE3Xlk3zx
      responses:
        '200':
          description: The IPS signature exception object.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ips_exception'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/bad_request'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'
    put:
      summary: Updates the specified IPS signature exception.
      tags:
        - Exceptions (Intrusion Prevention)
      parameters:
        - in: path
          name: objectid
          required: true
          schema:
            type: string
          description: ID of the IPS signature exception to update in your 
            WatchGuard Cloud account.
          example: ipse_12345_eY5Jwxv1nE3Xlk3zx
      requestBody:
        required: true
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/object_update_attributes'
                - $ref: '#/components/schemas/ips_exception_base'
              example:
                version: 1
                description: Drop signature 1055124
                signature_id: 1054265
                action: drop
      responses:
        '201':
          description: The updated IPS signature exception object.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ips_exception'
              example:
                id: ipse_12345_eY5Jwxv1nE3Xlk3zx
                object: ips_exception
                device: 12345
                version: 2
                account: WGC-1-123abc456
                created: 1579907960
                author: testuser
                description: Drop signature 1055124
                signature_id: 1054265
                action: drop
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '409':
          $ref: '#/components/responses/conflict'
        '500':
          $ref: '#/components/responses/internal_error'
    delete:
      summary: Deletes the specified IPS signature exception.
      tags:
        - Exceptions (Intrusion Prevention)
      parameters:
        - in: path
          name: objectid
          required: true
          schema:
            type: string
          description: ID of the IPS signature exception to delete from your 
            WatchGuard Cloud account.
          example: ipse_12345_eY5Jwxv1nE3Xlk3zx
      responses:
        '201':
          description: The deleted IPS signature exception object.
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/object_metadata'
                  - $ref: '#/components/schemas/new_object_attributes'
                  - $ref: '#/components/schemas/ips_exception_base'
                  - type: object
                    properties:
                      inactive:
                        type: boolean
                        description: Object is inactive.
                        example: true
                    required: [inactive]
                example:
                  id: ipse_12345_eY5Jwxv1nE3Xlk3zx
                  object: ips_exception
                  device: 12345
                  version: 2
                  account: WGC-1-123abc456
                  created: 1579907960
                  author: testuser
                  description: Drop signature 1055124
                  signature_id: 1054265
                  action: drop
                  inactive: true
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v2/configuration/{accountid}/exceptions/ips:
    parameters:
      - $ref: '#/components/parameters/accountid'
    get:
      summary: Retrieves all IPS signature exceptions.
      tags:
        - Exceptions (Intrusion Prevention)
      parameters:
        - $ref: '#/components/parameters/limit'
        - in: query
          name: query
          required: false
          schema:
            type: string
          description: Query string that specifies which IPS signature 
            exceptions to retrieve from WatchGuard Cloud, written in Lucene 
            query syntax.
          example: device:12345 AND signature_id:"1054265"
        - in: query
          name: start_after
          required: false
          schema:
            type: string
          description: ID of the first IPS signature exception to return in the 
            response.
          example: ipse_12345_eY5Jwxv1nE3Xlk3zx
      responses:
        '200':
          description: A list of IPS signature exceptions.
          content:
            application/json:
              schema:
                type: object
                properties:
                  count:
                    type: integer
                  more:
                    type: boolean
                  objects:
                    type: array
                    items:
                      $ref: '#/components/schemas/ips_exception'
                  start_after:
                    type: string
                    example: ipse_12345_eY5Jwxv1nE3Xlk3zx
                required: [count, objects]
        '403':
          $ref: '#/components/responses/access_denied'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/exceptions/webblocker:
    parameters:
      - $ref: '#/components/parameters/accountid'
    get:
      deprecated: true
      summary: Retrieves all WebBlocker exceptions.
      tags:
        - Exceptions (WebBlocker)
      parameters:
        - in: query
          name: query
          required: false
          schema:
            type: string
          description: Query string that specifies which WebBlocker exceptions 
            to retrieve from WatchGuard Cloud, written in Lucene query syntax.
          example: device:12345 AND rule_type:"string"
      responses:
        '200':
          description: A list of WebBlocker exceptions.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/webblocker_exception'
        '403':
          $ref: '#/components/responses/access_denied'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'
    post:
      summary: Creates a new WebBlocker exception.
      tags:
        - Exceptions (WebBlocker)
      requestBody:
        required: true
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/new_object_attributes'
                - $ref: '#/components/schemas/webblocker_exception_base'
              example:
                device: 12345
                name: Allow www.example.com
                rule_type: string
                rule: www.example.com/*
                action: allow
      responses:
        '201':
          description: The created WebBlocker exception object.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/webblocker_exception'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '405':
          $ref: '#/components/responses/method_denied'
        '409':
          $ref: '#/components/responses/conflict'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/exceptions/webblocker/{objectid}:
    parameters:
      - $ref: '#/components/parameters/accountid'
    get:
      summary: Retrieves the specified WebBlocker exception.
      tags:
        - Exceptions (WebBlocker)
      parameters:
        - in: path
          name: objectid
          required: true
          schema:
            type: string
          description: ID of the WebBlocker exception to retrieve.
          example: wbe_12124_7HM70EvrifZ7rSfXSA
      responses:
        '200':
          description: The WebBlocker exception object.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/webblocker_exception'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'
    put:
      summary: Updates the specified WebBlocker exception.
      tags:
        - Exceptions (WebBlocker)
      parameters:
        - in: path
          name: objectid
          required: true
          schema:
            type: string
          description: ID of the WebBlocker exception to update in your 
            WatchGuard Cloud account.
          example: wbe_12124_7HM70EvrifZ7rSfXSA
      requestBody:
        required: true
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/object_update_attributes'
                - $ref: '#/components/schemas/webblocker_exception_base'
              example:
                version: 1
                name: Allow www.example.com
                rule_type: string
                rule: www.example.com/*
                action: allow
      responses:
        '201':
          description: The updated WebBlocker exception object.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/webblocker_exception'
              example:
                id: wbe_12124_7HM70EvrifZ7rSfXSA
                object: webblocker_exception
                device: 12345
                version: 2
                account: WGC-1-123abc456
                created: 1579907960
                author: testuser
                name: Allow www.example.com
                rule_type: string
                rule: www.example.com/*
                action: allow
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '409':
          $ref: '#/components/responses/conflict'
        '500':
          $ref: '#/components/responses/internal_error'
    delete:
      summary: Deletes the specified WebBlocker exception.
      tags:
        - Exceptions (WebBlocker)
      parameters:
        - in: path
          name: objectid
          required: true
          schema:
            type: string
          description: ID of the WebBlocker exception to delete from your 
            WatchGuard Cloud account.
          example: wbe_12124_7HM70EvrifZ7rSfXSA
      responses:
        '201':
          description: The deleted WebBlocker exception object.
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/object_metadata'
                  - $ref: '#/components/schemas/new_object_attributes'
                  - $ref: '#/components/schemas/webblocker_exception_base'
                  - type: object
                    properties:
                      inactive:
                        type: boolean
                        description: Object is inactive.
                        example: true
                    required: [inactive]
                example:
                  id: wbe_12124_7HM70EvrifZ7rSfXSA
                  object: webblocker_exception
                  device: 12345
                  version: 2
                  account: WGC-1-123abc456
                  created: 1579907960
                  author: testuser
                  name: Allow www.example.com
                  rule_type: string
                  rule: www.example.com/*
                  action: allow
                  inactive: true
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v2/configuration/{accountid}/exceptions/webblocker:
    parameters:
      - $ref: '#/components/parameters/accountid'
    get:
      summary: Retrieves all WebBlocker exceptions.
      tags:
        - Exceptions (WebBlocker)
      parameters:
        - $ref: '#/components/parameters/limit'
        - in: query
          name: query
          required: false
          schema:
            type: string
          description: Query string that specifies which WebBlocker exceptions 
            to retrieve from WatchGuard Cloud, written in Lucene query syntax.
          example: device:12345 AND rule_type:"string"
        - in: query
          name: start_after
          required: false
          schema:
            type: string
          description: ID of the first WebBlocker exception to return in the 
            response.
          example: wbe_12124_7HM70EvrifZ7rSfXSA
      responses:
        '200':
          description: A list of WebBlocker exceptions.
          content:
            application/json:
              schema:
                type: object
                properties:
                  count:
                    type: integer
                  more:
                    type: boolean
                  objects:
                    type: array
                    items:
                      $ref: '#/components/schemas/webblocker_exception'
                  start_after:
                    type: string
                    example: wbe_12124_7HM70EvrifZ7rSfXSA
                required: [count, objects]
        '403':
          $ref: '#/components/responses/access_denied'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/bovpn/ipsec/tunnels:
    get:
      summary: Retrieves a list of BOVPN IPSec tunnels.
      description: Given an account ID, retrieves a list of BOVPN tunnels for 
        the account or for a specific device. If a *device* is specified as a 
        query parameter, only the BOVPN tunnels for that device are retrieved.
      tags:
        - BOVPN IPSec Tunnel
      parameters:
        - $ref: '#/components/parameters/accountid'
        - $ref: '#/components/parameters/device'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  count:
                    type: integer
                  objects:
                    $ref: '#/components/schemas/bovpn.ipsec.tunnel_list'
                required:
                  - count
                  - objects
                example:
                  count: 1
                  objects:
                    - id: ipsgp_12345_ARBHLJ70Y78rGOIGBS
                      object: ipsec_gatewaypair
                      version: 1
                      account: WGC-1-123abc456
                      created: 1579907960
                      author: testuser
                      name: PBoVPN1
                      endpoint_a: '136162'
                      endpoint_b_name: CentralVPNServer
                      vpn_type: route-based
                      address_family: 4
                      interfaces:
                        - endpoint_a:
                            network: External
                          endpoint_b:
                            id:
                              type: ip
                              value: 192.88.99.200
                      psk: '12345678'
                      ipsec_tunnel_core:
                        ike_proposals:
                          - encryption: AES-CBC-256
                            dh_group: DH-14
                            lifetime: 24
                            authentication: SHA2-256
                        ipsec_proposals:
                          - encryption: AES-CBC-256
                            lifetime: 8
                            lifebyte: 0
                            authentication: SHA2-256
                        pfs_dh_group: DH-14
                        natt_interval: 20
                        dpd:
                          dpd_type: traffic
                          idle_time: 20
                          retries: 5
                      routes:
                        endpoint_a:
                          local_routes:
                            - metric: 1
                              route: 192.168.1.0/24
                        endpoint_b:
                          local_routes:
                            - metric: 6
                              route: 192.168.100.0/24
                      vif:
                        endpoint_a:
                          vif_df_bit: set
                          vif_local_ip: 9.9.9.9/32
                          vif_mtu: 1399
                          vif_remote_ip: 10.10.10.10/32
                        endpoint_b:
                          vif_local_ip: 10.10.10.10/32
                          vif_remote_ip: 9.9.9.9/32

        '403':
          $ref: '#/components/responses/access_denied'
        '500':
          $ref: '#/components/responses/internal_error'
    post:
      summary: Creates a BOVPN IPSec tunnel.
      description: Creates a BOVPN IPSec tunnel in the given account. All 
        tunnels require at least one cloud-managed Firebox endpoint. Supports 
        both route-based and policy-based tunnels.
      tags:
        - BOVPN IPSec Tunnel
      parameters:
        - $ref: '#/components/parameters/accountid'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/bovpn.ipsec.tunnel_base'
              example:
                example1:
                  summary: Create an IPSEC tunnel using PSK
                  value:
                    name: PBoVPN1
                    endpoint_a: '136162'
                    endpoint_b_name: CentralVPNServer
                    vpn_type: route-based
                    address_family: 4
                    interfaces:
                      - endpoint_a:
                          network: External
                        endpoint_b:
                          id:
                            type: ip
                            value: 192.88.99.200
                    psk: '12345678'
                    ipsec_tunnel_core:
                      ike_proposals:
                        - encryption: AES-CBC-256
                          dh_group: DH-14
                          lifetime: 24
                          authentication: SHA2-256
                      ipsec_proposals:
                        - encryption: AES-CBC-256
                          lifetime: 8
                          lifebyte: 0
                          authentication: SHA2-256
                      pfs_dh_group: DH-14
                      natt_interval: 20
                      dpd:
                        dpd_type: traffic
                        idle_time: 20
                        retries: 5
                    routes:
                      endpoint_a:
                        local_routes:
                          - metric: 1
                            route: 192.168.1.0/24
                      endpoint_b:
                        local_routes:
                          - metric: 6
                            route: 192.168.100.0/24
                    vif:
                      endpoint_a:
                        vif_df_bit: set
                        vif_local_ip: 9.9.9.9/32
                        vif_mtu: 1399
                        vif_remote_ip: 10.10.10.10/32
                      endpoint_b:
                        vif_local_ip: 10.10.10.10/32
                        vif_remote_ip: 9.9.9.9/32
                example2:
                  summary: Create an IPSEC tunnel using certificate
                  value:
                    name: PBoVPN1
                    endpoint_a: '136162'
                    endpoint_b_name: CentralVPNServer
                    vpn_type: route-based
                    address_family: 4
                    interfaces:
                      - endpoint_a:
                          network: External
                        endpoint_b:
                          id:
                            type: ip
                            value: 192.88.99.200
                    certs:
                      - endpoint_a: DeviceCertificateName
                    ipsec_tunnel_core:
                      ike_proposals:
                        - encryption: AES-CBC-256
                          dh_group: DH-14
                          lifetime: 24
                          authentication: SHA2-256
                      ipsec_proposals:
                        - encryption: AES-CBC-256
                          lifetime: 8
                          lifebyte: 0
                          authentication: SHA2-256
                      pfs_dh_group: DH-14
                      natt_interval: 20
                      dpd:
                        dpd_type: traffic
                        idle_time: 20
                        retries: 5
                    routes:
                      endpoint_a:
                        local_routes:
                          - metric: 1
                            route: 192.168.1.0/24
                      endpoint_b:
                        local_routes:
                          - metric: 6
                            route: 192.168.100.0/24
                    vif:
                      endpoint_a:
                        vif_df_bit: set
                        vif_local_ip: 9.9.9.9/32
                        vif_mtu: 1399
                        vif_remote_ip: 10.10.10.10/32
                      endpoint_b:
                        vif_local_ip: 10.10.10.10/32
                        vif_remote_ip: 9.9.9.9/32
      responses:
        '201':
          description: The created BOVPN IPSec tunnel object.
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/bovpn.ipsec.tunnel'
                example:
                  id: ipsgp_12345_ARBHLJ70Y78rGOIGBS
                  object: ipsec_gatewaypair
                  version: 1
                  account: WGC-1-123abc456
                  created: 1579907960
                  author: testuser
                  name: PBoVPN1
                  endpoint_a: '136162'
                  endpoint_b_name: CentralVPNServer
                  vpn_type: route-based
                  address_family: 4
                  interfaces:
                    - endpoint_a:
                        network: External
                      endpoint_b:
                        id:
                          type: ip
                          value: 192.88.99.200
                  psk: '12345678'
                  ipsec_tunnel_core:
                    ike_proposals:
                      - encryption: AES-CBC-256
                        dh_group: DH-14
                        lifetime: 24
                        authentication: SHA2-256
                    ipsec_proposals:
                      - encryption: AES-CBC-256
                        lifetime: 8
                        lifebyte: 0
                        authentication: SHA2-256
                    pfs_dh_group: DH-14
                    natt_interval: 20
                    dpd:
                      dpd_type: traffic
                      idle_time: 20
                      retries: 5
                  routes:
                    endpoint_a:
                      local_routes:
                        - metric: 1
                          route: 192.168.1.0/24
                    endpoint_b:
                      local_routes:
                        - metric: 6
                          route: 192.168.100.0/24
                  vif:
                    endpoint_a:
                      vif_df_bit: set
                      vif_local_ip: 9.9.9.9/32
                      vif_mtu: 1399
                      vif_remote_ip: 10.10.10.10/32
                    endpoint_b:
                      vif_local_ip: 10.10.10.10/32
                      vif_remote_ip: 9.9.9.9/32
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '405':
          $ref: '#/components/responses/method_denied'
        '409':
          $ref: '#/components/responses/conflict'
        '500':
          $ref: '#/components/responses/internal_error'
    put:
      summary: Update a BOVPN IPSec tunnel specified by its name.
      description: Update a BOVPN IPSec tunnel specified by its name through a 
        URL parameter.
      tags:
        - BOVPN IPSec Tunnel
      parameters:
        - $ref: '#/components/parameters/accountid'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/object_update_attributes'
                - $ref: '#/components/schemas/bovpn.ipsec.tunnel_base'
      responses:
        '201':
          description: The updated BOVPN IPSec tunnel object.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/bovpn.ipsec.tunnel'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '409':
          $ref: '#/components/responses/conflict'
        '500':
          $ref: '#/components/responses/internal_error'
    delete:
      summary: Deletes the specified BOVPN IPSec tunnel.
      description: Deletes the BOVPN IPSec tunnel with the given tunnel name.
      tags:
        - BOVPN IPSec Tunnel
      parameters:
        - $ref: '#/components/parameters/accountid'
        - $ref: '#/components/parameters/tunnel_name'
      responses:
        '201':
          description: The deleted BOVPN IPSec tunnel object.
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/object_metadata'
                  - $ref: '#/components/schemas/bovpn.ipsec.tunnel'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'
    patch:
      summary: Update the routes list or certificate of a specific BOVPN tunnel.
      description: Update the routes list or certificate of a specific BOVPN 
        tunnel.
      tags:
        - BOVPN IPSec Tunnel
      parameters:
        - $ref: '#/components/parameters/accountid'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                id:
                  type: string
                  description: Unique ID that identifies this object.
                name:
                  type: string
                  description: VPN IPSec tunnel name.
                  minLength: 1
                  maxLength: 58
                routes:
                  type: object
                  properties:
                    endpoint_a:
                      $ref: '#/components/schemas/bovpn.ipsec.gateway_vif_routes'
                    endpoint_b:
                      $ref: '#/components/schemas/bovpn.ipsec.gateway_vif_routes'
                certs:
                  description: Certificate object reference for each endpoint.
                  type: object
                  required:
                    - endpoint_a
                  properties:
                    endpoint_a:
                      type: string
                    endpoint_b:
                      type: string
            example:
              update_routes:
                summary: Update routes for both endpoints
                value:
                  id: ipsgp_12345_ARBHLJ70Y78rGOIGBS
                  name: PBoVPN1
                  routes:
                    endpoint_a:
                      local_routes:
                        - metric: 1
                          route: 192.168.1.0/24
                        - metric: 2
                          route: 192.168.2.0/24
                    endpoint_b:
                      local_routes:
                        - metric: 6
                          route: 192.168.100.0/24
              update_certificate:
                summary: Update certificate for endpoint_a
                value:
                  id: ipsgp_12345_ARBHLJ70Y78rGOIGBS
                  name: PBoVPN1
                  certs:
                    endpoint_a: cert_12345_ABCDEFGHIJKLMNOP
              update_routes_and_certificate:
                summary: Update name, routes, and certificate
                value:
                  id: ipsgp_12345_ARBHLJ70Y78rGOIGBS
                  name: UpdatedTunnelName
                  routes:
                    endpoint_a:
                      local_routes:
                        - metric: 1
                          route: 10.0.1.0/24
                    endpoint_b:
                      local_routes:
                        - metric: 5
                          route: 10.0.2.0/24
                  certs:
                    endpoint_a: cert_12345_ABCDEFGHIJKLMNOP
                    endpoint_b: cert_67890_QRSTUVWXYZABCDEF
      responses:
        '201':
          description: The updated BOVPN IPSec tunnel object.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/bovpn.ipsec.tunnel'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '409':
          $ref: '#/components/responses/conflict'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/bovpn/ipsec/tunnels/{objectid}:
    parameters:
      - $ref: '#/components/parameters/accountid'
      - in: path
        name: objectid
        required: true
        schema:
          type: string
        description: ID of the BOVPN IPSec tunnel.
        example: ipsgp_136162_2DPNyV3Tc4ZkpqK
    get:
      summary: Retrieves the specified BOVPN IPSec tunnel.
      description: Retrieves the BOVPN IPSec tunnel with the given object ID.
      tags:
        - BOVPN IPSec Tunnel
      responses:
        '200':
          description: The specified BOVPN IPSec tunnel object.
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/bovpn.ipsec.tunnel'
                example:
                  id: ipsgp_12345_ARBHLJ70Y78rGOIGBS
                  object: ipsec_gatewaypair
                  version: 1
                  account: WGC-1-123abc456
                  created: 1579907960
                  author: testuser
                  name: PBoVPN1
                  endpoint_a: '136162'
                  endpoint_b_name: CentralVPNServer
                  vpn_type: route-based
                  address_family: 4
                  interfaces:
                    - endpoint_a:
                        network: External
                      endpoint_b:
                        id:
                          type: ip
                          value: 192.88.99.200
                  psk: '12345678'
                  ipsec_tunnel_core:
                    ike_proposals:
                      - encryption: AES-CBC-256
                        dh_group: DH-14
                        lifetime: 24
                        authentication: SHA2-256
                    ipsec_proposals:
                      - encryption: AES-CBC-256
                        lifetime: 8
                        lifebyte: 0
                        authentication: SHA2-256
                    pfs_dh_group: DH-14
                    natt_interval: 20
                    dpd:
                      dpd_type: traffic
                      idle_time: 20
                      retries: 5
                  routes:
                    endpoint_a:
                      local_routes:
                        - metric: 1
                          route: 192.168.1.0/24
                    endpoint_b:
                      local_routes:
                        - metric: 6
                          route: 192.168.100.0/24
                  vif:
                    endpoint_a:
                      vif_df_bit: set
                      vif_local_ip: 9.9.9.9/32
                      vif_mtu: 1399
                      vif_remote_ip: 10.10.10.10/32
                    endpoint_b:
                      vif_local_ip: 10.10.10.10/32
                      vif_remote_ip: 9.9.9.9/32
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'
    put:
      summary: Updates the specified BOVPN IPSec tunnel.
      description: Updates the BOVPN IPSec tunnel with the given object ID.
      tags:
        - BOVPN IPSec Tunnel
      requestBody:
        required: true
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/object_update_attributes'
                - $ref: '#/components/schemas/bovpn.ipsec.tunnel_base'
              example:
                id: ipsgp_12345_ARBHLJ70Y78rGOIGBS
                object: ipsec_gatewaypair
                version: 1
                account: WGC-1-123abc456
                name: PBoVPN1
                endpoint_a: '136162'
                endpoint_b_name: CentralVPNServer
                vpn_type: route-based
                address_family: 4
                interfaces:
                  - endpoint_a:
                      network: External
                    endpoint_b:
                      id:
                        type: ip
                        value: 192.88.99.200
                psk: '12345678'
                ipsec_tunnel_core:
                  ike_proposals:
                    - encryption: AES-CBC-256
                      dh_group: DH-14
                      lifetime: 24
                      authentication: SHA2-256
                  ipsec_proposals:
                    - encryption: AES-CBC-256
                      lifetime: 8
                      lifebyte: 0
                      authentication: SHA2-256
                  pfs_dh_group: DH-14
                  natt_interval: 20
                  dpd:
                    dpd_type: traffic
                    idle_time: 20
                    retries: 5
                routes:
                  endpoint_a:
                    local_routes:
                      - metric: 1
                        route: 192.168.1.0/24
                  endpoint_b:
                    local_routes:
                      - metric: 6
                        route: 192.168.100.0/24
                vif:
                  endpoint_a:
                    vif_df_bit: set
                    vif_local_ip: 9.9.9.9/32
                    vif_mtu: 1399
                    vif_remote_ip: 10.10.10.10/32
                  endpoint_b:
                    vif_local_ip: 10.10.10.10/32
                    vif_remote_ip: 9.9.9.9/32
      responses:
        '201':
          description: The updated BOVPN IPSec tunnel object.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/bovpn.ipsec.tunnel'
              example:
                id: ipsgp_12345_ARBHLJ70Y78rGOIGBS
                object: ipsec_gatewaypair
                version: 2
                account: WGC-1-123abc456
                created: 1579909960
                author: testuser
                name: PBoVPN1
                endpoint_a: '136162'
                endpoint_b_name: CentralVPNServer
                vpn_type: route-based
                address_family: 4
                interfaces:
                  - endpoint_a:
                      network: External
                    endpoint_b:
                      id:
                        type: ip
                        value: 192.88.99.200
                psk: '12345678'
                ipsec_tunnel_core:
                  ike_proposals:
                    - encryption: AES-CBC-256
                      dh_group: DH-14
                      lifetime: 24
                      authentication: SHA2-256
                  ipsec_proposals:
                    - encryption: AES-CBC-256
                      lifetime: 8
                      lifebyte: 0
                      authentication: SHA2-256
                  pfs_dh_group: DH-14
                  natt_interval: 20
                  dpd:
                    dpd_type: traffic
                    idle_time: 20
                    retries: 5
                routes:
                  endpoint_a:
                    local_routes:
                      - metric: 1
                        route: 192.168.1.0/24
                  endpoint_b:
                    local_routes:
                      - metric: 6
                        route: 192.168.100.0/24
                vif:
                  endpoint_a:
                    vif_df_bit: set
                    vif_local_ip: 9.9.9.9/32
                    vif_mtu: 1399
                    vif_remote_ip: 10.10.10.10/32
                  endpoint_b:
                    vif_local_ip: 10.10.10.10/32
                    vif_remote_ip: 9.9.9.9/32
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '409':
          $ref: '#/components/responses/conflict'
        '500':
          $ref: '#/components/responses/internal_error'
    delete:
      summary: Deletes the specified BOVPN IPSec tunnel.
      description: Deletes the BOVPN IPSec tunnel with the given object ID.
      tags:
        - BOVPN IPSec Tunnel
      responses:
        '201':
          description: The deleted BOVPN IPSec tunnel object.
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/object_metadata'
                  - $ref: '#/components/schemas/bovpn.ipsec.tunnel'
                example:
                  id: ipsgp_12345_ARBHLJ70Y78rGOIGBS
                  object: ipsec_gatewaypair
                  version: 1
                  account: WGC-1-123abc456
                  created: 1579907960
                  author: testuser
                  name: PBoVPN1
                  endpoint_a: '136162'
                  endpoint_b_name: CentralVPNServer
                  vpn_type: route-based
                  address_family: 4
                  interfaces:
                    - endpoint_a:
                        network: External
                      endpoint_b:
                        id:
                          type: ip
                          value: 192.88.99.200
                  psk: '12345678'
                  ipsec_tunnel_core:
                    ike_proposals:
                      - encryption: AES-CBC-256
                        dh_group: DH-14
                        lifetime: 24
                        authentication: SHA2-256
                    ipsec_proposals:
                      - encryption: AES-CBC-256
                        lifetime: 8
                        lifebyte: 0
                        authentication: SHA2-256
                    pfs_dh_group: DH-14
                    natt_interval: 20
                    dpd:
                      dpd_type: traffic
                      idle_time: 20
                      retries: 5
                  routes:
                    endpoint_a:
                      local_routes:
                        - metric: 1
                          route: 192.168.1.0/24
                    endpoint_b:
                      local_routes:
                        - metric: 6
                          route: 192.168.100.0/24
                  vif:
                    endpoint_a:
                      vif_df_bit: set
                      vif_local_ip: 9.9.9.9/32
                      vif_mtu: 1399
                      vif_remote_ip: 10.10.10.10/32
                    endpoint_b:
                      vif_local_ip: 10.10.10.10/32
                      vif_remote_ip: 9.9.9.9/32
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'
    patch:
      summary: Update the routes list or certificate of a specific BOVPN tunnel.
      description: Update the routes list or certificate of a specific BOVPN 
        tunnel.
      tags:
        - BOVPN IPSec Tunnel
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                routes:
                  type: object
                  properties:
                    endpoint_a:
                      $ref: '#/components/schemas/bovpn.ipsec.gateway_vif_routes'
                    endpoint_b:
                      $ref: '#/components/schemas/bovpn.ipsec.gateway_vif_routes'
                certs:
                  description: Certificate object reference for each endpoint.
                  type: object
                  required:
                    - endpoint_a
                  properties:
                    endpoint_a:
                      type: string
                    endpoint_b:
                      type: string
            example:
              update_routes:
                summary: Update routes for both endpoints
                value:
                  routes:
                    endpoint_a:
                      local_routes:
                        - metric: 1
                          route: 192.168.1.0/24
                        - metric: 2
                          route: 192.168.2.0/24
                    endpoint_b:
                      local_routes:
                        - metric: 6
                          route: 192.168.100.0/24
              update_certificate:
                summary: Update certificate for endpoint_a
                value:
                  certs:
                    endpoint_a: cert_12345_ABCDEFGHIJKLMNOP
              update_routes_and_certificate:
                summary: Update both routes and certificate
                value:
                  routes:
                    endpoint_a:
                      local_routes:
                        - metric: 1
                          route: 10.0.1.0/24
                    endpoint_b:
                      local_routes:
                        - metric: 5
                          route: 10.0.2.0/24
                  certs:
                    endpoint_a: cert_12345_ABCDEFGHIJKLMNOP
                    endpoint_b: cert_67890_QRSTUVWXYZABCDEF
      responses:
        '201':
          description: The updated BOVPN IPSec tunnel object.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/bovpn.ipsec.tunnel'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '409':
          $ref: '#/components/responses/conflict'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/bovpn/ipsec/p1_shared_settings:
    get:
      summary: Retrieves the BOVPN IPSec P1 shared settings object for the 
        device.
      description: Retrieves the BOVPN IPSec P1 shared settings object for the 
        given device ID. If no *device* is provided, all P1 shared settings 
        objects for the account are retrieved.
      tags:
        - BOVPN IPSec Tunnel P1 Shared Settings
      parameters:
        - $ref: '#/components/parameters/accountid'
        - $ref: '#/components/parameters/device'
      responses:
        '200':
          description: The specified BOVPN IPSec shared P1 settings object for 
            the Firebox.
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/bovpn.ipsec.shared_p1'
                example:
                  id: ipstp_12345_ARBHLJ70Y78rGOIGBS
                  object: ipsec_gatewaytemplate
                  version: 1
                  account: WGC-1-123abc456
                  created: 1579907960
                  device: '12345'
                  author: testuser
                  ike_proposals:
                    - encryption: AES-GCM-256
                      authentication: SHA2-512
                      dh_group: DH-21
                      lifetime: 8
                  natt_interval: 20
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'
    post:
      summary: Creates a shared P1 settings object.
      description: Creates a shared P1 settings object. One object can exist per
        Firebox. The Firebox ID is specified in the *device* attribute of the 
        configuration object.
      tags:
        - BOVPN IPSec Tunnel P1 Shared Settings
      parameters:
        - $ref: '#/components/parameters/accountid'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/new_object_attributes'
                - $ref: '#/components/schemas/bovpn.ipsec.shared_p1_base'
              example:
                device: '12345'
                ike_proposals:
                  - encryption: AES-GCM-256
                    authentication: SHA2-512
                    dh_group: DH-21
                    lifetime: 8
                natt_interval: 20
      responses:
        '201':
          description: The created BOVPN IPSec tunnel shared P1 settings object.
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/bovpn.ipsec.shared_p1'
                example:
                  id: ipstp_12345_ARBHLJ70Y78rGOIGBS
                  object: ipsec_gatewaytemplate
                  version: 1
                  account: WGC-1-123abc456
                  created: 1579907960
                  device: '12345'
                  author: testuser
                  ike_proposals:
                    - encryption: AES-GCM-256
                      authentication: SHA2-512
                      dh_group: DH-21
                      lifetime: 8
                  natt_interval: 20
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '405':
          $ref: '#/components/responses/method_denied'
        '409':
          $ref: '#/components/responses/conflict'
        '500':
          $ref: '#/components/responses/internal_error'
    put:
      summary: Updates the specified BOVPN IPSec P1 shared settings object for 
        the device.
      description: Updates the specified BOVPN IPSec P1 shared settings object 
        for the device. The Firebox ID is specified in the *device* attribute of
        the configuration object.
      tags:
        - BOVPN IPSec Tunnel P1 Shared Settings
      parameters:
        - $ref: '#/components/parameters/accountid'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/object_update_attributes'
                - $ref: '#/components/schemas/bovpn.ipsec.shared_p1_base'
              example:
                id: ipstp_12345_ARBHLJ70Y78rGOIGBS
                object: ipsec_gatewaytemplate
                version: 1
                account: WGC-1-123abc456
                device: '12345'
                ike_proposals:
                  - encryption: AES-GCM-256
                    authentication: SHA2-512
                    dh_group: DH-20
                    lifetime: 16
                natt_interval: 20
      responses:
        '201':
          description: The updated BOVPN IPSec tunnel shared P1 settings object.
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/bovpn.ipsec.shared_p1'
                example:
                  id: ipstp_12345_ARBHLJ70Y78rGOIGBS
                  object: ipsec_gatewaytemplate
                  version: 2
                  account: WGC-1-123abc456
                  created: 1579909960
                  device: '12345'
                  author: testuser
                  ike_proposals:
                    - encryption: AES-GCM-256
                      authentication: SHA2-512
                      dh_group: DH-20
                      lifetime: 16
                  natt_interval: 20
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '405':
          $ref: '#/components/responses/method_denied'
        '409':
          $ref: '#/components/responses/conflict'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/system/certificates:
    get:
      summary: Retrieves a list of certificates for the account or device.
      description: Retrieves a list of certificates for the account. Or 
        retrieves a list of all certificates for a device when you specify 
        *device*.
      tags:
        - Firebox Certificates
      parameters:
        - $ref: '#/components/parameters/accountid'
        - $ref: '#/components/parameters/device'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  count:
                    type: integer
                  objects:
                    $ref: '#/components/schemas/system.certificate_list'
                required:
                  - count
                  - objects
                example:
                  count: 2
                  objects:
                    - account: WGC-1-123abc456
                      id: crt_34425_jf3904ukdj94
                      device: FB-123456
                      name: MyDeviceWebCert
                      algorithm: RSA
                      cert_type: web_server
                      cert_fingerprint: aa:aa:aa:aa:aa:aa:aa:aa
                      valid_from: 1738863038
                      expiration: 1815016892
                      key_length: 2048
                      signature_algo: sha256WithRSAEncryption
                      key_usage:
                        - digital_signature
                        - content_commitment
                        - key_encipherment
                      extended_key_usage:
                        - serverAuth
                      issuer: o=WatchGuard cn=WatchGuard Certificate Authority
                      subject: o=myCompany cn=mydevice.org
                      subject_alt:
                        - mydevicealt.org
                      pem: pem_string
                    - account: WGC-1-123abc456
                      id: crt_ksdghfj0499dj94sdf
                      name: MyAccountCACert
                      algorithm: RSA
                      cert_type: ca
                      cert_fingerprint: bb:bb:bb:bb:bb:bb:bb:bb
                      valid_from: 1738863038
                      expiration: 1815016892
                      key_length: 2048
                      signature_algo: sha256WithRSAEncryption
                      key_usage:
                        - key_cert_sign
                        - crl_sign
                      issuer: o=WatchGuard cn=WatchGuard Certificate Authority
                      subject: o=WatchGuard cn=WatchGuard Certificate Authority
                      pem: pem_string
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

    post:
      summary: Creates a certificate (account-level or device-level).
      description: Creates an account-level or device-level certificate. Specify
        the *device* ID in the request data for device-level certificates.
      tags:
        - Firebox Certificates
      parameters:
        - $ref: '#/components/parameters/accountid'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/device'
                - $ref: '#/components/schemas/system.certificate_base'
            examples:
              account-level:
                value:
                  name: AccountCert
                  description: My Account Certificate
                  pem: PEM_STRING
                  pvt_key: PRIVATE_KEY_STRING
              device-level:
                value:
                  device: '56392'
                  name: AccountCert
                  description: My Device Certificate
                  pem: PEM_STRING
                  pvt_key: PRIVATE_KEY_STRING
              device-level-pfx:
                value:
                  device: '56392'
                  name: AccountCert
                  description: My Device PFX Certificate
                  pfx: PFX_STRING
                  password: 123456
              device-level-from-account:
                value:
                  device: '56392'
                  alias: crt_34425_jf3904ukdj94
      responses:
        '201':
          description: The created certificate object.
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/system.certificate'
              examples:
                device-level-web:
                  value:
                    account: WGC-1-123abc456
                    id: crt_34425_jf3904ukdj94
                    device: FB-123456
                    name: MyDeviceWebCert
                    algorithm: RSA
                    cert_type: web_server
                    cert_fingerprint: aa:aa:aa:aa:aa:aa:aa:aa
                    valid_from: 1738863038
                    expiration: 1815016892
                    key_length: 2048
                    signature_algo: sha256WithRSAEncryption
                    key_usage:
                      - digital_signature
                      - content_commitment
                      - key_encipherment
                    extended_key_usage:
                      - serverAuth
                    issuer: o=WatchGuard cn=WatchGuard Certificate Authority
                    subject: o=myCompany cn=mydevice.org
                    subject_alt:
                      - mydevicealt.org
                    pem: pem_string
                account-level-ca:
                  value:
                    account: WGC-1-123abc456
                    id: crt_ksdghfj0499dj94sdf
                    name: MyAccountCACert
                    algorithm: RSA
                    cert_type: ca
                    cert_fingerprint: bb:bb:bb:bb:bb:bb:bb:bb
                    valid_from: 1738863038
                    expiration: 1815016892
                    key_length: 2048
                    signature_algo: sha256WithRSAEncryption
                    key_usage:
                      - key_cert_sign
                      - crl_sign
                    issuer: o=WatchGuard cn=WatchGuard Certificate Authority
                    subject: o=WatchGuard cn=WatchGuard Certificate Authority
                    pem: pem_string
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '405':
          $ref: '#/components/responses/method_denied'
        '409':
          $ref: '#/components/responses/conflict'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/system/certificates/{objectid}:
    parameters:
      - $ref: '#/components/parameters/accountid'
      - $ref: '#/components/parameters/objectid'
    get:
      summary: Retrieves the specified certificate.
      description: Retrieves the certificate with the given object ID.
      tags:
        - Firebox Certificates
      responses:
        '200':
          description: The specified certificate object.
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/device'
                  - $ref: '#/components/schemas/system.certificate'
                example:
                  account: WGC-1-123abc456
                  id: crt_34425_jf3904ukdj94
                  device: FB-123456
                  name: MyDeviceWebCert
                  algorithm: RSA
                  cert_type: web_server
                  cert_fingerprint: aa:aa:aa:aa:aa:aa:aa:aa
                  valid_from: 1738863038
                  expiration: 1815016892
                  key_length: 2048
                  signature_algo: sha256WithRSAEncryption
                  key_usage:
                    - digital_signature
                    - content_commitment
                    - key_encipherment
                  extended_key_usage:
                    - serverAuth
                  issuer: o=WatchGuard cn=WatchGuard Certificate Authority
                  subject: o=myCompany cn=mydevice.org
                  subject_alt:
                    - mydevicealt.org
                  pem: pem_string
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

    delete:
      summary: Deletes the specified certificate.
      description: Deletes the certificate with the given object ID.
      tags:
        - Firebox Certificates
      responses:
        '201':
          description: The deleted certificate object.
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/object_metadata'
                  - $ref: '#/components/schemas/system.certificate'
                example:
                  account: WGC-1-123abc456
                  id: crt_34425_jf3904ukdj94
                  device: FB-123456
                  name: MyDeviceWebCert
                  algorithm: RSA
                  cert_type: web_server
                  cert_fingerprint: aa:aa:aa:aa:aa:aa:aa:aa
                  valid_from: 1738863038
                  expiration: 1815016892
                  key_length: 2048
                  signature_algo: sha256WithRSAEncryption
                  key_usage:
                    - digital_signature
                    - content_commitment
                    - key_encipherment
                  extended_key_usage:
                    - serverAuth
                  issuer: o=WatchGuard cn=WatchGuard Certificate Authority
                  subject: o=myCompany cn=mydevice.org
                  subject_alt:
                    - mydevicealt.org
                  pem: pem_string
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/commands/{accountid}/global_exceptions/enable:
    parameters:
      - $ref: '#/components/parameters/accountid'
    post:
      summary: Enables the ability to manage and deploy exceptions with the 
        Firebox Management API for the specified device(s).
      tags:
        - Global Exceptions
      requestBody:
        required: true
        content:
          application/json:
            schema:
              properties:
                devices:
                  allOf:
                    - $ref: '#/components/schemas/device_list'
                  description: Device(s) to enable global exceptions for. Each 
                    device has a unique ID number in WatchGuard Cloud, which 
                    appears in the URL of the Device Summary page.
              required: [devices]
      responses:
        '204':
          description: No Content
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/commands/{accountid}/global_exceptions/disable:
    parameters:
      - $ref: '#/components/parameters/accountid'
    post:
      summary: Disables the ability to manage and deploy global exceptions with 
        the Firebox Management API for the specified device(s). You can specify 
        whether to retain or delete exceptions on the device(s).
      tags:
        - Global Exceptions
      requestBody:
        required: true
        content:
          application/json:
            schema:
              properties:
                devices:
                  allOf:
                    - $ref: '#/components/schemas/device_list'
                  description: Device(s) to disable global exceptions for. Each 
                    device has a unique ID number in WatchGuard Cloud, which 
                    appears in the URL of the Device Summary page.
                retain_device_configuration:
                  type: boolean
                  description: Specifies whether to retain or delete exceptions 
                    on the specified device(s) when you disable global 
                    exceptions. Either true (retain exceptions) or false (delete
                    exceptions).
                  default: false
              required: [devices]
      responses:
        '204':
          description: No Content
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/commands/{accountid}/transactions:
    parameters:
      - $ref: '#/components/parameters/accountid'
    get:
      summary: Retrieves a list of transaction records, which include details of
        individual deployments.
      tags:
        - Deployments
      parameters:
        - in: query
          name: device
          schema:
            type: integer
          description: Specifies the ID of the device to retrieve transaction 
            records for.
          example: 12345
        - in: query
          name: tx_type
          schema:
            type: string
            enum:
              - deployment
          required: true
          description: Specifies the type of transaction records to retrieve.
          example: deployment
      responses:
        '200':
          description: The transaction objects.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/device_transaction'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/commands/{accountid}/transactions/{objectid}:
    parameters:
      - $ref: '#/components/parameters/accountid'
    get:
      summary: Retrieves the specified transaction record, which includes 
        details of a specific deployment.
      tags:
        - Deployments
      parameters:
        - in: path
          name: objectid
          required: true
          schema:
            type: string
          description: ID of the transaction record to retrieve.
          example: ddply_12345_J2VwPbXuek3CRGN1
      responses:
        '200':
          description: The transaction object.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/device_transaction'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'
    put:
      summary: Updates the specified transaction record.
      tags:
        - Deployments
      parameters:
        - in: path
          name: objectid
          required: true
          schema:
            type: string
          description: ID of the transaction record to update.
          example: ddply_12345_J2VwPbXuek3CRGN1
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                start_date:
                  type: string
                  minLength: 1
                  maxLength: 128
                  description: Time to deploy objects to the specified devices. 
                    Specify 'now' to deploy immediately or specify a time in UTC
                    format to deploy at that time.
                  example: '2020-04-19T21:23:46Z'
                description:
                  type: string
                  minLength: 1
                  maxLength: 128
                  description: 'Description of the device deployment. Maximum: 128
                    characters.'
                  example: Deploy objects to Seattle office Fireboxes.
              required:
                - start_date
              example:
                start_date: '2020-04-19T21:23:46Z'
                description: Deploy objects to Seattle office Fireboxes.
      responses:
        '200':
          description: The updated transaction object.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/device_transaction'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

    delete:
      summary: Deletes the specified transaction record.
      tags:
        - Deployments
      parameters:
        - in: path
          name: objectid
          required: true
          schema:
            type: string
          description: ID of the transaction record to delete from your 
            WatchGuard Cloud account.
          example: ddply_12345_J2VwPbXuek3CRGN1
      responses:
        '200':
          description: The deleted transaction object.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/device_transaction'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/commands/{accountid}/system/certificates/install:
    parameters:
      - $ref: '#/components/parameters/accountid'
    post:
      summary: Installs a certificate on a Firebox or Fireboxes.
      description: Install a certificate on a Firebox or a list of Fireboxes. 
        The certificate to install and the target Firebox(es) are specified in 
        the request body. The certificate can be referenced by name or object 
        id.
      tags:
        - Firebox Certificates
      requestBody:
        required: true
        content:
          application/json:
            schema:
              allOf:
                - anyOf:
                    - type: object
                      properties:
                        certificate:
                          type: string
                    - type: object
                      properties:
                        certificate_id:
                          type: string
                - oneOf:
                    - $ref: '#/components/schemas/device'
                    - $ref: '#/components/schemas/devices'
            examples:
              single-device-name:
                value:
                  certificate: MyCertificate
                  device: '12345'
              multi-device-id:
                value:
                  certificate_id: cert_12345_ARBHLJ70Y78rGOIGBS
                  devices:
                    - '12345'
                    - '67890'
      responses:
        '201':
          description: The ID of the created certificate object.
          content:
            application/json:
              schema:
                type: string
                example:
                  id: crt_12345_ARBHLJ70Y78rGOIGBS
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '405':
          $ref: '#/components/responses/method_denied'
        '409':
          $ref: '#/components/responses/conflict'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/commands/{accountid}/deployments:
    parameters:
      - $ref: '#/components/parameters/accountid'
    post:
      summary: Deploys exceptions or full configurations saved in WatchGuard 
        Cloud to the specified devices.
      tags:
        - Deployments
      requestBody:
        required: true
        content:
          application/json:
            schema:
              properties:
                devices:
                  allOf:
                    - $ref: '#/components/schemas/device_list'
                  description: Device(s) to deploy exceptions to. Each device 
                    has a unique ID number in WatchGuard Cloud, which appears in
                    the URL of the Device Summary page. Enclose in square 
                    brackets and separate device IDs with commas.
                version:
                  type: integer
                  description: Version number of the device deployment to 
                    deploy. Only specify a version if you want to redeploy a 
                    previous deployment to the device.
                  example: 1
                start_date:
                  type: string
                  minLength: 1
                  maxLength: 128
                  description: Time to deploy objects to the specified devices. 
                    Specify 'now' to deploy immediately or specify a time in UTC
                    format to deploy at that time.
                  example: '2020-04-19T21:23:46Z'
                description:
                  type: string
                  minLength: 1
                  maxLength: 128
                  description: 'Description of the device deployment. Maximum: 128
                    characters.'
                  example: Deploy objects to Seattle office Fireboxes.
                full_config:
                  type: boolean
                  default: false
                  description: Deploy full configuration for cloud-managed 
                    Fireboxes when set to true. Otherwise, deploy global 
                    exceptions only.
              required:
                - devices
                - start_date
            example:
              devices: [12345, 12346, 12347]
              start_date: '2020-04-19T21:23:46Z'
              description: Deploy objects to Seattle office Fireboxes.
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                properties:
                  ok:
                    type: array
                    items:
                      $ref: '#/components/schemas/device_transaction'
                  errors:
                    type: object
                    example:
                      '12345': global_exceptions not enabled for device
                      FBCL-67890: global_exceptions not enabled for device
        '201':
          description: Created
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/device_transaction'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/firewall/policies:
    get:
      summary: Retrieves a list of firewall policies.
      operationId: pyproxy.handlers.firewall.policies.find
      description: >-
        Retrieves a list of firewall policies for the account or for a specific device.
        When you specify *device* as a query parameter, this operation retrieves only
        the firewall policies for that device.
        When you specify *full* (set to 0) as a query parameter, this operation returns
        a summary list (id, name, group, and device) of firewall policies.
        When *full* (set to 1) or not specified, returns full policy objects.
      tags:
        - Firewall Policies
      parameters:
        - $ref: '#/components/parameters/accountid'
        - $ref: '#/components/parameters/device'
        - $ref: '#/components/parameters/full'
      responses:
        '200':
          description: A list of firewall policies.
          content:
            application/json:
              schema:
                type: object
                properties:
                  count:
                    type: integer
                    description: Total number of firewall policies returned.
                  objects:
                    type: array
                    items:
                      oneOf:
                        - $ref: '#/components/schemas/firewall.policy_summary'
                        - $ref: '#/components/schemas/firewall.policy'
                required:
                  - count
                  - objects
              examples:
                summary-list:
                  summary: Summary list of firewall policies.
                  description: Returned when *full* is set to 0 or omitted.
                  value:
                    count: 2
                    objects:
                      - id: fpol_12345_ARBHLJ70Y78rGOIGBS
                        name: Outgoing
                        group: Core Policies
                        device: '12345'
                      - id: fpol_12345_DENYINCOMING
                        name: Deny-Incoming
                        group: Last Run Policies
                        device: '12345'
                full-list:
                  summary: Full list of firewall policies.
                  description: Returned when *full* is set to 1.
                  value:
                    count: 1
                    objects:
                      - id: fpol_12345_ARBHLJ70Y78rGOIGBS
                        object: firewall_policy
                        version: 1
                        account: WGC-1-123abc456
                        device: 12345
                        created: 1579907960
                        author: testuser
                        name: Outgoing
                        description: Allow outgoing traffic.
                        enabled: true
                        action: allow
                        type: outbound
                        traffic_types:
                          - All TCP and UDP
                          - FTP
                        sources:
                          - type: system_alias
                            value: Any-Internal
                        destinations:
                          - type: system_alias
                            value: Any-External
                        idle_timeout:
                          override_global: false
                        nat:
                          dynamic_nat:
                            enabled: true
                            type: global
                        sticky_connection:
                          override_global: false
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'
    post:
      summary: Creates a new firewall policy.
      operationId: pyproxy.handlers.firewall.policies.add
      description: Creates a new firewall policy for a device. Specify the 
        *group* parameter to indicate which policy category to add the policy 
        to.
      tags:
        - Firewall Policies
      parameters:
        - $ref: '#/components/parameters/accountid'
      requestBody:
        required: true
        description: Request body to create a new firewall policy.
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/device'
                - $ref: '#/components/schemas/firewall.policy_base'
                - type: object
                  required:
                    - device
            example:
              device: 12345
              name: Outgoing
              description: Allow outgoing traffic
              enabled: true
              action: allow
              type: outbound
              group: Core Policies
              traffic_types:
                - All TCP and UDP
                - FTP
              sources:
                - type: system_alias
                  value: Any-Internal
              destinations:
                - type: system_alias
                  value: Any-External
              idle_timeout:
                override_global: false
              nat:
                dynamic_nat:
                  enabled: true
                  type: global
              sticky_connection:
                override_global: false
      responses:
        '201':
          description: The created firewall policy object.
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/firewall.policy'
              example:
                id: fpol_12345_ARBHLJ70Y78rGOIGBS
                object: firewall_policy
                version: 1
                account: WGC-1-123abc456
                device: 12345
                created: 1579907960
                author: testuser
                name: Outgoing
                description: Allow outgoing traffic
                enabled: true
                action: allow
                type: outbound
                traffic_types:
                  - All TCP and UDP
                  - FTP
                sources:
                  - type: system_alias
                    value: Any-Internal
                destinations:
                  - type: system_alias
                    value: Any-External
                idle_timeout:
                  override_global: false
                nat:
                  dynamic_nat:
                    enabled: true
                    type: global
                sticky_connection:
                  override_global: false
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '405':
          $ref: '#/components/responses/method_denied'
        '409':
          $ref: '#/components/responses/conflict'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/firewall/policies/{objectid}:
    parameters:
      - $ref: '#/components/parameters/accountid'
      - in: path
        name: objectid
        required: true
        schema:
          type: string
        description: ID of the firewall policy to retrieve.
        example: fpol_12345_ARBHLJ70Y78rGOIGBS
    get:
      summary: Retrieves the specified firewall policy.
      operationId: pyproxy.handlers.firewall.policies.get
      description: Retrieves the firewall policy with the specified object ID.
      tags:
        - Firewall Policies
      responses:
        '200':
          description: The specified firewall policy object.
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/firewall.policy'
              example:
                id: fpol_12345_ARBHLJ70Y78rGOIGBS
                object: firewall_policy
                version: 1
                account: WGC-1-123abc456
                device: 12345
                created: 1579907960
                author: testuser
                name: Outgoing
                description: Allow outgoing traffic
                enabled: true
                action: allow
                type: outbound
                traffic_types:
                  - All TCP and UDP
                  - FTP
                sources:
                  - type: system_alias
                    value: Any-Internal
                destinations:
                  - type: system_alias
                    value: Any-External
                idle_timeout:
                  override_global: false
                nat:
                  dynamic_nat:
                    enabled: true
                    type: global
                sticky_connection:
                  override_global: false
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'
    put:
      summary: Updates the specified firewall policy.
      operationId: pyproxy.handlers.firewall.policies.update
      description: Updates the firewall policy with the specified object ID.
      tags:
        - Firewall Policies
      requestBody:
        required: true
        description: Request body to update the firewall policy.
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/object_update_attributes'
                - $ref: '#/components/schemas/device'
                - $ref: '#/components/schemas/firewall.policy_base'
                - type: object
                  required:
                    - device
            example:
              version: 1
              device: 12345
              name: Outgoing Updated
              description: Allow outgoing traffic - updated.
              enabled: true
              action: allow
              type: outbound
              group: Core Policies
              traffic_types:
                - All TCP and UDP
                - FTP
              sources:
                - type: ipv4_network
                  value: 10.0.1.0/24
              destinations:
                - type: system_alias
                  value: Any-External
              idle_timeout:
                override_global: false
              nat:
                dynamic_nat:
                  enabled: true
                  type: global
              sticky_connection:
                override_global: false
      responses:
        '201':
          description: The updated firewall policy object.
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/firewall.policy'
              example:
                id: fpol_12345_ARBHLJ70Y78rGOIGBS
                object: firewall_policy
                version: 2
                account: WGC-1-123abc456
                device: 12345
                created: 1579907960
                author: testuser
                name: Outgoing Updated
                description: Allow outgoing traffic - updated
                enabled: true
                action: allow
                type: outbound
                traffic_types:
                  - All TCP and UDP
                  - FTP
                sources:
                  - type: ipv4_network
                    value: 10.0.1.0/24
                destinations:
                  - type: system_alias
                    value: Any-External
                idle_timeout:
                  override_global: false
                nat:
                  dynamic_nat:
                    enabled: true
                    type: global
                sticky_connection:
                  override_global: false
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '409':
          $ref: '#/components/responses/conflict'
        '500':
          $ref: '#/components/responses/internal_error'
    patch:
      summary: Enables or disables the specified firewall policy.
      operationId: pyproxy.handlers.firewall.policies.patch
      description: Enables or disables the firewall policy with the specified 
        object ID without modifying other settings.
      tags:
        - Firewall Policies
      requestBody:
        required: true
        description: Request body to enable or disable the firewall policy.
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/device'
                - $ref: '#/components/schemas/firewall.policy_patch'
                - type: object
                  required:
                    - device
            example:
              device: 12345
              enabled: false
      responses:
        '201':
          description: The updated firewall policy object.
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/firewall.policy'
              example:
                id: fpol_12345_ARBHLJ70Y78rGOIGBS
                object: firewall_policy
                version: 2
                account: WGC-1-123abc456
                device: 12345
                created: 1579907960
                author: testuser
                name: Outgoing
                description: Allow outgoing traffic
                enabled: false
                action: allow
                type: outbound
                traffic_types:
                  - All TCP and UDP
                  - FTP
                sources:
                  - type: system_alias
                    value: Any-Internal
                destinations:
                  - type: system_alias
                    value: Any-External
                idle_timeout:
                  override_global: false
                nat:
                  dynamic_nat:
                    enabled: true
                    type: global
                sticky_connection:
                  override_global: false
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '409':
          $ref: '#/components/responses/conflict'
        '500':
          $ref: '#/components/responses/internal_error'
    delete:
      summary: Deletes the specified firewall policy.
      operationId: pyproxy.handlers.firewall.policies.delete
      description: Deletes the firewall policy with the specified object ID. 
        Permanent policies cannot be deleted.
      tags:
        - Firewall Policies
      responses:
        '201':
          description: The deleted firewall policy object.
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/firewall.policy'
                  - type: object
                    properties:
                      inactive:
                        type: boolean
                        description: Indicates whether the object is inactive.
                        example: true
                    required: [inactive]
              example:
                id: fpol_12345_ARBHLJ70Y78rGOIGBS
                object: firewall_policy
                version: 2
                account: WGC-1-123abc456
                device: 12345
                created: 1579907960
                author: testuser
                name: Outgoing
                description: Allow outgoing traffic
                enabled: true
                action: allow
                type: outbound
                traffic_types:
                  - All TCP and UDP
                  - FTP
                sources:
                  - type: system_alias
                    value: Any-Internal
                destinations:
                  - type: system_alias
                    value: Any-External
                idle_timeout:
                  override_global: false
                nat:
                  dynamic_nat:
                    enabled: true
                    type: global
                sticky_connection:
                  override_global: false
                inactive: true
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '409':
          $ref: '#/components/responses/conflict'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/firewall/policy_groups:
    get:
      summary: Retrieves a list of policy groups.
      operationId: pyproxy.handlers.firewall.policy_groups.find
      description: Retrieves a list of policy groups for the account or for a 
        specific device or template. If a *device* is specified as a query 
        parameter, only the policy groups for that device are retrieved. If a 
        *templateid* is specified as a query parameter, only the policy groups 
        for that template are retrieved.
      tags:
        - Firewall Policy Groups
      parameters:
        - $ref: '#/components/parameters/accountid'
        - $ref: '#/components/parameters/device'
        - $ref: '#/components/parameters/templateid'
      responses:
        '200':
          description: OK.
          content:
            application/json:
              schema:
                type: object
                properties:
                  count:
                    type: integer
                    description: The total number of policy groups.
                  objects:
                    type: array
                    items:
                      $ref: '#/components/schemas/firewall.policy_group'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/firewall/policy_groups/{objectid}:
    parameters:
      - $ref: '#/components/parameters/accountid'
      - $ref: '#/components/parameters/objectid'
    get:
      summary: Retrieves the specified policy group.
      operationId: pyproxy.handlers.firewall.policy_groups.get
      description: Retrieves the policy group with the specified object ID.
      tags:
        - Firewall Policy Groups
      responses:
        '200':
          description: The specified policy group object.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/firewall.policy_group'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/firewall/traffic_types:
    get:
      summary: Retrieves a list of traffic types.
      operationId: pyproxy.handlers.firewall.traffic_types.find
      description: Retrieves a list of traffic types for the account or for a 
        specific device or template. If a *device* is specified as a query 
        parameter, only the traffic types for that device are retrieved. If a 
        *templateid* is specified as a query parameter, only the traffic types 
        for that template are retrieved.
      tags:
        - Firewall Traffic Types
      parameters:
        - $ref: '#/components/parameters/accountid'
        - $ref: '#/components/parameters/device'
        - $ref: '#/components/parameters/templateid'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  count:
                    type: integer
                    description: The total number of traffic types.
                  objects:
                    type: array
                    items:
                      $ref: '#/components/schemas/firewall.traffic_type'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/firewall/traffic_types/{objectid}:
    parameters:
      - $ref: '#/components/parameters/accountid'
      - $ref: '#/components/parameters/objectid'
    get:
      summary: Retrieves the specified traffic type.
      operationId: pyproxy.handlers.firewall.traffic_types.get
      description: Retrieves the traffic type with the specified object ID.
      tags:
        - Firewall Traffic Types
      responses:
        '200':
          description: The specified traffic type object.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/firewall.traffic_type'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/firewall/aliases:
    get:
      summary: Retrieves a list of aliases.
      operationId: pyproxy.handlers.firewall.aliases.find
      description: Retrieves a list of aliases for the account or for a specific
        device or template. If a *device* is specified as a query parameter, 
        only the aliases for that device are retrieved. If a *templateid* is 
        specified as a query parameter, only the aliases for that template are 
        retrieved.
      tags:
        - Firewall Aliases
      parameters:
        - $ref: '#/components/parameters/accountid'
        - $ref: '#/components/parameters/device'
        - $ref: '#/components/parameters/templateid'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  count:
                    type: integer
                    description: The total number of aliases.
                  objects:
                    type: array
                    items:
                      $ref: '#/components/schemas/firewall.alias'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/firewall/aliases/{objectid}:
    parameters:
      - $ref: '#/components/parameters/accountid'
      - $ref: '#/components/parameters/objectid'
    get:
      summary: Retrieves the specified alias.
      operationId: pyproxy.handlers.firewall.aliases.get
      description: Retrieves the alias with the specified object ID.
      tags:
        - Firewall Aliases
      responses:
        '200':
          description: The specified alias object.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/firewall.alias'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/networking/networks:
    get:
      summary: Retrieves a list of networks.
      operationId: pyproxy.handlers.networking.networks.find
      description: Retrieves a list of networks for the account or for a 
        specific device or template. If a *device* is specified as a query 
        parameter, only the networks for that device are retrieved. If a 
        *templateid* is specified as a query parameter, only the networks for 
        that template are retrieved.
      tags:
        - Networking Networks
      parameters:
        - $ref: '#/components/parameters/accountid'
        - $ref: '#/components/parameters/device'
        - $ref: '#/components/parameters/templateid'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  count:
                    type: integer
                    description: The total number of networks.
                  objects:
                    type: array
                    items:
                      $ref: '#/components/schemas/networking.network'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/networking/networks/{objectid}:
    parameters:
      - $ref: '#/components/parameters/accountid'
      - $ref: '#/components/parameters/objectid'
    get:
      summary: Retrieves the specified network.
      operationId: pyproxy.handlers.networking.networks.get
      description: Retrieves the network with the specified object ID.
      tags:
        - Networking Networks
      responses:
        '200':
          description: The specified network object.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/networking.network'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/authentication/users:
    get:
      summary: Retrieves a list of users.
      operationId: pyproxy.handlers.authentication.user.find
      description: Retrieves a list of users for the account or for a specific 
        device or template. If a *device* is specified as a query parameter, 
        only the users for that device are retrieved. If a *templateid* is 
        specified as a query parameter, only the users for that template are 
        retrieved.
      tags:
        - Authentication Users
      parameters:
        - $ref: '#/components/parameters/accountid'
        - $ref: '#/components/parameters/device'
        - $ref: '#/components/parameters/templateid'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  count:
                    type: integer
                    description: The total number of Firebox users.
                  objects:
                    type: array
                    items:
                      $ref: '#/components/schemas/authentication.firebox_user'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/authentication/users/{objectid}:
    parameters:
      - $ref: '#/components/parameters/accountid'
      - $ref: '#/components/parameters/objectid'
    get:
      summary: Retrieves the specified user.
      operationId: pyproxy.handlers.authentication.user.get
      description: Retrieves the user with the specified object ID.
      tags:
        - Authentication Users
      responses:
        '200':
          description: The specified user object.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/authentication.firebox_user'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/authentication/groups:
    get:
      summary: Retrieves a list of groups.
      operationId: pyproxy.handlers.authentication.firebox_group.find
      description: Retrieves a list of groups for the account or for a specific 
        device or template. If a *device* is specified as a query parameter, 
        only the groups for that device are retrieved. If a *templateid* is 
        specified as a query parameter, only the groups for that template are 
        retrieved.
      tags:
        - Authentication Groups
      parameters:
        - $ref: '#/components/parameters/accountid'
        - $ref: '#/components/parameters/device'
        - $ref: '#/components/parameters/templateid'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  count:
                    type: integer
                    description: The total number of groups.
                  objects:
                    type: array
                    items:
                      $ref: '#/components/schemas/authentication.firebox_group'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/authentication/groups/{objectid}:
    parameters:
      - $ref: '#/components/parameters/accountid'
      - $ref: '#/components/parameters/objectid'
    get:
      summary: Retrieves the specified group.
      operationId: pyproxy.handlers.authentication.firebox_group.get
      description: Retrieves the group with the specified object ID.
      tags:
        - Authentication Groups
      responses:
        '200':
          description: The specified group object.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/authentication.firebox_group'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/authentication/auth_groups:
    get:
      summary: Retrieves a list of auth groups.
      operationId: pyproxy.handlers.authentication.auth_group.find
      description: Retrieves a list of auth groups for the account or for a 
        specific device or template. If a *device* is specified as a query 
        parameter, only the auth groups for that device are retrieved. If a 
        *templateid* is specified as a query parameter, only the auth groups for
        that template are retrieved.
      tags:
        - Authentication Auth Groups
      parameters:
        - $ref: '#/components/parameters/accountid'
        - $ref: '#/components/parameters/device'
        - $ref: '#/components/parameters/templateid'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  count:
                    type: integer
                    description: The total number of auth groups.
                  objects:
                    type: array
                    items:
                      $ref: '#/components/schemas/authentication.auth_group'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/authentication/auth_groups/{objectid}:
    parameters:
      - $ref: '#/components/parameters/accountid'
      - $ref: '#/components/parameters/objectid'
    get:
      summary: Retrieves the specified auth group.
      operationId: pyproxy.handlers.authentication.auth_group.get
      description: Retrieves the auth group with the specified object ID.
      tags:
        - Authentication Auth Groups
      responses:
        '200':
          description: The specified auth group object.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/authentication.auth_group'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/authentication/authpoint_user_groups:
    get:
      summary: Retrieves a list of AuthPoint user groups.
      operationId: pyproxy.handlers.authentication.authpoint_user_groups.find
      description: Retrieves a list of AuthPoint user groups.
      tags:
        - Authentication AuthPoint User Groups
      parameters:
        - $ref: '#/components/parameters/accountid'
        - $ref: '#/components/parameters/device'
        - $ref: '#/components/parameters/templateid'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  count:
                    type: integer
                    description: The total number of AuthPoint user groups.
                  objects:
                    type: array
                    items:
                      $ref: '#/components/schemas/authentication.authpoint_user_group'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/authentication/authpoint_user_groups/{objectid}:
    parameters:
      - $ref: '#/components/parameters/accountid'
      - $ref: '#/components/parameters/objectid'
    get:
      summary: Retrieves the specified AuthPoint user group.
      operationId: pyproxy.handlers.authentication.authpoint_user_groups.get
      description: Retrieves the AuthPoint user group with the specified object 
        ID.
      tags:
        - Authentication AuthPoint User Groups
      responses:
        '200':
          description: The specified AuthPoint user group object.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/authentication.authpoint_user_group'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/authentication/saml_user_groups:
    get:
      summary: Retrieves a list of SAML user groups.
      operationId: pyproxy.handlers.authentication.saml_user_group.find
      description: Retrieves a list of SAML user groups.
      tags:
        - Authentication SAML User Groups
      parameters:
        - $ref: '#/components/parameters/accountid'
        - $ref: '#/components/parameters/device'
        - $ref: '#/components/parameters/templateid'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  count:
                    type: integer
                    description: The total number of SAML user groups.
                  objects:
                    type: array
                    items:
                      $ref: '#/components/schemas/authentication.saml_user_group'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/authentication/saml_user_groups/{objectid}:
    parameters:
      - $ref: '#/components/parameters/accountid'
      - $ref: '#/components/parameters/objectid'
    get:
      summary: Retrieves the specified SAML user group.
      operationId: pyproxy.handlers.authentication.saml_user_group.get
      description: Retrieves the SAML user group with the specified object ID.
      tags:
        - Authentication SAML User Groups
      responses:
        '200':
          description: The specified SAML user group object.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/authentication.saml_user_group'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/firewall/snat_actions:
    get:
      summary: Retrieves a list of SNAT actions.
      operationId: pyproxy.handlers.firewall.snat_actions.find
      description: Retrieves a list of SNAT actions for the account or for a 
        specific device or template. If a *device* is specified as a query 
        parameter, only the SNAT actions for that device are retrieved. If a 
        *templateid* is specified as a query parameter, only the SNAT actions 
        for that template are retrieved.
      tags:
        - Firewall SNAT Actions
      parameters:
        - $ref: '#/components/parameters/accountid'
        - $ref: '#/components/parameters/device'
        - $ref: '#/components/parameters/templateid'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  count:
                    type: integer
                    description: The total number of SNAT actions.
                  objects:
                    type: array
                    items:
                      $ref: '#/components/schemas/firewall.snat_action'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/firewall/snat_actions/{objectid}:
    parameters:
      - $ref: '#/components/parameters/accountid'
      - $ref: '#/components/parameters/objectid'
    get:
      summary: Retrieves the specified SNAT action.
      operationId: pyproxy.handlers.firewall.snat_actions.get
      description: Retrieves the SNAT action with the specified object ID.
      tags:
        - Firewall SNAT Actions
      responses:
        '200':
          description: The specified SNAT action object.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/firewall.snat_action'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/networking/sdwans:
    get:
      summary: Retrieves a list of SD-WANs.
      operationId: pyproxy.handlers.networking.sdwans.find
      description: Retrieves a list of SD-WANs for the account or for a specific
        device or template. If a *device* is specified as a query parameter, 
        only the SD-WANs for that device are retrieved. If a *templateid* is 
        specified as a query parameter, only the SD-WANs for that template are 
        retrieved.
      tags:
        - Networking SD-WANs
      parameters:
        - $ref: '#/components/parameters/accountid'
        - $ref: '#/components/parameters/device'
        - $ref: '#/components/parameters/templateid'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  count:
                    type: integer
                    description: The total number of SD-WANs.
                  objects:
                    type: array
                    items:
                      $ref: '#/components/schemas/networking.sdwan'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/networking/sdwans/{objectid}:
    parameters:
      - $ref: '#/components/parameters/accountid'
      - $ref: '#/components/parameters/objectid'
    get:
      summary: Retrieves the specified SD-WAN.
      operationId: pyproxy.handlers.networking.sdwans.get
      description: Retrieves the SD-WAN with the specified object ID.
      tags:
        - Networking SD-WANs
      responses:
        '200':
          description: The specified SD-WAN object.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/networking.sdwan'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/traffic_shaping/rules:
    get:
      summary: Retrieves a list of traffic shaping rules.
      operationId: pyproxy.handlers.traffic_shaping.rules.find
      description: Retrieves a list of traffic shaping rules for the account or 
        for a specific device or template. If a *device* is specified as a query
        parameter, only the traffic shaping rules for that device are retrieved.
        If a *templateid* is specified as a query parameter, only the traffic 
        shaping rules for that template are retrieved.
      tags:
        - Traffic Shaping Rules
      parameters:
        - $ref: '#/components/parameters/accountid'
        - $ref: '#/components/parameters/device'
        - $ref: '#/components/parameters/templateid'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  count:
                    type: integer
                    description: The total number of traffic shaping rules.
                  objects:
                    type: array
                    items:
                      $ref: '#/components/schemas/traffic_shaping.rule'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/traffic_shaping/rules/{objectid}:
    parameters:
      - $ref: '#/components/parameters/accountid'
      - $ref: '#/components/parameters/objectid'
    get:
      summary: Retrieves the specified traffic shaping rule.
      operationId: pyproxy.handlers.traffic_shaping.rules.get
      description: Retrieves the traffic shaping rule with the specified object 
        ID.
      tags:
        - Traffic Shaping Rules
      responses:
        '200':
          description: The specified traffic shaping rule object.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/traffic_shaping.rule'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/system/schedule:
    get:
      summary: Retrieves a list of schedules.
      operationId: pyproxy.handlers.system.schedule.find
      description: Retrieves a list of schedules for the account or for a 
        specific device or template. If a *device* is specified as a query 
        parameter, only the schedules for that device are retrieved. If a 
        *templateid* is specified as a query parameter, only the schedules for 
        that template are retrieved.
      tags:
        - System Schedules
      parameters:
        - $ref: '#/components/parameters/accountid'
        - $ref: '#/components/parameters/device'
        - $ref: '#/components/parameters/templateid'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  count:
                    type: integer
                    description: The total number of schedules.
                  objects:
                    type: array
                    items:
                      $ref: '#/components/schemas/system_schedule'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/system/schedule/{objectid}:
    parameters:
      - $ref: '#/components/parameters/accountid'
      - $ref: '#/components/parameters/objectid'
    get:
      summary: Retrieves the specified schedule.
      operationId: pyproxy.handlers.system.schedule.get
      description: Retrieves the schedule with the specified object ID.
      tags:
        - System Schedules
      responses:
        '200':
          description: The specified schedule object.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/system_schedule'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/content_filtering:
    get:
      summary: Retrieves a list of content filtering rules.
      operationId: pyproxy.handlers.content_filtering.find
      description: Retrieves a list of content filtering rules for the account 
        or for a specific device or template. If a *device* is specified as a 
        query parameter, only the content filtering rules for that device are 
        retrieved. If a *templateid* is specified as a query parameter, only the
        content filtering rules for that template are retrieved.
      tags:
        - Content Filtering
      parameters:
        - $ref: '#/components/parameters/accountid'
        - $ref: '#/components/parameters/device'
        - $ref: '#/components/parameters/templateid'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  count:
                    type: integer
                    description: The total number of content filtering rules.
                  objects:
                    type: array
                    items:
                      $ref: '#/components/schemas/content_filtering'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/content_filtering/{objectid}:
    parameters:
      - $ref: '#/components/parameters/accountid'
      - $ref: '#/components/parameters/objectid'
    get:
      summary: Retrieves the specified content filtering rule.
      operationId: pyproxy.handlers.content_filtering.get
      description: Retrieves the content filtering rule with the specified 
        object ID.
      tags:
        - Content Filtering
      responses:
        '200':
          description: The specified content filtering rule object.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/content_filtering'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

  /v1/configuration/{accountid}/templates/subscribe:
    get:
      summary: Retrieves available Firebox templates, templates subscribed by a 
        Firebox, or Fireboxes subscribed to a Firebox template.
      operationId: pyproxy.handlers.templates.get
      description: >
        With no query parameters, returns templates available to the account, including
        inherited templates.  Retrieves a list of templates subscribed by a Firebox
        when the *device* parameter is specified as a query parameter. If a *templateid*
        is specified as a query parameter, a list of Fireboxes subscribed to a template
        are retrieved.
        The *device* and *templateid* parameters are mutually exclusive.
      tags:
        - Templates
      parameters:
        - $ref: '#/components/parameters/accountid'
        - $ref: '#/components/parameters/device'
        - $ref: '#/components/parameters/templateid'
      responses:
        '200':
          description: Templates subscribed by the device, or devices subscribed
            to the configuration template or templates available to the account.
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/available_templates_response'
                  - $ref: '#/components/schemas/templates_by_device_response'
                  - $ref: '#/components/schemas/devices_by_templateid_response'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'
    post:
      summary: Updates the subscription of Firebox Templates on a Firebox.
      operationId: pyproxy.handlers.templates.post
      description: >
        Subscribes, unsubscribes, or changes the order of Firebox templates on a Firebox.
        Specify only the template IDs in the *templates* parameter that you want the
        Firebox
        to subscribe to. The Firebox is unsubscribed from templates that you do not
        include. An empty *templates* array unsubscribes the Firebox from all templates.
        Specify
        template IDs in the order of priority to apply on the Firebox.
      tags:
        - Templates
      parameters:
        - $ref: '#/components/parameters/accountid'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/template_subscribe_request'
            examples:
              subscribe:
                summary: Subscribe to Firebox templates.
                value:
                  device: '266318'
                  templates:
                    - tmpl_123
                    - tmpl_456
              reorder:
                summary: Change the order of subscribed Firebox templates.
                value:
                  device: '266318'
                  templates:
                    - tmpl_456
                    - tmpl_123
              unsubscribe:
                summary: Unsubscribe from all Firebox templates.
                value:
                  device: '266318'
                  templates: []
      responses:
        '200':
          description: Successfully updated the subscription status of a 
            template on a Firebox.
          content:
            application/json:
              schema:
                type: object
                properties:
                  template_group:
                    $ref: '#/components/schemas/template_group'
                  templates:
                    type: array
                    items:
                      $ref: '#/components/schemas/template'
              example:
                template_group:
                  id: tmplg_266318_XWtrxfPzRRkG3eU
                  account: WGC-1-cddf744733c246adbec5
                  device: '266318'
                  name: device_template_group
                  object: template_group
                  templates:
                    - tmpl_266318_QtD0zFYL5k28tUsg
                    - tmpl_266318_SRNU8MPqJhLrZLXB
                templates:
                  - id: tmpl_266318_QtD0zFYL5k28tUsg
                    account: WGC-1-cddf744733c246adbec5
                    device: '266318'
                    name: htripathi_sp_test_template
                    object: template
                  - id: tmpl_266318_SRNU8MPqJhLrZLXB
                    account: WGC-1-cddf744733c246adbec5
                    device: '266318'
                    name: another_template
                    object: template
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/access_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '405':
          $ref: '#/components/responses/method_denied'
        '500':
          $ref: '#/components/responses/internal_error'

components:
  parameters:
    accountid:
      in: path
      name: accountid
      required: true
      schema:
        type: string
      description: Specifies the WatchGuard Cloud account ID.
      examples:
        WGC-1-123abc456:
          value: WGC-1-123abc456
        ACC-1234567:
          value: ACC-1234567

    objectid:
      in: path
      name: objectid
      required: true
      schema:
        type: string
      description: Object ID.
      example: ipsgp_PUfunqLjBP9cJKHe36df

    device:
      in: query
      name: device
      required: false
      schema:
        type: string
      description: Specifies the Firebox ID in WatchGuard Cloud. For templates 
        api, mutually exclusive with *templateid*. If omitted and *templateid* 
        is also omitted, the request returns templates available to the account.
      examples:
        '136162':
          value: 136162
        FBCL-136162:
          value: FBCL-136162

    tunnel_name:
      in: query
      name: name
      required: false
      schema:
        type: string
        description: VPN IPSec tunnel name.
        minLength: 1
        maxLength: 58

    limit:
      in: query
      name: limit
      required: false
      schema:
        type: integer
      description: Maximum number of exceptions to return in the the response.
      examples:
        '10':
          value: 10

    start_after:
      in: query
      name: start_after
      required: false
      schema:
        type: string
      description: ID of the first exception to return in the response. The 
        value must be a valid exception ID.
      examples:
        bse_12345_ARBHLJ70Y78rGOIGBS:
          value: bse_12345_ARBHLJ70Y78rGOIGBS

    templateid:
      in: query
      name: templateid
      required: false
      schema:
        type: string
      description: Account level Template ID to filter objects. Mutually 
        exclusive with device parameter.For templates api, if omitted and 
        *device* is also omitted, the request returns templates available to the
        account.
      example: tmpl_ABCDEFG

    full:
      in: query
      name: full
      required: false
      schema:
        type: integer
      description: >-
        1 returns full policy objects. 0 or omitted returns a summary list
        (id, name, group, and device).

  responses:
    bad_request:
      description: BAD REQUEST.
      content:
        application/json:
          schema:
            allOf:
              - $ref: '#/components/schemas/error_response'
              - example:
                  type: invalid_request_error
                  message: The request could not be validated.

    access_denied:
      description: ACCESS DENIED.
      content:
        application/json:
          schema:
            allOf:
              - $ref: '#/components/schemas/error_response'
              - example:
                  type: access_denied_error
                  message: The user is not permitted to access the API endpoint.

    not_found:
      description: NOT FOUND.
      content:
        application/json:
          schema:
            allOf:
              - $ref: '#/components/schemas/error_response'
              - example:
                  type: invalid_object_error
                  message: The object could not be found.

    method_denied:
      description: METHOD NOT ALLOWED.
      content:
        application/json:
          schema:
            allOf:
              - $ref: '#/components/schemas/error_response'
              - example:
                  type: method_denied_error
                  message: The target endpoint does not support the request 
                    method.

    internal_error:
      description: INTERNAL ERROR.
      content:
        application/json:
          schema:
            allOf:
              - $ref: '#/components/schemas/error_response'
              - example:
                  type: server_error
                  message: The request could not be processed due to an internal
                    server error.

    conflict:
      description: CONFLICT.
      content:
        application/json:
          schema:
            allOf:
              - $ref: '#/components/schemas/error_response'
              - example:
                  type: object_exists_error
                  message: An object exists with the same ID and version.

  schemas:
    Health:
      type: object
      description: Health check response.
      properties:
        healthy:
          type: boolean
          description: Indicates whether the API is operational.
          default: false

    device_list:
      type: array
      maxItems: 50
      items:
        oneOf:
          - type: string
          - type: integer
      example: [12345, 12346, 12347, FBCL-12345]

    error_response:
      type: object
      description: Error response.
      properties:
        type:
          type: string
          enum:
            - invalid_request_error
            - access_denied_error
            - invalid_object_error
            - method_denied_error
            - object_exists_error
            - server_error
          description: Type of error.
        message:
          type: string
          description: Error message text.
      required:
        - type
        - message

    domain_name:
      type: string
      description: Domain name.
      pattern: ^([a-zA-Z0-9_](([a-zA-Z0-9_-])*[a-zA-Z0-9_])?\.)+([a-zA-Z])+$
      example: example.com

    uint16:
      type: integer
      description: Unsigned 16-bit integer.
      minimum: 0
      maximum: 65535
      example: 443

    ipv4_address_string:
      type: string
      description: IPv4 address string.
      pattern: 
        ^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$
      example: 192.0.2.1

    ipv4_addr_type:
      description: IPv4 address type.
      oneOf:
        - $ref: '#/components/schemas/ipv4_host_type'
        - $ref: '#/components/schemas/ipv4_range_type'
        - $ref: '#/components/schemas/ipv4_network_type'

    ipv4_cidr_string:
      type: string
      description: IPv4 CIDR notation string.
      pattern: 
        ^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)/([1-9]|[1-2][0-9]|3[0-2])$
      example: 192.0.2.0/24

    ipv6_address_string:
      type: string
      description: IPv6 address string.
      pattern: >-
        ^((.{1,64}\|){0,1})((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|:)))$
      example: 2001:db8::1

    ipv6_addr_type:
      description: IPv6 address type.
      oneOf:
        - $ref: '#/components/schemas/ipv6_host_type'
        - $ref: '#/components/schemas/ipv6_range_type'
        - $ref: '#/components/schemas/ipv6_network_type'

    ipv6_cidr_string:
      type: string
      description: IPv6 CIDR notation string.
      pattern: 
        ^((.{1,64}\\|){0,1})((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|:)))/([0-9]|[1-9][0-9]|1[0-1][0-9]|12[0-8])$
      example: 2001:db8::/32

    ipv4_host_type:
      type: object
      description: IPv4 address.
      properties:
        type:
          type: string
          description: Address type identifier.
          enum:
            - ipv4_host
        value:
          description: IPv4 host address.
          $ref: '#/components/schemas/ipv4_address_string'
      required:
        - type
        - value

    ipv4_network_type:
      type: object
      description: IPv4 network.
      properties:
        type:
          type: string
          description: Address type identifier.
          enum:
            - ipv4_network
        value:
          description: IPv4 network address in CIDR notation.
          $ref: '#/components/schemas/ipv4_cidr_string'
      required:
        - type
        - value

    ipv4_range_type:
      type: object
      description: IPv4 address range.
      properties:
        type:
          type: string
          description: Address type identifier.
          enum:
            - ipv4_range
        value:
          type: string
          description: IPv4 address range in start-end format.
          pattern: 
            ^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)-(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$
          example: 192.0.2.1-192.0.2.5
      required:
        - type
        - value

    ipv6_host_type:
      type: object
      description: IPv6 address.
      required:
        - type
        - value
      properties:
        type:
          type: string
          description: Address type identifier.
          enum:
            - ipv6_host
        value:
          description: IPv6 host address.
          $ref: '#/components/schemas/ipv6_address_string'

    ipv6_network_type:
      type: object
      description: IPv6 network.
      required:
        - type
        - value
      properties:
        type:
          type: string
          description: Address type identifier.
          enum:
            - ipv6_network
        value:
          description: IPv6 network address in CIDR notation.
          $ref: '#/components/schemas/ipv6_cidr_string'

    ipv6_range_type:
      type: object
      description: IPv6 address range.
      required:
        - type
        - value
      properties:
        type:
          type: string
          description: Address type identifier.
          enum:
            - ipv6_range
        value:
          type: string
          description: IPv6 address range in start-end format.
          pattern: 
            ^((.{1,64}\\|){0,1})((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|:)))-((.{1,64}\\|){0,1})((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|:)))$
          example: 2001:db8::1-2001:db8::ff

    fqdn_type:
      type: object
      description: FQDN.
      properties:
        type:
          type: string
          description: Address type identifier.
          enum:
            - fqdn
        value:
          type: string
          description: Fully qualified domain name.
          pattern: 
            ^(\*\.)?([a-zA-Z0-9_](([a-zA-Z0-9_-])*[a-zA-Z0-9_])?\.)+([a-zA-Z])+$
          example: example.com
      required:
        - type
        - value

    mac_address_string:
      type: string
      pattern: ^([0-9a-fA-F]{2}[:]){5}[0-9a-fA-F]{2}$

    reservation_name_string:
      type: string
      minLength: 1
      maxLength: 63
      pattern: 
        ^([a-zA-Z0-9]([-.a-zA-Z0-9]*[a-zA-Z0-9]))*([a-zA-Z0-9][-a-zA-Z0-9]*)?([a-zA-Z0-9])$

    domain_type:
      type: object
      properties:
        type:
          type: string
          enum:
            - domain
        value:
          $ref: '#/components/schemas/domain_name'
      required:
        - type
        - value

    hostname_string:
      type: string
      minLength: 1
      maxLength: 63
      pattern: ^([a-zA-Z0-9_]*|[a-zA-Z0-9_][a-zA-Z0-9_-]*)[a-zA-Z0-9_]$

    duid_string:
      type: string
      pattern: ^([0-9a-fA-F]{2}:)*[0-9a-fA-F]{2}$
      minLength: 1
      maxLength: 128

    email_or_username:
      type: string
      minLength: 1
      maxLength: 64
      pattern: 
        ^([a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}|[a-zA-Z0-9._%+-]+)$

    object_metadata:
      type: object
      description: Common metadata for all API objects.
      properties:
        id:
          type: string
          description: Represents the unique identifier of the object.
        object:
          type: string
          description: Type of object.
        version:
          type: integer
          description: Version number of the object.
          example: 1
        account:
          type: string
          description: Your WatchGuard Cloud account ID.
          example: WGC-1-123abc456
        created:
          type: integer
          description: Object creation time in Unix epoch time format.
          example: 1579907960
        device:
          oneOf:
            - type: string
            - type: integer
          description: Specifies the device this object applies to.
          example: 12345, "FBCL-12345"
        author:
          type: string
          description: Author of the object. This is always empty for objects 
            added or updated with the Firebox Management API.
      required:
        - id
        - object
        - version
        - account
        - created
        - author

    new_object_attributes:
      type: object
      properties:
        device:
          oneOf:
            - type: string
            - type: integer
          description: Device this object applies to. Each device has a unique 
            ID number in WatchGuard Cloud, which appears in the URL of the 
            Device Summary page for the device.
          example: 12345, "FBCL-12345"

    object_update_attributes:
      type: object
      description: Attributes required to update an object.
      properties:
        version:
          type: integer
          description: Specifies the version number of the object to update.
          example: 1
      required:
        - version

    blocked_site_exception_base:
      type: object
      properties:
        description:
          type: string
          maxLength: 127
          description: 'Description of the blocked sites exception. Letters, numbers,
            spaces, commas, and (-_+.*:@/;) only. Maximum: 127 characters.'
          example: Block example.com
        address:
          oneOf:
            - $ref: '#/components/schemas/ipv4_addr_type'
            - $ref: '#/components/schemas/fqdn_type'
          description: Address of the site to allow or block.
        action:
          type: string
          enum:
            - allow
            - block
          default: allow
          description: Action to take for the specified address, either allow or
            block. Allow adds the address to the Blocked Sites Exception list. 
            Block adds the address to the Blocked Sites list.
          example: block
      required:
        - address

    blocked_site_exception:
      description: Blocked sites exception.
      allOf:
        - $ref: '#/components/schemas/object_metadata'
        - $ref: '#/components/schemas/new_object_attributes'
        - $ref: '#/components/schemas/blocked_site_exception_base'
      example:
        id: bse_12345_ARBHLJ70Y78rGOIGBS
        object: blockedsite_exception
        version: 1
        account: WGC-1-123abc456
        created: 1579907960
        device: 12345
        author: testuser
        description: Block example.com
        address:
          type: fqdn
          value: example.com
        action: block

    botnet_exception_base:
      type: object
      properties:
        description:
          type: string
          maxLength: 127
          description: 'Description of the botnet site exception. Letters, numbers,
            spaces, commas, and (-_+.*:@/;) only. Maximum: 127 characters.'
          example: Allow example.com
        address:
          oneOf:
            - $ref: '#/components/schemas/ipv4_addr_type'
            - $ref: '#/components/schemas/fqdn_type'
          description: Address of the exception.
      required:
        - address

    botnet_exception:
      description: Botnet site exception.
      allOf:
        - $ref: '#/components/schemas/object_metadata'
        - $ref: '#/components/schemas/new_object_attributes'
        - $ref: '#/components/schemas/botnet_exception_base'
        - example:
            id: bote_CjBY92ourN7Izaa1jJu3eH5
            object: botnet_exception
            version: 1
            account: WGC-1-123abc456
            created: 1579907960
            device: 12345
            author: testuser
            description: Allow example.com
            address:
              type: fqdn
              value: example.com

    file_exception_base:
      type: object
      properties:
        action:
          type: string
          enum:
            - allow
            - drop
          description: Action to take for the specified file, either allow or 
            drop.
        description:
          type: string
          maxLength: 127
          description: 'Description of the file exception. Maximum: 127 characters.'
          example: Allow Sales Presentation.
        md5:
          type: string
          pattern: ^[a-f0-9]{32}$
          description: MD5 hash of the file. Must be 32 characters (lowercase 
            letters a-f and numbers only).
          example: d2ffd57b48ee2ac34a4797ea44571a05
      required:
        - action
        - md5

    file_exception:
      description: File exception.
      allOf:
        - $ref: '#/components/schemas/object_metadata'
        - $ref: '#/components/schemas/new_object_attributes'
        - $ref: '#/components/schemas/file_exception_base'
        - example:
            id: file_12345_UqhDVIdx8D5iwivAX
            object: file_exception
            version: 1
            account: WGC-1-123abc456
            created: 1579907960
            device: 12345
            author: testuser
            description: Allow Sales Presentation.
            md5: d2ffd57b48ee2ac34a4797ea44571a05
            action: allow

    geolocation_exception_base:
      type: object
      properties:
        description:
          type: string
          maxLength: 127
          description: 'Description of the Geolocation exception. Letters, numbers,
            spaces, commas, and (-_+.*:@/;) only. Maximum: 127 characters.'
          example: Allow example.com
        address:
          oneOf:
            - $ref: '#/components/schemas/ipv4_addr_type'
            - $ref: '#/components/schemas/fqdn_type'
          description: Address of the exception.
      required:
        - address

    geolocation_exception:
      description: Geolocation exception.
      allOf:
        - $ref: '#/components/schemas/object_metadata'
        - $ref: '#/components/schemas/new_object_attributes'
        - $ref: '#/components/schemas/geolocation_exception_base'
        - example:
            id: geoe_12345_aHbWC5IuWO3qzyV2t
            object: geolocation_exception
            version: 1
            account: WGC-1-123abc456
            created: 1579907960
            device: 12345
            author: testuser
            description: Allow example.com
            address:
              type: fqdn
              value: example.com

    ips_exception_base:
      type: object
      properties:
        action:
          type: string
          enum:
            - allow
            - block
            - drop
          description: Action to take for the specified signature, either allow,
            block, or drop.
        alarm:
          type: boolean
          default: false
          description: Specifies whether the Firebox sends an alarm for the IPS 
            exception.
          example: true
        description:
          type: string
          maxLength: 127
          description: 'Description of the IPS signature exception. Maximum: 127 characters.'
          example: Drop signature 1055124
        signature_id:
          type: string
          pattern: ^[0-9]{1,31}$
          description: 'IPS signature ID. Must contain only numbers. Maximum: 31 characters.'
          example: 1055124
      required:
        - action
        - signature_id

    ips_exception:
      description: IPS signature exception.
      allOf:
        - $ref: '#/components/schemas/object_metadata'
        - $ref: '#/components/schemas/new_object_attributes'
        - $ref: '#/components/schemas/ips_exception_base'
        - example:
            id: ipse_12345_eY5Jwxv1nE3Xlk3zx
            object: ips_exception
            device: 12345
            version: 1
            account: WGC-1-123abc456
            created: 1579907960
            author: testuser
            description: Drop signature 1055124
            signature_id: 1054265
            action: drop

    webblocker_exception_base:
      type: object
      properties:
        action:
          type: string
          enum:
            - allow
            - deny
          description: Action to take for the WebBlocker exception, either allow
            or deny.
        alarm:
          type: boolean
          default: false
          description: Specifies whether the Firebox sends an alarm for the 
            WebBlocker exception.
          example: true
        name:
          type: string
          pattern: ^([A-Za-z0-9\-\ \_\+\.\*\)\(]|[^\x00-\x7f])+$
          maxLength: 58
          description: 'Name of the WebBlocker exception. Maximum: 58 characters.'
          example: Allow example.com
        rule_type:
          type: string
          enum:
            - string
            - pattern
            - regexp
          description: The type of rule, either string (exact match), pattern 
            (pattern match), or regexp (regular expression).
        rule:
          type: string
          pattern: ^(?=.*\S).+$
          maxLength: 255
          description: 'The URL pattern, value, or expression to match. Maximum: 255
            characters.'
          example: www.example.com/*, 1.1.1.1, or (www\.)?example\.[com|net]
      required:
        - action
        - name
        - rule_type
        - rule

    webblocker_exception:
      description: WebBlocker exception.
      allOf:
        - $ref: '#/components/schemas/object_metadata'
        - $ref: '#/components/schemas/new_object_attributes'
        - $ref: '#/components/schemas/webblocker_exception_base'
        - example:
            id: wbe_12124_7HM70EvrifZ7rSfXSA
            object: webblocker_exception
            device: 12345
            version: 1
            account: WGC-1-123abc456
            created: 1579907960
            author: testuser
            name: Allow www.example.com
            rule_type: string
            rule: www.example.com/*
            action: allow

    device:
      type: object
      description: Firebox device identifier.
      properties:
        device:
          oneOf:
            - type: string
            - type: integer
          description: Specifies the WatchGuard Cloud Firebox device ID.

    devices:
      type: array
      minItems: 1
      maxItems: 100
      items:
        type: string
      description: List of WatchGuard Cloud Firebox device IDs.

    bovpn.ipsec.tunnel_list:
      type: array
      items:
        $ref: '#/components/schemas/bovpn.ipsec.tunnel'

    bovpn.ipsec.tunnel:
      description: BOVPN IPSec configuration.
      allOf:
        - $ref: '#/components/schemas/object_metadata'
        - $ref: '#/components/schemas/bovpn.ipsec.tunnel_base'

    bovpn.ipsec.tunnel_base:
      type: object
      required:
        - name
        - endpoint_a
        - interfaces
        - routes
      properties:
        name:
          type: string
          description: VPN IPSec tunnel name.
          minLength: 1
          maxLength: 58
        endpoint_a:
          description: Endpoint_A device ID.
          type: string
        endpoint_b:
          description: Endpoint_B device ID.
          type: string
        endpoint_b_name:
          description: Non cloud managed device name.
          type: string
        disabled:
          description: IPSec tunnel is disabled.
          type: boolean
          default: false
        vpn_type:
          description: VPN IPSec tunnel type. Default value is set as BOVPN-VIF.
          type: string
          enum:
            - policy-based
            - route-based
          default: route-based
        address_family:
          description: IP address family for all gateway endpoints.
          type: integer
          enum:
            - 4
            - 6
          default: 4
        auth_method:
          description: Local authentication method.
          type: string
          enum:
            - psk
            - certificate
          default: psk
        interfaces:
          type: array
          description: VPN IPSec gateway endpoints.
          minItems: 1
          uniqueItems: true
          items:
            type: object
            required:
              - endpoint_a
              - endpoint_b
            properties:
              endpoint_a:
                $ref: '#/components/schemas/bovpn.ipsec.gateway_endpoint_interface'
              endpoint_b:
                $ref: '#/components/schemas/bovpn.ipsec.gateway_endpoint_interface'
              df_bit:
                description: Policy based BOVPN - Optional DF bit settings.
                type: string
                enum:
                  - copy
                  - set
                  - clear
              pmtu_minimum:
                description: Optional per endpoint minimum PMTU in bytes.
                type: integer
                minimum: 68
                maximum: 1550
              pmtu_age:
                description: Optional per endpoint PMTU aging time in minutes.
                type: integer
                minimum: 60
                maximum: 2147483647
        routes:
          type: object
          properties:
            endpoint_a:
              $ref: '#/components/schemas/bovpn.ipsec.gateway_vif_routes'
            endpoint_b:
              $ref: '#/components/schemas/bovpn.ipsec.gateway_vif_routes'
        vif:
          type: object
          required:
            - endpoint_a
          properties:
            endpoint_a:
              $ref: '#/components/schemas/bovpn.ipsec.gateway_vif'
            endpoint_b:
              $ref: '#/components/schemas/bovpn.ipsec.gateway_vif'
        certs:
          description: Certificate object reference for each endpoint.
          type: object
          required:
            - endpoint_a
          properties:
            endpoint_a:
              type: string
            endpoint_b:
              type: string
        psk:
          $ref: '#/components/schemas/bovpn.ipsec.pre_shared_key'
        psk_encrypted:
          type: boolean
          description: Indicates the given PSK is already encrypted.
        shared_p1_settings:
          type: boolean
          default: false
        ipsec_tunnel_core:
          $ref: '#/components/schemas/bovpn.ipsec.ipsec_tunnel_core'
        local_remote_pairs:
          type: array
          description: Customized local and remote endpoint pairs.
          uniqueItems: true
          items:
            type: object
            required:
              - enabled
              - remote_address
              - direction
            properties:
              enabled:
                type: boolean
              local_network:
                type: string
                description: Name of network.
              local_address:
                oneOf:
                  - $ref: '#/components/schemas/ipv4_cidr_string'
                  - $ref: '#/components/schemas/ipv6_cidr_string'
              remote_address:
                oneOf:
                  - $ref: '#/components/schemas/ipv4_cidr_string'
                  - $ref: '#/components/schemas/ipv6_cidr_string'
              direction:
                type: string
                enum:
                  - in
                  - out
                  - bi
              dnat_ip:
                $ref: '#/components/schemas/ipv4_address_string'
              nat_base:
                $ref: '#/components/schemas/ipv4_cidr_string'

    bovpn.ipsec.gateway_endpoint_interface:
      type: object
      properties:
        network:
          type: string
          description: Name of network.
        ip_address:
          oneOf:
            - $ref: '#/components/schemas/ipv4_address_string'
            - $ref: '#/components/schemas/ipv6_address_string'
            - type: string
              enum:
                - Dynamic
        id:
          type: object
          required:
            - type
            - value
          properties:
            type:
              description: Gateway endpoint ID type.
              type: string
              enum:
                - ip
                - fqdn
                - ufqdn
                - x500_name
              default: ip
            value:
              description: Gateway endpoint ID data.
              type: string
              minLength: 0
              maxLength: 255
        perpetual_resolve:
          description: Enable to re-resolve domains when rebuilding tunnels.
          type: boolean

    bovpn.ipsec.gateway_vif_routes:
      description: Gateway VIF routes.
      type: object
      properties:
        local_networks:
          type: array
          minItems: 1
          uniqueItems: true
          items:
            type: object
            required:
              - network
            properties:
              network:
                type: string
                description: Name of network.
              metric:
                $ref: '#/components/schemas/bovpn.ipsec.gateway_vif_route_metric'
              nat_base:
                $ref: '#/components/schemas/ipv4_cidr_string'
              dnat_ip:
                $ref: '#/components/schemas/ipv4_address_string'
        local_routes:
          type: array
          minItems: 1
          uniqueItems: true
          items:
            type: object
            required:
              - route
            properties:
              route:
                oneOf:
                  - $ref: '#/components/schemas/ipv4_cidr_string'
                  - $ref: '#/components/schemas/ipv6_cidr_string'
              metric:
                $ref: '#/components/schemas/bovpn.ipsec.gateway_vif_route_metric'
              nat_base:
                $ref: '#/components/schemas/ipv4_cidr_string'
              dnat_ip:
                $ref: '#/components/schemas/ipv4_address_string'

    bovpn.ipsec.gateway_vif_route_metric:
      description: VIF route metric.
      type: integer
      default: 1

    bovpn.ipsec.gateway_vif:
      description: Gateway VIF.
      type: object
      properties:
        vif_dev_name:
          type: string
          description: VIF device name.
        vif_local_ip:
          oneOf:
            - $ref: '#/components/schemas/ipv4_cidr_string'
            - $ref: '#/components/schemas/ipv6_cidr_string'
        vif_remote_ip:
          oneOf:
            - $ref: '#/components/schemas/ipv4_cidr_string'
            - $ref: '#/components/schemas/ipv6_cidr_string'
        vif_mtu:
          description: VIF MTU
          type: integer
          minimum: 68
          maximum: 9000
        vif_df_bit:
          description: Optional per endpoint VIF DF bit settings.
          type: string
          enum:
            - copy
            - set
            - clear

    bovpn.ipsec.pre_shared_key:
      type: string
      description: IPSec pre-shared key.
      minLength: 8

    bovpn.ipsec.ipsec_tunnel_core:
      description: VPN IPSec tunnel core configuration.
      type: object
      properties:
        natt_interval:
          description: IKE NAT-T keep-alive interval in seconds.
          type: integer
          minimum: 1
          maximum: 65535
          default: 20
        dpd:
          description: DPD configuration.
          type: object
          properties:
            enabled:
              description: DPD enabled.
              type: boolean
              default: true
            dpd_type:
              description: IKE DPD type.
              type: string
              enum:
                - traffic
                - timer
              default: traffic
            idle_time:
              description: IKE DPD idle time in seconds.
              type: integer
              minimum: 10
              maximum: 300
              default: 30
            retries:
              description: IKE DPD maximum retries.
              type: integer
              minimum: 1
              maximum: 30
              default: 5
            interval:
              description: IKE DPD timer based message interval in seconds.
              type: integer
              minimum: 10
              maximum: 300
              default: 30
            max_failures:
              description: IKE DPD timer based max failures.
              type: integer
              minimum: 1
              maximum: 30
              default: 5
        ike_proposals:
          description: IKE phase-1 proposals.
          type: array
          minItems: 1
          maxItems: 1
          uniqueItems: true
          items:
            type: object
            properties:
              encryption:
                type: string
                enum:
                  - AES-CBC-128
                  - AES-CBC-192
                  - AES-CBC-256
                  - AES-GCM-128
                  - AES-GCM-192
                  - AES-GCM-256
                default: AES-CBC-256
              authentication:
                type: string
                enum:
                  - SHA2-256
                  - SHA2-384
                  - SHA2-512
                default: SHA2-256
              dh_group:
                type: string
                enum:
                  - DH-14
                  - DH-15
                  - DH-19
                  - DH-20
                  - DH-21
                default: DH-14
              lifetime:
                type: integer
                minimum: 1
                default: 24
              lifetime_unit:
                type: string
                enum:
                  - hours
                  - minutes
                default: hours
        pfs_dh_group:
          description: PFS DH-Group
          type: string
          enum:
            - DH-14
            - DH-15
            - DH-19
            - DH-20
            - DH-21
        ipsec_proposals:
          description: IKE phase-2 (IPSec) proposals.
          type: array
          minItems: 1
          maxItems: 1
          uniqueItems: true
          items:
            type: object
            properties:
              protocol:
                type: string
                enum:
                  - ESP
                default: ESP
              encryption:
                type: string
                enum:
                  - AES-CBC-128
                  - AES-CBC-192
                  - AES-CBC-256
                  - AES-GCM-128
                  - AES-GCM-192
                  - AES-GCM-256
                default: AES-CBC-256
              authentication:
                type: string
                enum:
                  - SHA2-256
                  - SHA2-384
                  - SHA2-512
                default: SHA2-256
              lifetime:
                type: integer
                minimum: 1
                default: 8
              lifetime_unit:
                type: string
                enum:
                  - hours
                  - minutes
                default: hours
              lifebyte:
                type: integer
                minimum: 0
                default: 0
              lifebyte_unit:
                type: string
                enum:
                  - MB
                  - GB
                default: GB

    bovpn.ipsec.shared_p1:
      description: BOVPN IPSec P1 shared settings.
      allOf:
        - $ref: '#/components/schemas/object_metadata'
        - $ref: '#/components/schemas/new_object_attributes'
        - $ref: '#/components/schemas/bovpn.ipsec.shared_p1_base'

    bovpn.ipsec.shared_p1_base:
      type: object
      required:
        - ike_proposals
      properties:
        ike_proposals:
          description: IKE phase-1 proposals.
          type: array
          minItems: 1
          maxItems: 8
          uniqueItems: true
          items:
            type: object
            properties:
              encryption:
                type: string
                enum:
                  - AES-CBC-128
                  - AES-CBC-192
                  - AES-CBC-256
                  - AES-GCM-128
                  - AES-GCM-192
                  - AES-GCM-256
                default: AES-CBC-256
              authentication:
                type: string
                enum:
                  - SHA2-256
                  - SHA2-384
                  - SHA2-512
                default: SHA2-256
              dh_group:
                type: string
                enum:
                  - DH-14
                  - DH-15
                  - DH-19
                  - DH-20
                  - DH-21
                default: DH-14
              lifetime:
                type: integer
                minimum: 1
                default: 24
              lifetime_unit:
                type: string
                enum:
                  - hours
                  - minutes
                default: hours
        natt_interval:
          description: IKE NAT-T keep-alive interval in seconds.
          type: integer
          minimum: 1
          maximum: 65535
          default: 20
      example:
        ike_proposals:
          - encryption: AES-GCM-256
            authentication: SHA2-512
            dh_group: DH-21
            lifetime: 8
        natt_interval: 20

    system.certificate_list:
      type: array
      items:
        $ref: '#/components/schemas/system.certificate'

    system.certificate:
      description: Certificate
      allOf:
        - $ref: '#/components/schemas/object_metadata'
        - $ref: '#/components/schemas/system.certificate_base'
        - $ref: '#/components/schemas/system.certificate_details'

    system.certificate_base:
      type: object
      oneOf:
        - type: object
          description: Request to create an alias object for a specific device.
          required:
            - alias
          properties:
            alias:
              type: string
              description: Set the name of an account certificate object.
        - type: object
          description: Request to import a certificate.
          required:
            - name
          properties:
            name:
              $ref: '#/components/schemas/name_string'
            description:
              $ref: '#/components/schemas/description_string'
            pem:
              type: string
            pvt_key:
              type: string
            pfx:
              type: string
            password:
              type: string

    system.certificate_details:
      type: object
      properties:
        cert_type:
          type: string
        skid:
          type: string
        akid:
          type: string
        cert_fingerprint:
          type: string
        pubkey_fingerprint:
          type: string
        subject_name_fingerprint:
          type: string
        subject:
          type: string
        subject_alt:
          type: array
          minItems: 1
          items:
            type: string
        subject_alt_dns:
          type: array
          minItems: 1
          items:
            type: string
        subject_alt_ips:
          type: array
          minItems: 1
          items:
            type: string
        subject_alt_emails:
          type: array
          minItems: 1
          items:
            type: string
        issuer:
          type: string
        algorithm:
          type: string
        signature_algo:
          type: string
        key_length:
          type: string
        key_usage:
          type: array
          minItems: 1
          items:
            type: string
        extended_key_usage:
          type: array
          minItems: 1
          items:
            type: string
        valid_from:
          type: integer
        expiration:
          type: integer

    name_string:
      type: string
      description: 'Object name. Maximum: 58 characters.'
      minLength: 1
      maxLength: 58
      pattern: ^([A-Za-z0-9\-\ \_\+\.\*]|[^\x00-\x7f])+$

    description_string:
      type: string
      description: 'Object description. Maximum: 127 characters.'
      maxLength: 127

    device_transaction:
      type: object
      properties:
        id:
          type: string
          description: Unique ID that identifies this device transaction.
          example: ddply_12345_J2VwPbXuek3CRGN1
        object:
          type: string
          description: Device object type.
          example: device_deployment
        device:
          type: string
          description: Device this transaction applies to. Each device has a 
            unique ID number in WatchGuard Cloud, which appears in the URL of 
            the Device Summary page.
          example: '12345'
        inception_time:
          type: integer
          description: Time that the transaction was created, in seconds since 
            epoch.
          example: 1714684162
        start_date:
          type: string
          description: Time to deploy the transaction to the device, in UTC 
            format.
          example: '2020-02-21T19:48:19Z'
        status:
          type: string
          enum:
            - scheduled
            - imaged
            - pending
            - in_progress
            - complete
            - failed
          description: Status of the transaction.
        account:
          type: string
          description: Your WatchGuard Cloud account ID.
          example: WGC-1-123abc456
        original_author_username:
          type: string
          description: Operator that added the transaction. This is always empty
            for transactions added with the Firebox Management API.
      required: [id, object, device, inception_time, start_date, status, account,
        operator]
      example:
        account: WGC-1-123abc456
        original_author_username:
        device: '12345'
        id: ddply_12345_J2VwPbXuek3CRGN1
        status: complete
        start_date: '2020-03-04T18:54:48Z'
        object: device_deployment
        inception_time: 1714684162

    system_alias_type:
      type: object
      description: System-defined firewall aliases.
      required:
        - type
        - value
      properties:
        type:
          type: string
          description: Match type identifier.
          enum:
            - system_alias
        value:
          type: string
          description: System alias name.
          enum:
            - Any
            - Firebox
            - Any-BOVPN
            - Any-Guest
            - Any-Internal
            - Any-External
            - Microsoft365

    firewall.policy_summary:
      type: object
      description: Firewall policy summary.
      required:
        - id
        - name
      properties:
        id:
          type: string
        name:
          $ref: '#/components/schemas/name_string'
        group:
          type: string
          description: Specifies the name of the policy group.
        device:
          type: string
          description: Firebox device identifier.

    firewall.policy:
      description: Firewall policy object.
      allOf:
        - $ref: '#/components/schemas/object_metadata'
        - $ref: '#/components/schemas/firewall.policy_base'

    firewall.policy_base:
      allOf:
        - type: object
          description: Common settings for policies of any type.
          required:
            - name
            - enabled
            - group
            - action
            - traffic_types
            - sources
            - destinations
          properties:
            name:
              $ref: '#/components/schemas/name_string'
            description:
              $ref: '#/components/schemas/description_string'
            enabled:
              type: boolean
              description: Indicates whether the policy is enabled.
              default: true
            group:
              type: string
              description: >-
                Name of the Policy group or Reference of the Policy group configuration
                object this policy belongs to.  Valid names of a Policy group are:
                First Run Policies, Last Run Policies & Core Policies.
            hidden:
              type: boolean
              description: Indicates whether this policy is visible to end 
                users. [Deprecated] Policy visibility is now controlled by user 
                preference.
              default: false
            immutable:
              type: boolean
              description: Indicates whether end users can modify this policy.
              default: false
            permanent:
              type: boolean
              description: Indicates whether the policy is permanent for a 
                device, that is, cannot be deleted by end users.
              default: false
            togglable:
              type: boolean
              description: Indicates whether end users can only toggle this 
                policy on or off. This property should be combined with 
                immutable to determine whether the policy is only togglable by 
                the end user.
              default: false
            action:
              type: string
              description: Defines the action to take for traffic that matches 
                this policy, either allow or deny.
              enum:
                - allow
                - deny
              default: allow
            traffic_types:
              type: array
              description: >-
                Name of the traffic types or References to traffic types to match
                against a connection.  Must not be empty unless the policy type is
                outbound and web traffic is enabled.
              uniqueItems: true
              items:
                type: string
            sources:
              type: array
              description: Lists source addresses or objects to match against a 
                connection.
              minItems: 1
              uniqueItems: true
              items:
                $ref: '#/components/schemas/firewall.policy_match_type'
            destinations:
              type: array
              description: Lists destination addresses or objects to match 
                against a connection.
              minItems: 1
              uniqueItems: true
              items:
                oneOf:
                  - $ref: '#/components/schemas/firewall.policy_match_type'
                  - type: object
                    description: Firewall SNAT action reference.
                    required:
                      - type
                      - value
                    properties:
                      type:
                        type: string
                        description: Match type identifier.
                        enum:
                          - firewall_snat_action
                      value:
                        type: string
                        description: Specifies the name of the SNAT action or 
                          reference to an SNAT action configuration object.
            sdwan:
              type: string
              description: Specifies the name of the SD-WAN action or reference 
                to an SD-WAN action configuration object.
            geolocation:
              type: object
              description: Geolocation action settings.
              properties:
                enabled:
                  type: boolean
                  description: Indicates whether Geolocation is enabled for this
                    policy.
                  default: true
                action:
                  type: string
                  description: Specifies the name of the Geolocation action or 
                    reference to a Geolocation action configuration object.
            tor_nodes:
              type: boolean
              description: Indicates whether to block traffic from Tor exit 
                nodes.
              default: false
            idle_timeout:
              type: object
              description: Idle timeout settings for this policy.
              properties:
                override_global:
                  type: boolean
                  description: Indicates whether to override the global idle 
                    timeout setting.
                  default: false
                value:
                  type: integer
                  description: Idle timeout value in seconds.
                  default: 180
            nat:
              type: object
              description: Network Address Translation (NAT) settings.
              properties:
                global_one_to_one_nat:
                  type: object
                  description: Global 1-to-1 NAT settings.
                  properties:
                    enabled:
                      type: boolean
                      description: Indicates whether 1-to-1 NAT is enabled for 
                        this policy.
                      default: true
                dynamic_nat:
                  type: object
                  description: Dynamic NAT settings.
                  properties:
                    enabled:
                      type: boolean
                      description: Indicates whether dynamic NAT is enabled.
                      default: true
                    type:
                      type: string
                      description: Dynamic NAT type, either global or 
                        per_policy.
                      enum:
                        - global
                        - per_policy
                      default: global
                    source_ip:
                      type: object
                      description: Stores dynamic NAT source IP address 
                        settings.
                      properties:
                        enabled:
                          type: boolean
                          description: Indicates whether a specific source IP 
                            address is set.
                          default: false
                        ipv4_address:
                          description: Specifies the source IPv4 address for 
                            dynamic NAT.
                          $ref: '#/components/schemas/ipv4_address_string'
            sticky_connection:
              type: object
              description: Sticky connection settings for this policy.
              properties:
                override_global:
                  type: boolean
                  description: Indicates whether to override the global sticky 
                    connection setting.
                  default: false
                interval:
                  type: integer
                  description: Sticky connection interval in seconds.
                  default: 180
            connection_rate_limit:
              type: object
              description: Connection rate limit settings.
              required:
                - enabled
              properties:
                enabled:
                  type: boolean
                  description: Indicates whether connection rate limiting is 
                    enabled.
                  default: false
                connection_rate:
                  type: integer
                  description: Maximum number of connections per second.
                  minimum: 1
                  maximum: 100000
                  default: 100
                alarm:
                  type: boolean
                  description: Indicates whether to send an alarm when the rate 
                    limit is exceeded.
                  default: false
            notifications:
              type: object
              description: Notification settings for this policy.
              properties:
                enabled:
                  type: boolean
                  description: Indicates whether notifications are enabled.
                  default: false
                snmp:
                  type: boolean
                  description: Indicates whether to send SNMP notifications.
                  default: false
            traffic_shaping:
              type: string
              description: Specifies the name of the traffic shaping rule or 
                reference to a traffic shaping configuration object.
            qos:
              type: object
              description: Quality of Service (QoS) marking settings.
              required:
                - marking_type
                - method
              properties:
                marking_type:
                  type: string
                  description: QoS marking type, either dscp or ip_precedence.
                  default: ip_precedence
                  enum:
                    - dscp
                    - ip_precedence
                method:
                  type: string
                  description: QoS marking method, either preserve, clear, or 
                    assign.
                  default: preserve
                  enum:
                    - preserve
                    - clear
                    - assign
                value:
                  type: integer
                  description: QoS marking value. Valid values depend on the 
                    marking type.
                  default: 0
                  anyOf:
                    - minimum: 0
                      maximum: 7
                      description: Valid values for ip_precedence.
                    - enum:
                        - 0
                        - 8
                        - 10
                        - 12
                        - 14
                        - 16
                        - 18
                        - 20
                        - 22
                        - 24
                        - 26
                        - 28
                        - 30
                        - 32
                        - 34
                        - 36
                        - 38
                        - 40
                        - 46
                        - 48
                        - 56
                      description: Valid values for dscp.
            smtp_setting:
              type: object
              description: SMTP proxy settings for this policy.
              required:
                - max_email_size
              properties:
                max_email_size:
                  description: Maximum email message size in MB.
                  type: integer
                  default: 20
                  minimum: 1
                  maximum: 150
            schedule:
              type: string
              description: Specifies the name of the schedule or reference to a 
                schedule configuration object.
        - oneOf:
            - type: object
              description: Type-specific settings for First Run or Last Run 
                policies.
              required:
                - type
              properties:
                type:
                  type: string
                  description: Defines the policy type, either first or last.
                  enum:
                    - first
                    - last
                content_filtering:
                  type: object
                  description: Content filtering action settings.
                  properties:
                    enabled:
                      type: boolean
                      description: Indicates whether content filtering is 
                        enabled.
                      default: true
                    action:
                      type: string
                      description: Specifies the name of the content filtering 
                        action or reference to a content filtering action 
                        configuration object.
            - type: object
              description: Type-specific settings for Outbound policies.
              required:
                - type
              properties:
                type:
                  description: Defines the policy type.
                  type: string
                  enum:
                    - outbound
                web_traffic:
                  type: object
                  description: Web traffic inspection settings for selected 
                    ports.
                  properties:
                    enabled:
                      type: boolean
                      description: Indicates whether web traffic inspection is 
                        enabled.
                      default: false
                    ports:
                      type: array
                      description: Lists the TCP ports for web traffic 
                        inspection.
                      minItems: 1
                      uniqueItems: true
                      items:
                        $ref: '#/components/schemas/uint16'
                    inspect_https:
                      type: boolean
                      description: Indicates whether to inspect HTTPS traffic.
                      default: false
                content_filtering:
                  type: object
                  description: Content filtering action settings.
                  properties:
                    enabled:
                      type: boolean
                      description: Indicates whether content filtering is 
                        enabled.
                      default: true
                    action:
                      type: string
                      description: Specifies the name of the content filtering 
                        action or reference to a content filtering action 
                        configuration object.
                content_scanning:
                  type: boolean
                  description: Indicates whether content scanning is enabled.
                  default: true
                websocket:
                  type: boolean
                  description: Indicates whether WebSocket connections are 
                    allowed.
                  default: false
                web_action_setting:
                  type: object
                  description: Web action settings for this policy.
                  required:
                    - safe_search
                    - google_apps_allowed_domains
                    - fastvue_enabled
                    - url_path_keywords_filtering
                  properties:
                    safe_search:
                      type: object
                      description: SafeSearch enforcement settings.
                      required:
                        - enabled
                      properties:
                        enabled:
                          type: boolean
                          description: Indicates whether SafeSearch enforcement 
                            is enabled.
                          default: false
                        enforcement_level:
                          type: string
                          description: SafeSearch enforcement level, either 
                            moderate or strict.
                          default: strict
                          enum:
                            - moderate
                            - strict
                    google_apps_allowed_domains:
                      type: object
                      description: Google Apps allowed domains settings.
                      required:
                        - enabled
                      properties:
                        enabled:
                          type: boolean
                          description: Indicates whether Google Apps domain 
                            restriction is enabled.
                          default: false
                        domains:
                          type: array
                          description: Lists the allowed Google Apps domains.
                          uniqueItems: true
                          items:
                            $ref: '#/components/schemas/domain_name'
                    fastvue_enabled:
                      type: boolean
                      description: Indicates whether Fastvue reporting is 
                        enabled.
                      default: false
                    url_path_keywords_filtering:
                      type: object
                      description: URL path keyword filtering settings.
                      required:
                        - enabled
                      properties:
                        enabled:
                          type: boolean
                          description: Indicates whether URL path keyword 
                            filtering is enabled.
                          default: false
                        keywords:
                          type: array
                          description: Lists the URL path keywords to filter.
                          items:
                            type: object
                            required:
                              - keyword_type
                              - keyword
                              - action
                            properties:
                              keyword_type:
                                type: string
                                description: Keyword match type, either pattern,
                                  regexp, or string.
                                enum:
                                  - pattern
                                  - regexp
                                  - string
                              keyword:
                                type: string
                                description: 'Keyword value to match. Maximum: 200
                                  characters.'
                                pattern: ^(?=.*\S).+$
                                maxLength: 200
                              action:
                                type: string
                                description: Action to take when the keyword 
                                  matches, either allow or deny.
                                enum:
                                  - allow
                                  - deny
                              log:
                                type: boolean
                                description: Indicates whether to log keyword 
                                  matches.
                                default: true
                              alarm:
                                type: boolean
                                description: Indicates whether to send an alarm 
                                  for keyword matches.
                                default: false
            - type: object
              description: Type-specific settings for Inbound policies.
              required:
                - type
              properties:
                type:
                  type: string
                  description: Policy type.
                  enum:
                    - inbound
                content_scanning:
                  type: boolean
                  description: Indicates whether content scanning is enabled.
                  default: true
            - type: object
              description: Type-specific settings for Custom policies.
              required:
                - type
              properties:
                type:
                  type: string
                  description: Policy type.
                  enum:
                    - custom
                content_filtering:
                  type: object
                  description: Content filtering action settings.
                  properties:
                    enabled:
                      type: boolean
                      description: Indicates whether content filtering is 
                        enabled.
                      default: true
                    action:
                      type: string
                      description: Name of the content filtering action or 
                        Reference to a content filtering action configuration 
                        object.
                content_scanning:
                  type: boolean
                  description: Indicates whether content scanning is enabled.
                  default: true
                traffic_direction:
                  type: string
                  description: Traffic direction for the custom policy, either 
                    bidirectional or unidirectional.
                  enum:
                    - bidirectional
                    - unidirectional

    firewall.policy_patch:
      type: object
      description: Request body to enable or disable a firewall policy.
      required:
        - enabled
      properties:
        enabled:
          type: boolean
          description: Indicates whether the policy is enabled or disabled.

    firewall.policy_match_type:
      description: Object that matches traffic against firewall policies.
      oneOf:
        - $ref: '#/components/schemas/ipv4_addr_type'
        - $ref: '#/components/schemas/ipv6_addr_type'
        - $ref: '#/components/schemas/fqdn_type'
        - $ref: '#/components/schemas/system_alias_type'
        - type: object
          description: Reference to another object of enumerated types.
          required:
            - type
            - value
          properties:
            type:
              type: string
              description: Match type identifier.
              enum:
                - firewall_alias
                - network
                - firebox_user
                - firebox_group
                - auth_group
                - authpoint_user_group
                - saml_user_group
            value:
              type: string
              description: Specifies the name of the configuration object or 
                reference to a configuration object.
        - type: object
          description: Shared user group reference.
          required:
            - type
            - value
          properties:
            type:
              type: string
              description: Match type identifier.
              enum:
                - shared_user_group
            value:
              oneOf:
                - type: string
                  description: Reference to an existing shared user group 
                    object.
                - type: object
                  description: Specifies a shared user group and authentication 
                    domain.
                  required:
                    - usergrp_id
                    - domain_id
                  properties:
                    usergrp_id:
                      type: string
                      description: Represents the user group identifier.
                    domain_id:
                      type: string
                      description: Represents the authentication domain 
                        identifier.

    scope:
      type: string
      enum:
        - AP

    reference:
      type: string
      description: Represents a reference to a configuration object.

    uint8:
      type: integer
      minimum: 0
      maximum: 255

    firewall.policy_group:
      type: object
      description: Firewall policy group object.
      allOf:
        - $ref: '#/components/schemas/object_metadata'
        - $ref: '#/components/schemas/firewall.policy_group_base'

    firewall.policy_group_base:
      type: object
      required:
        - name
      properties:
        name:
          $ref: '#/components/schemas/name_string'
        policies:
          type: array
          description: Lists the ordered references to firewall policies in one 
            group.
          uniqueItems: true
          items:
            $ref: '#/components/schemas/reference'

    firewall.traffic_type:
      type: object
      description: Firewall traffic type object.
      allOf:
        - $ref: '#/components/schemas/object_metadata'
        - $ref: '#/components/schemas/firewall.traffic_type_base'

    firewall.traffic_type_base:
      type: object
      description: A list of protocols and ports for a specific traffic type.
      required:
        - name
        - protocols
      properties:
        name:
          $ref: '#/components/schemas/name_string'
        description:
          $ref: '#/components/schemas/description_string'
        type:
          type: string
          description: Defines whether the traffic type is predefined or custom.
          enum:
            - predefined
            - custom
          default: custom
        category:
          type: string
          enum:
            - Auth
            - Custom
            - Database
            - Email
            - File
            - General
            - Network
            - RemoteAccess
            - Tunneling
            - VoIP/Chat
            - WatchGuard
            - Web
          default: Custom
        protocols:
          type: array
          minItems: 1
          items:
            oneOf:
              - type: object
                description: Single protocol. No port restrictions.
                required:
                  - type
                  - protocol
                properties:
                  protocol:
                    type: integer
                    minimum: 0
                    maximum: 255
                  type:
                    type: string
                    enum:
                      - any
              - type: object
                description: Protocol and single port.
                required:
                  - type
                  - protocol
                  - value
                properties:
                  protocol:
                    type: integer
                    enum:
                      - 6
                      - 17
                  type:
                    type: string
                    enum:
                      - single_port
                  value:
                    $ref: '#/components/schemas/uint16'
              - type: object
                description: Protocol and port range.
                required:
                  - type
                  - protocol
                  - value
                properties:
                  protocol:
                    type: integer
                    enum:
                      - 6
                      - 17
                  type:
                    type: string
                    enum:
                      - port_range
                  value:
                    type: object
                    required:
                      - start
                      - end
                    properties:
                      start:
                        $ref: '#/components/schemas/uint16'
                      end:
                        $ref: '#/components/schemas/uint16'
              - type: object
                description: ICMP.
                required:
                  - type
                  - protocol
                  - value
                properties:
                  protocol:
                    type: integer
                    enum:
                      - 1
                      - 58
                  type:
                    type: string
                    enum:
                      - icmp
                  value:
                    type: object
                    required:
                      - icmp_type
                      - icmp_code
                    properties:
                      icmp_type:
                        $ref: '#/components/schemas/uint8'
                      icmp_code:
                        $ref: '#/components/schemas/uint8'

    firewall.alias:
      type: object
      description: Firewall alias object.
      allOf:
        - $ref: '#/components/schemas/object_metadata'
        - $ref: '#/components/schemas/firewall.alias_base'

    firewall.alias_base:
      type: object
      required:
        - name
        - members
      properties:
        name:
          $ref: '#/components/schemas/name_string'
        description:
          $ref: '#/components/schemas/description_string'
        members:
          type: array
          minItems: 1
          uniqueItems: true
          items:
            $ref: '#/components/schemas/firewall.policy_match_type'

    networking.network:
      type: object
      description: Networking network object.
      allOf:
        - $ref: '#/components/schemas/object_metadata'
        - $ref: '#/components/schemas/networking.network_base'

    networking.network_base:
      type: object
      properties:
        type:
          type: string
          enum:
            - standalone
            - bridge
            - vlan
          description: A network could be a VLAN interface, if a VLAN ID is 
            given; or a bridge interface, if not. If no VLAN ID is provided, and
            the network consists of a single interface, it is a standalone 
            interface
        ifnum:
          type: integer
          description: It is the same as VLAN ID for VLAN network; it is a 
            unique number for bridge network; absent if it is a standalone 
            network. This property should never be set by the user
        vid:
          type: integer
          description: VLAN ID for VLAN network. Absent if it is a bridge or 
            standalone network
        name:
          $ref: '#/components/schemas/name_string'
        zone:
          type: string
          enum:
            - internal
            - external
            - guest
            - ha
          description: "'Internal' will be mapped to 'Trusted' zone on Firebox; 'Guest'
            will be mapped to 'Optional' zone on Firebox"
        interfaces:
          type: array
          items:
            type: object
            properties:
              interface:
                oneOf:
                  - $ref: '#/components/schemas/reference'
                  - $ref: '#/components/schemas/networking.network_interface_base'
              tagged:
                type: boolean
            required:
              - interface
        ip_addresses:
          type: object
          properties:
            primary:
              $ref: '#/components/schemas/ipv4_cidr_string'
            secondary:
              type: array
              items:
                $ref: '#/components/schemas/ipv4_cidr_string'
              maxItems: 2048
              uniqueItems: true
            gateway:
              $ref: '#/components/schemas/ipv4_address_string'
        external_type:
          type: string
          enum:
            - static
            - dhcp
            - pppoe
        dhcp_client:
          type: object
          properties:
            ip_addr:
              $ref: '#/components/schemas/ipv4_address_string'
            client_id:
              type: string
              minLength: 1
              maxLength: 255
            host_name:
              type: string
              minLength: 1
              maxLength: 255
            lease_time:
              type: integer
              minimum: 1
              maximum: 2147483647
            force_renew:
              type: boolean
            auth_token:
              type: string
              minLength: 1
              maxLength: 513
        pppoe_client:
          type: object
          properties:
            ip_addr:
              $ref: '#/components/schemas/ipv4_address_string'
            user:
              type: string
              minLength: 1
              maxLength: 63
            password:
              type: string
              minLength: 1
              maxLength: 192
            dial_on_demand:
              type: boolean
            init_delay:
              type: integer
              default: 60
              minimum: 0
              maximum: 3600
            idle_timeout:
              type: integer
              default: 20
              minimum: 0
              maximum: 60
            retry_unique:
              type: boolean
            retry_lcp:
              type: boolean
            lcp_retries:
              type: integer
              default: 6
              minimum: 1
              maximum: 60
            lcp_timeout:
              type: integer
              default: 10
              minimum: 1
              maximum: 1200
            auto_restart:
              type: boolean
            restart_day:
              type: integer
              enum:
                - 0
                - 1
                - 2
                - 3
                - 4
                - 5
                - 6
                - 7
              description: 'Day of the week for auto restart: 0 (Sunday), 1 (Monday),
                2 (Tuesday), 3 (Wednesday), 4 (Thursday), 5 (Friday), 6 (Saturday),
                7 (Everyday)'
            restart_hour:
              type: integer
              minimum: 0
              maximum: 23
            restart_minute:
              type: integer
              minimum: 0
              maximum: 59
            service_name:
              type: string
              minLength: 1
              maxLength: 255
            ac_name:
              type: string
              minLength: 1
              maxLength: 255
            auth_retry:
              type: integer
              default: 3
              minimum: 0
              maximum: 20
            auth_timeout:
              type: integer
              default: 20
              minimum: 0
              maximum: 60
            static_ip_mode:
              type: string
              enum:
                - send_ip
                - no_send_ip
                - enforce_ip
            use_peer_dns:
              type: boolean
        mac_acl:
          type: object
          properties:
            enabled:
              type: boolean
            mac_addresses:
              type: array
              items:
                type: object
                properties:
                  mac_address:
                    $ref: '#/components/schemas/mac_address_string'
                  name:
                    type: string
                    minLength: 1
                    maxLength: 47
          required:
            - enabled
        dhcp_server:
          type: object
          properties:
            server_type:
              type: string
              enum:
                - disabled
                - server
                - relay
            lease_time:
              type: integer
              default: 28800
              minimum: 1
              maximum: 2147483647
            domain_name:
              type: string
              minLength: 1
              maxLength: 63
            address_pools:
              type: array
              items:
                type: object
                properties:
                  start:
                    $ref: '#/components/schemas/ipv4_address_string'
                  end:
                    $ref: '#/components/schemas/ipv4_address_string'
            dns:
              type: object
              properties:
                servers:
                  type: array
                  minItems: 1
                  maxItems: 3
                  uniqueItems: true
                  items:
                    $ref: '#/components/schemas/ipv4_address_string'
            reserved_addresses:
              type: array
              items:
                type: object
                properties:
                  ip:
                    $ref: '#/components/schemas/ipv4_address_string'
                  name:
                    $ref: '#/components/schemas/reservation_name_string'
                  mac:
                    $ref: '#/components/schemas/mac_address_string'
            dhcp_options:
              type: array
              items:
                type: object
                properties:
                  code:
                    type: integer
                    minimum: 1
                    maximum: 255
                  name:
                    type: string
                    minLength: 1
                    maxLength: 63
                  type:
                    type: string
                    enum:
                      - int8
                      - uint8
                      - int16
                      - uint16
                      - int32
                      - uint32
                      - bool
                      - text
                      - hex
                      - ips
                    description: 'DHCP option type: int8 (1-byte integer), uint8 (1-byte
                      integer unsigned), int16 (2-byte integer), uint16 (2-byte integer
                      unsigned), int32 (4-byte integer), uint32 (4-byte integer unsigned),
                      bool (Boolean), text (Text), hex (Hexadecimal), ips (IP addresses)'
                  value:
                    type: string
                    minLength: 1
                    maxLength: 255
              maxItems: 255
            gateway_ip:
              $ref: '#/components/schemas/ipv4_address_string'
            relay_servers:
              type: array
              items:
                $ref: '#/components/schemas/ipv4_address_string'
              maxItems: 3
              uniqueItems: true
          required:
            - server_type
        link_monitor:
          type: object
          properties:
            enabled:
              type: boolean
              default: false
            default:
              type: boolean
              default: false
            type:
              type: string
              enum:
                - dns
                - ping
                - tcp
            target:
              oneOf:
                - $ref: '#/components/schemas/ipv4_addr_type'
                - $ref: '#/components/schemas/domain_type'
            port:
              $ref: '#/components/schemas/uint16'
            domain:
              $ref: '#/components/schemas/domain_type'
            nexthop:
              $ref: '#/components/schemas/ipv4_address_string'
          required:
            - enabled
        dynamic_dns:
          type: object
          properties:
            enabled:
              type: boolean
              default: false
            provider:
              type: string
              minLength: 4
              maxLength: 64
            username:
              type: string
              minLength: 4
              maxLength: 64
            password:
              type: string
              minLength: 4
              maxLength: 513
            domain:
              $ref: '#/components/schemas/domain_type'
            options:
              type: string
              maxLength: 255
              description: Specifies one or more options required for a few 
                Service Providers.
            forced_update:
              type: integer
              minimum: 1
              maximum: 28
              description: 'A time interval (unit: day, range 1-28) to force an update
                of the IP address'
            allow_provider_ip_selection:
              type: boolean
              default: false
          required:
            - enabled
        allow_webui:
          type: boolean
          default: false
        allow_ping:
          type: boolean
          default: false
        ipv6:
          type: object
          required:
            - enabled
          properties:
            enabled:
              type: boolean
              default: false
            addresses:
              type: array
              items:
                type: object
                properties:
                  addr:
                    $ref: '#/components/schemas/ipv6_cidr_string'
                  advert_prefix:
                    type: boolean
                    default: false
                  pd_network:
                    $ref: '#/components/schemas/reference'
                required:
                  - addr
              uniqueItems: true
            default_gateway:
              $ref: '#/components/schemas/ipv6_address_string'
            hop_limit:
              type: integer
              default: 64
              minimum: 1
              maximum: 65535
            dad_transmit:
              type: integer
              default: 1
              minimum: 1
              maximum: 10
            router_advertisements:
              type: object
              properties:
                send_advertisements:
                  type: boolean
                  default: false
                managed:
                  type: boolean
                  default: false
                other:
                  type: boolean
                  default: false
                default_lifetime:
                  type: integer
                  default: 1800
                  minimum: 0
                  maximum: 9000
                max_interval:
                  type: integer
                  default: 600
                  minimum: 4
                  maximum: 1800
                min_interval:
                  type: integer
                  default: 200
                  minimum: 3
                  maximum: 1350
                prefixes:
                  type: array
                  uniqueItems: true
                  items:
                    type: object
                    required:
                      - network_addr
                    properties:
                      network_addr:
                        $ref: '#/components/schemas/ipv6_cidr_string'
                      pd_network:
                        $ref: '#/components/schemas/reference'
                      valid_lifetime:
                        type: integer
                        default: 2592000
                        minimum: 0
                        maximum: 4294967295
                      prefer_lifetime:
                        type: integer
                        default: 604800
                        minimum: 0
                        maximum: 4294967295
                      autonomous:
                        type: boolean
                        default: true
                      onlink:
                        type: boolean
                        default: true
            external:
              type: object
              properties:
                dhcp_client:
                  type: object
                  properties:
                    enabled:
                      type: boolean
                      default: false
                    rapid_commit:
                      type: boolean
                      default: false
                dhcp_client_pd:
                  type: object
                  properties:
                    enabled:
                      type: boolean
                      default: false
                    rapid_commit:
                      type: boolean
                      default: false
                    perform_iana_query:
                      type: boolean
                      default: false
                    custom_iaid:
                      type: string
                      minLength: 8
                      maxLength: 8
                autoconf:
                  type: boolean
                  default: false
            dhcp_server:
              type: object
              properties:
                server_type:
                  type: string
                  enum:
                    - disabled
                    - server
                rapid_commit:
                  type: boolean
                  default: false
                preferred_lifetime:
                  type: integer
                  default: 86400
                  minimum: 0
                  maximum: 4294967295
                valid_lifetime:
                  type: integer
                  default: 172800
                  minimum: 0
                  maximum: 4294967295
                dns:
                  type: object
                  properties:
                    domain:
                      $ref: '#/components/schemas/domain_type'
                    servers:
                      type: array
                      minItems: 1
                      maxItems: 3
                      uniqueItems: true
                      items:
                        $ref: '#/components/schemas/ipv6_address_string'
                sip:
                  type: object
                  properties:
                    domain:
                      $ref: '#/components/schemas/domain_type'
                    servers:
                      type: array
                      minItems: 1
                      maxItems: 3
                      uniqueItems: true
                      items:
                        $ref: '#/components/schemas/ipv6_address_string'
                address_pools:
                  type: array
                  uniqueItems: true
                  items:
                    type: object
                    required:
                      - start
                      - end
                    properties:
                      start:
                        $ref: '#/components/schemas/ipv6_address_string'
                      end:
                        $ref: '#/components/schemas/ipv6_address_string'
                      pd_network:
                        $ref: '#/components/schemas/reference'
                prefix_pools:
                  type: array
                  uniqueItems: true
                  items:
                    type: object
                    required:
                      - start
                      - end
                      - prefix_length
                    properties:
                      start:
                        $ref: '#/components/schemas/ipv6_address_string'
                      end:
                        $ref: '#/components/schemas/ipv6_address_string'
                      prefix_length:
                        type: integer
                        minimum: 1
                        maximum: 127
                reserved_addresses:
                  type: array
                  uniqueItems: true
                  items:
                    type: object
                    required:
                      - name
                      - ip
                      - duid
                    properties:
                      name:
                        $ref: '#/components/schemas/hostname_string'
                      duid:
                        $ref: '#/components/schemas/duid_string'
                      ip:
                        $ref: '#/components/schemas/ipv6_address_string'
                      prefix:
                        $ref: '#/components/schemas/ipv6_cidr_string'
                      pd_network:
                        $ref: '#/components/schemas/reference'
              required:
                - server_type
        intra_inspection:
          type: boolean
        stp_enabled:
          type: boolean
          description: Enable/disable Spanning Tree Protocol. Applies only to 
            Bridge & VLAN networks
          default: false
      required:
        - type
        - name
        - zone
        - interfaces

    networking.network_interface_base:
      type: object
      properties:
        type:
          type: string
          enum:
            - physical
            - lag
            - wireless
            - modem
        mode:
          type: string
          enum:
            - standalone
            - bridge
            - vlan
          description: The user should never set this property.
        ifnum:
          type: integer
          description: Interface number. It could be an immutable number for a 
            physical or wireless interface.
        enabled:
          type: boolean
        ethernet_settings:
          type: object
          properties:
            auto_negotiate:
              type: boolean
            link_speed:
              type: integer
              enum:
                - 10
                - 100
                - 1000
                - 2500
                - 5000
                - 10000
            full_duplex:
              type: boolean
            mtu:
              type: integer
              minimum: 68
              maximum: 9000
            qos_type:
              type: integer
              enum:
                - 1
                - 2
              description: 'QoS marking field: 1 (DSCP), 2 (Precedence)'
            qos_method:
              type: integer
              enum:
                - 0
                - 1
              description: 'QoS marking method: 0 (Preserve), 1 (Assign)'
            qos_value:
              type: integer
              oneOf:
                - minimum: 0
                  maximum: 7
                  description: For assigning value with precedence type.
                - enum:
                    - 0
                    - 8
                    - 10
                    - 12
                    - 14
                    - 16
                    - 18
                    - 20
                    - 22
                    - 24
                    - 26
                    - 28
                    - 30
                    - 32
                    - 34
                    - 36
                    - 38
                    - 40
                    - 46
                    - 48
                    - 56
                  description: 'For assigning value with DSCP type: 0 (Best Effort),
                    8 (CS1, Scavenger), 10 (AF11), 12 (AF12), 14 (AF13), 16 (CS2),
                    18 (AF21), 20 (AF22), 22 (AF23), 24 (CS3), 26 (AF31), 28 (AF32),
                    30 (AF33), 32 (CS4), 34 (AF41), 36 (AF42), 38 (AF43), 40 (CS5),
                    46 (EF), 48 (Control, CS6), 56 (Control, CS7)'
        wireless_settings:
          $ref: '#/components/schemas/networking.wireless_settings'
        modem_settings:
          type: object
          properties:
            builtin:
              type: boolean
              description: 4G LTE (true), other modem types (false).
            apn:
              type: string
              minLength: 1
              maxLength: 255
              description: Access Point Name (Optional).
            ipv6:
              type: object
              properties:
                enabled:
                  type: boolean
                  default: false
              required:
                - enabled
          required:
            - builtin
        lag_settings:
          type: object
          properties:
            name:
              $ref: '#/components/schemas/name_string'
            mode:
              type: string
              enum:
                - dynamic
                - static
                - active-backup
            members:
              type: array
              items:
                $ref: '#/components/schemas/reference'
          required:
            - name
            - mode
            - members
      required:
        - type
        - enabled

    networking.wireless_settings:
      type: object
      properties:
        ssid:
          type: string
          minLength: 1
          maxLength: 32
        operation_mode:
          type: string
          enum:
            - wireless_ap
        broadcast_ssid:
          type: boolean
        auth_mode:
          type: string
          enum:
            - open_system
            - owe
            - psk_wpa2_only
            - psk_wpa3_only
            - wpa2_wpa3_mixed
            - wpa2_enterprise
            - wpa3_enterprise
            - wpa2_wpa3_enterprise
        passphrase:
          type: string
          minLength: 8
          maxLength: 63
        log_authentication_events:
          type: boolean
        client_isolation:
          type: boolean
        2_4ghz_radio:
          type: boolean
        5ghz_radio:
          type: boolean
        6ghz_radio:
          type: boolean
        domain:
          description: A reference to a Pyro-DB domain object.
          $ref: '#/components/schemas/reference'
        eap_reauth_period:
          description: Used for EAP Server (domain) with WPA2/3 Enterprise.
          type: integer
          minimum: 0
          maximum: 2147483647
      required:
        - ssid
        - operation_mode
        - auth_mode

    authentication.firebox_user:
      type: object
      description: Authentication user object.
      allOf:
        - $ref: '#/components/schemas/object_metadata'
        - $ref: '#/components/schemas/authentication.firebox_user_base'

    authentication.firebox_user_base:
      type: object
      required:
        - name
        - password
        - timeout
        - idle
      properties:
        name:
          $ref: '#/components/schemas/name_string'
        description:
          $ref: '#/components/schemas/description_string'
        password:
          type: string
          minLength: 8
          maxLength: 32
        timeout:
          type: integer
          minimum: 1
          maximum: 31536000
          default: 28800
        idle:
          type: integer
          minimum: 1
          maximum: 31536000
          default: 1800
        domain:
          $ref: '#/components/schemas/reference'
        groups:
          type: array
          uniqueItems: true
          items:
            $ref: '#/components/schemas/reference'
        scope:
          $ref: '#/components/schemas/scope'
        ap_id:
          type: string

    authentication.firebox_group:
      type: object
      description: Authentication group object.
      allOf:
        - $ref: '#/components/schemas/object_metadata'
        - $ref: '#/components/schemas/authentication.firebox_group_base'

    authentication.firebox_group_base:
      type: object
      required:
        - name
      properties:
        name:
          $ref: '#/components/schemas/name_string'
        description:
          $ref: '#/components/schemas/description_string'
        domain:
          $ref: '#/components/schemas/reference'
        members:
          type: array
          uniqueItems: true
          items:
            $ref: '#/components/schemas/reference'
        scope:
          $ref: '#/components/schemas/scope'

    authentication.auth_group:
      type: object
      description: Authentication auth group object.
      allOf:
        - $ref: '#/components/schemas/object_metadata'
        - $ref: '#/components/schemas/authentication.auth_group_base'

    authentication.auth_group_base:
      type: object
      required:
        - name
      properties:
        name:
          $ref: '#/components/schemas/name_string'
        description:
          $ref: '#/components/schemas/description_string'
        domains:
          type: array
          uniqueItems: true
          items:
            type: object
            properties:
              type:
                type: string
                enum:
                  - firebox_domain
                  - authentication_domain
                  - authpoint_domain
                  - saml_settings
              value:
                description: A reference to a Pyro-DB domain object
                $ref: '#/components/schemas/reference'
            required:
              - type
              - value
        members:
          type: array
          uniqueItems: true
          items:
            type: object
            properties:
              type:
                type: string
                enum:
                  - firebox_user
                  - firebox_group
                  - shared_user_group
                  - authpoint_user_group
                  - saml_user_group
              value:
                oneOf:
                  - description: A reference to a Pyro-DB user/group object
                    $ref: '#/components/schemas/reference'
                  - description: Create a shared_user_group referencing the 
                      domain object in Pyro-DB
                    type: object
                    required:
                      - usergrp_id
                      - domain_id
                    properties:
                      usergrp_id:
                        type: string
                      domain_id:
                        type: string
                      movpn_enforcement:
                        type: boolean
            required:
              - type
              - value

    authentication.authpoint_user_group:
      type: object
      description: Authentication AuthPoint user group object.
      allOf:
        - $ref: '#/components/schemas/object_metadata'
        - $ref: '#/components/schemas/authentication.authpoint_user_group_base'

    authentication.authpoint_user_group_base:
      type: object
      required:
        - name
        - type
        - domain
      properties:
        name:
          type: string
        type:
          type: string
          enum:
            - user
            - group
        domain:
          $ref: '#/components/schemas/reference'

    authentication.saml_user_group:
      type: object
      description: Authentication SAML user group object.
      allOf:
        - $ref: '#/components/schemas/object_metadata'
        - $ref: '#/components/schemas/authentication.saml_user_group_base'

    authentication.saml_user_group_base:
      type: object
      required:
        - name
        - type
        - domain
      properties:
        name:
          $ref: '#/components/schemas/email_or_username'
        type:
          type: string
          enum:
            - user
            - group
        domain:
          $ref: '#/components/schemas/reference'
        movpn_enforcement:
          type: boolean
          default: false

    firewall.snat_action:
      type: object
      description: Firewall SNAT action object.
      allOf:
        - $ref: '#/components/schemas/object_metadata'
        - $ref: '#/components/schemas/firewall.snat_action_base'

    firewall.snat_action_base:
      type: object
      required:
        - name
        - rules
      properties:
        name:
          $ref: '#/components/schemas/name_string'
        description:
          $ref: '#/components/schemas/description_string'
        rules:
          type: array
          minItems: 1
          uniqueItems: true
          items:
            type: object
            required:
              - external_address
              - internal_address
            properties:
              external_address:
                oneOf:
                  - description: Any primary or secondary IPv4 address on 
                      external networks
                    $ref: '#/components/schemas/ipv4_host_type'
                  - type: object
                    description: Reference to an external network.
                    required:
                      - type
                      - value
                    properties:
                      type:
                        type: string
                        enum:
                          - network
                      value:
                        $ref: '#/components/schemas/reference'
                  - description: Any-External is allowed
                    allOf:
                      - $ref: '#/components/schemas/system_alias_type'
                      - properties:
                          value:
                            type: string
                            enum:
                              - Any-External
              internal_address:
                $ref: '#/components/schemas/ipv4_address_string'
              destination_port:
                $ref: '#/components/schemas/uint16'
              source_address:
                $ref: '#/components/schemas/ipv4_address_string'

    networking.sdwan:
      type: object
      description: Networking SD-WAN object.
      allOf:
        - $ref: '#/components/schemas/object_metadata'
        - $ref: '#/components/schemas/networking.sdwan_base'

    networking.sdwan_base:
      type: object
      properties:
        name:
          $ref: '#/components/schemas/name_string'
        global:
          type: boolean
          default: false
          description: Indicates whether this object is a global WAN object.
        mode:
          type: string
          enum:
            - failover
            - round-robin
        failback:
          type: string
          enum:
            - immediate
            - gradual
            - dont
        sticky_tcp:
          type: integer
          default: 180
          minimum: 0
          maximum: 2147483647
        sticky_udp:
          type: integer
          default: 180
          minimum: 0
          maximum: 2147483647
        sticky_others:
          type: integer
          default: 180
          minimum: 0
          maximum: 2147483647
        measurements:
          type: object
          properties:
            enabled:
              type: boolean
              default: false
            loss:
              type: integer
              minimum: 0
              maximum: 100
              description: Metric for loss rate, use % as the unit.
            latency:
              type: integer
              minimum: 0
              maximum: 2000
              description: Metric for latency, in milliseconds.
            jitter:
              type: integer
              minimum: 0
              maximum: 1000
              description: Metric for jitter, in milliseconds.
          required:
            - enabled
          description: Specify at least one metric when measurements is enabled.
        members:
          type: array
          items:
            type: object
            properties:
              type:
                type: string
                enum:
                  - network
                  - ipsec_vpn
              value:
                $ref: '#/components/schemas/reference'
              weight:
                type: integer
            required:
              - type
              - value
          minItems: 1
      required:
        - name
        - mode
        - members

    traffic_shaping.rule:
      type: object
      description: Traffic shaping rule object.
      allOf:
        - $ref: '#/components/schemas/object_metadata'
        - $ref: '#/components/schemas/traffic_shaping.rule_base'

    traffic_shaping.rule_base:
      type: object
      required:
        - name
        - enabled
        - rule_type
        - behavior
        - method
      properties:
        name:
          $ref: '#/components/schemas/name_string'
        enabled:
          type: boolean
          default: true
          description: Indicates whether the traffic shaping rule is enabled.
        rule_type:
          type: string
          enum:
            - outbound
            - inbound
            - custom
            - first
            - last
            - content_filtering
            - mixed
        behavior:
          type: string
          default: limit
          enum:
            - limit
            - guarantee
        method:
          type: string
          default: all_users
          enum:
            - all_users
            - per_user
        max_users:
          type: integer
          minimum: 1
          maximum: 256
          default: 128
        upload:
          type: integer
          minimum: 1
          maximum: 1000000000
          description: Upload/Source_to_Destination bandwidth in Kbps.
        download:
          type: integer
          minimum: 1
          maximum: 1000000000
          description: Download/Destination_to_Source bandwidth in Kbps.
        bandwidth:
          type: integer
          minimum: 1
          maximum: 1000000000
          description: Application total bandwidth in Kbps.

    system_schedule:
      type: object
      description: System schedule object.
      allOf:
        - $ref: '#/components/schemas/object_metadata'
        - $ref: '#/components/schemas/system_schedule_base'

    system_schedule_base:
      type: object
      required:
        - name
        - description
        - enabled
        - schedule_type
        - immutable
        - members
      properties:
        name:
          type: string
          maxLength: 47
        description:
          type: string
          maxLength: 127
        enabled:
          type: boolean
          default: true
        schedule_type:
          type: integer
          description: 'Defines the schedule type: 0 (Always On), 1 (Daily), or 2
            (Weekly).'
          default: 2
          enum:
            - 0
            - 1
            - 2
        immutable:
          type: boolean
          default: false
        members:
          type: array
          description: Lists the date schedule objects by day of the week.
          minItems: 1
          uniqueItems: true
          items:
            type: object
            required:
              - day_of_week
              - members
            properties:
              day_of_week:
                type: integer
                description: 'Indicates the day of the week as a number: 0 (Sunday)
                  through 6 (Saturday).'
                enum:
                  - 0
                  - 1
                  - 2
                  - 3
                  - 4
                  - 5
                  - 6
              members:
                type: array
                description: Lists the time periods for the day.
                minItems: 1
                uniqueItems: true
                items:
                  type: object
                  properties:
                    from_hour:
                      type: integer
                      minimum: 0
                      maximum: 23
                    from_min:
                      type: integer
                      minimum: 0
                      maximum: 59
                    to_hour:
                      type: integer
                      minimum: 0
                      maximum: 24
                    to_min:
                      type: integer
                      minimum: 0
                      maximum: 59
                  required:
                    - from_hour
                    - from_min
                    - to_hour
                    - to_min

    content_filtering:
      type: object
      description: Content filtering object.
      allOf:
        - $ref: '#/components/schemas/object_metadata'
        - $ref: '#/components/schemas/content_filtering_base'

    content_filtering_base:
      type: object
      required:
        - name
        - appcontrol
        - webblocker
      properties:
        name:
          $ref: '#/components/schemas/name_string'
        appcontrol:
          type: array
          minItems: 0
          uniqueItems: true
          items:
            type: object
            required:
              - application_name
              - category_id
              - action
            properties:
              application_id:
                type: integer
              application_name:
                type: string
                minLength: 1
                maxLength: 255
              category_id:
                type: integer
              action:
                type: string
                enum:
                  - allow
                  - block
              traffic_shaping:
                $ref: '#/components/schemas/reference'
                description: Reference to the traffic_shaping object.
        webblocker:
          type: array
          minItems: 0
          uniqueItems: true
          items:
            type: object
            required:
              - category_id
              - action
              - log
            properties:
              category_id:
                type: integer
              action:
                type: string
                enum:
                  - allow
                  - bypass
                  - deny
                  - warn
              log:
                type: boolean
                default: true
              alarm:
                type: boolean
                default: false
        deny_uncategorized:
          type: boolean
          default: false
        webblocker_override:
          type: object
          properties:
            enabled:
              type: boolean
              default: false
            wbo_method:
              type: string
              enum:
                - password
                - user_group
            user_group:
              description: Specifies the user group reference to set.
              oneOf:
                - type: object
                  description: Reference to enumerated user group types.
                  required:
                    - type
                    - value
                  properties:
                    type:
                      type: string
                      enum:
                        - firebox_group
                        - auth_group
                    value:
                      $ref: '#/components/schemas/reference'
                - type: object
                  description: Reference to enumerated user group types.
                  required:
                    - type
                    - value
                  properties:
                    type:
                      type: string
                      enum:
                        - shared_user_group
                    value:
                      oneOf:
                        - description: A reference to an existing Pyro-DB object
                            of type 'shared_user_group'
                          $ref: '#/components/schemas/reference'
                        - description: Used by clients to create a reference to 
                            specified shared user group in specified 
                            authentication domain
                          type: object
                          required:
                            - usergrp_id
                            - domain_id
                          properties:
                            usergrp_id:
                              type: string
                            domain_id:
                              type: string
            password:
              type: string
              minLength: 8
              maxLength: 255
            timeout:
              type: integer
              minimum: 3
              maximum: 1440
              default: 5
            alarm:
              type: boolean
              default: false
          required:
            - enabled

    templates_by_device_response:
      type: object
      description: Lists Firebox templates subscribed by the device.
      required:
        - account_id
        - templates
      properties:
        account_id:
          type: string
          maxLength: 128
          description: Specifies the WatchGuard Cloud account used to authorize 
            the request.
        templates:
          type: array
          items:
            type: object
            required:
              - id
              - name
            properties:
              id:
                type: string
                maxLength: 256
                description: Specifies the Firebox template ID.
              name:
                type: string
                maxLength: 256
                description: Specifies the Firebox template name.

    available_templates_response:
      type: object
      description: Lists Firebox templates available in the account that 
        includes inherited templates.
      required:
        - account_id
        - templates
      properties:
        account_id:
          type: string
          maxLength: 128
          description: Account used to authorize the request.
        templates:
          type: array
          description: Templates available from the account hierarchy.
          items:
            type: object
            required:
              - id
              - name
              - account_id
            properties:
              id:
                type: string
                maxLength: 256
                description: Specifies the Firebox template ID.
              name:
                type: string
                maxLength: 256
                description: Specifies the Firebox template name.
              account_id:
                type: string
                maxLength: 128
                description: Account that owns the template.
      example:
        account_id: WGC-1-child
        templates:
          - id: tmpl_123
            name: Branch office
            account_id: WGC-1-child
          - id: tmpl_456
            name: Corporate defaults
            account_id: WGC-1-parent

    devices_by_templateid_response:
      type: object
      description: Lists Fireboxes subscribed to the Firebox template.
      required:
        - account_id
        - devices
      properties:
        account_id:
          type: string
          maxLength: 128
          description: Indicates the WatchGuard Cloud account used to authorize 
            the request.
        devices:
          type: array
          items:
            type: object
            required:
              - id
            properties:
              id:
                type: string
                maxLength: 256
                description: Indicates the Firebox ID in WatchGuard Cloud.

    template_subscribe_request:
      type: object
      description: >
        Request body to update the subscription status of a Firebox Template.
        An empty *templates* array unsubscribes a Firebox from all Firebox templates.
      properties:
        device:
          oneOf:
            - type: string
            - type: integer
          description: Specifies the Firebox device ID in WatchGuard Cloud.
        templates:
          type: array
          description: >
            Specifies a list of all the template IDs that you want a Firebox to subscribe
            to, in order.
            Maximum: 50 template IDs per request.
          minItems: 0
          maxItems: 50
          items:
            type: string
          example:
            - tmpl_123
            - tmpl_456
      required:
        - device
        - templates

    template:
      type: object
      description: Firebox template object.
      allOf:
        - $ref: '#/components/schemas/object_metadata'
        - $ref: '#/components/schemas/new_template'

    template_group:
      type: object
      description: Firebox template group object.
      allOf:
        - $ref: '#/components/schemas/object_metadata'
        - $ref: '#/components/schemas/new_template_group'

    new_template:
      type: object
      description: Attributes used to create a Firebox template.
      allOf:
        - $ref: '#/components/schemas/new_object_attributes'
        - $ref: '#/components/schemas/template_base'

    template_base:
      type: object
      description: Base attributes of a Firebox template.
      oneOf:
        - type: object
          properties:
            alias:
              type: string
          required:
            - alias
        - type: object
          properties:
            account_type:
              type: string
              enum:
                - service_provider
            name:
              $ref: '#/components/schemas/name_string'
            description:
              $ref: '#/components/schemas/description_string'
            scope:
              $ref: '#/components/schemas/scope'
            objects:
              type: array
              uniqueItems: true
              items:
                type: string
            disabled:
              type: array
              uniqueItems: true
              items:
                type: string
          required:
            - name

    new_template_group:
      type: object
      description: Attributes used to create a Firebox template group.
      allOf:
        - $ref: '#/components/schemas/new_object_attributes'
        - $ref: '#/components/schemas/template_group_base'

    template_group_base:
      type: object
      description: Base attributes of a Firebox template group.
      properties:
        templates:
          type: array
          uniqueItems: true
          minItems: 1
          items:
            oneOf:
              - $ref: '#/components/schemas/reference'
              - $ref: '#/components/schemas/template_base'
        precheck_info:
          type: object
          additionalProperties:
            type: string
      required:
        - templates

  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: WatchGuard-API-Key
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
tags:
  - name: API Health
    description: Check API health.
  - name: Exceptions
    description: All exception types
  - name: Exceptions (Blocked Sites)
    description: The Blocked Sites list specifies sites that cannot make a 
      connection through the Firebox. The Firebox does not block traffic from 
      sites you add to the Blocked Sites Exception list.
  - name: Exceptions (Botnet)
    description: Botnet site exceptions specify sites that you do not want to 
      block, even if they are known botnet sites that the Botnet Detection 
      service added to the Blocked SItes list.
  - name: Exceptions (File)
    description: File exceptions identify files that you do not want the Firebox
      to scan with APT Blocker, Data Loss Prevention, Gateway AntiVirus, and 
      IntelligentAV.
  - name: Exceptions (Geolocation)
    description: Geolocation exceptions identify sites that you do not want the 
      Geolocation service to block.
  - name: Exceptions (Intrusion Prevention)
    description: IPS signature exceptions specify IPS signature IDs that you do 
      not want the Firebox to use to block connections.
  - name: Exceptions (WebBlocker)
    description: WebBlocker exceptions specify that WebBlocker must always allow
      or always deny access to a website, regardless of the WebBlocker content 
      category.
  - name: Global Exceptions
    description: Before you can deploy the exceptions you configure with the 
      Firebox Management API to a device, you must enable global exceptions on 
      the device.
  - name: BOVPN IPSec Tunnel
    description: A BOVPN IPsec tunnel provides secure, encrypted connectivity 
      between geographically separated endpoints.
  - name: BOVPN IPSec Tunnel P1 Shared Settings
    description: For a BOVPN IPsec tunnel, Phase 1 shared settings help 
      establish a secure connection between the two endpoints.
  - name: Firebox Certificates
    description: Firebox certificates are security credentials that the device 
      uses to authenticate and secure encrypted connections.
  - name: Deployments
    description: After you configure exceptions with the Firebox Management API,
      you can deploy the exceptions to devices immediately or at a specified 
      time.
  - name: Firewall Policies
    description: Firewall policies control how the Firebox handles traffic 
      between network zones. You can create, update, enable, disable, and delete
      firewall policies for cloud-managed Fireboxes.
  - name: Firewall Policy Groups
    description: Organizes firewall policies into policy groups.
  - name: Firewall Traffic Types
    description: Defines protocols and ports for firewall traffic types.
  - name: Firewall Aliases
    description: Groups firewall alias members.
  - name: Networking Networks
    description: Defines network interfaces and settings.
  - name: Authentication Users
    description: Authenticates users to the Firebox.
  - name: Authentication Groups
    description: Organizes authentication users and groups.
  - name: Authentication Auth Groups
    description: Organizes authentication users and auth groups.
  - name: Authentication AuthPoint User Groups
    description: Authentication AuthPoint user groups are used to organize 
      authentication AuthPoint users and AuthPoint groups.
  - name: Authentication SAML User Groups
    description: Organizes SAML users and groups.
  - name: Firewall SNAT Actions
    description: Defines SNAT action rules.
  - name: Networking SD-WANs
    description: Defines SD-WAN configuration.
  - name: Traffic Shaping Rules
    description: Defines traffic shaping bandwidth limits.
  - name: System Schedules
    description: Defines schedule time periods.
  - name: Content Filtering
    description: Defines content filtering rules.
  - name: Templates
    description: Configuration templates define reusable Firebox settings that 
      you can subscribe devices to. Use these endpoints to retrieve template 
      subscriptions, subscribe a device to templates, change template order, or 
      unsubscribe from all templates.
servers:
  - url: https://api.usa.cloud.watchguard.com/rest/firebox/management
    description: Prod USA Region
  - url: https://api.deu.cloud.watchguard.com/rest/firebox/management
    description: Prod DEU region
  - url: https://api.jpn.cloud.watchguard.com/rest/firebox/management
    description: Prod JPN region
security:
  - ApiKeyAuth: []
    BearerAuth: []
externalDocs:
  description: Additional documentation
  url: https://www.watchguard.com/help/docs/api/Content/en-US/home.html
