action conjur_show_resource {
  label: "Shows a description of a single resource."
  description: "Details about a single resource.\n\nIf `permitted_roles` and `privilege` are given, Conjur lists the\nroles with the specified privilege on the resource.\n\nIf `check`, `privilege` and `role` are given, Conjur checks if the\nspecified role has the privilege on the resource.\n\nIf `permitted_roles` and `check` are both given, Conjur responds to the `check` call ONLY.\n\n##### Permissions Required\n"
  provider: conjur
  method: GET
  path: "/resources/{account}/{kind}/{identifier}"
  encoding: json
  input: {
    type: "object"
    properties: {
      account: {
        type: "string"
        description: "Conjur account name"
      }
      check: {
        type: "boolean"
        description: "Checks whether a role has a privilege on a resource."
      }
      identifier: {
        type: "string"
        description: "Resource identifier. Requires to be encoded when in path.\n\n##### Examples:\n\n- `myapp-01` -> `myapp-01` (unchanged)\n- `alice@devops` -> `alice%40devops`\n- `prod/aws/db-password` -> `prod%2Faws%2Fdb-password`\n- `research+development` -> `research%2Bdevelopment`\n- `sales&marketing` -> `sales%26marketing`\n"
      }
      kind: {
        type: "string"
      }
      permitted_roles: {
        type: "boolean"
      }
      privilege: {
        type: "string"
        description: "Denotes a type of permission allowed on a resource"
      }
      role: {
        type: "string"
        description: "##### Kinds of roles:\n\n- User: one unique wonderful human\n- Host: a single logical machine (in the broad sense, not just physical)\n- Layer: a collection of hosts that have the same privileges\n- Group: a collection of users and groups that have the same privileges\n- Policy: a role which owns of a set of related object\n\nAny identifier included in the URL must be URL-encoded to be recognized by the Conjur API.\n\n##### Resource Identifiers:\n\n- `myapp-01` -> `myapp-01` (unchanged)\n- `alice@devops` -> `alice%40devops`\n- `prod/aws/db-password` -> `prod%2Faws%2Fdb-password`\n- `research+development` -> `research%2Bdevelopment`\n- `sales&marketing` -> `sales%26marketing`\n"
      }
    }
    required: ["account", "identifier", "kind"]
    additionalProperties: false
  }
  output: {
    type: "object"
    additionalProperties: true
  }
}