VAmPI.txt

{
  "openapi": "3.0.1",
  "info": {
    "title": "VAmPI",
    "description": "OpenAPI v3 specs for VAmPI",
    "version": "0.1"
  },
  "servers": [
    {
      "url": "/"
    }
  ],
  "components": {},
  "paths": {
    "/createdb": {
      "get": {
        "tags": [
          "db-init"
        ],
        "summary": "Creates and populates the database with dummy data",
        "description": "Creates and populates the database with dummy data",
        "operationId": "api_views.main.populate_db",
        "responses": {
          "200": {
            "description": "Creates and populates the database with dummy data",
            "content": {}
          }
        }
      }
    },
    "/": {
      "get": {
        "tags": [
          "home"
        ],
        "summary": "VAmPI home",
        "description": "VAmPI is a vulnerable on purpose API. It was created in order to evaluate the efficiency of third party tools in identifying vulnerabilities in APIs but it can also be used in learning/teaching purposes.",
        "operationId": "api_views.main.basic",
        "responses": {
          "200": {
            "description": "Home - Help",
            "content": {}
          }
        }
      }
    },
    "/users/v1": {
      "get": {
        "tags": [
          "users"
        ],
        "summary": "Retrieves all users",
        "description": "Displays all users with basic information",
        "operationId": "api_views.users.get_all_users",
        "responses": {
          "200": {
            "description": "See basic info about all users",
            "content": {}
          }
        }
      }
    },
    "/users/v1/_debug": {
      "get": {
        "tags": [
          "users"
        ],
        "summary": "Retrieves all details for all users",
        "description": "Displays all details for all users",
        "operationId": "api_views.users.debug",
        "responses": {
          "200": {
            "description": "See all details of the users",
            "content": {}
          }
        }
      }
    },
    "/users/v1/register": {
      "post": {
        "tags": [
          "users"
        ],
        "summary": "Register new user",
        "description": "Register new user",
        "operationId": "api_views.users.register_user",
        "requestBody": {
          "description": "Username of the user",
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "username": {
                    "type": "string"
                  },
                  "password": {
                    "type": "string"
                  },
                  "email": {
                    "type": "string"
                  }
                }
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "description": "Sucessfully created user",
            "content": {}
          },
          "400": {
            "description": "Invalid request",
            "content": {}
          }
        }
      }
    },
    "/users/v1/login": {
      "post": {
        "tags": [
          "users"
        ],
        "summary": "Login to VAmPI",
        "description": "Login to VAmPI",
        "operationId": "api_views.users.login_user",
        "requestBody": {
          "description": "Username of the user",
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "username": {
                    "type": "string"
                  },
                  "password": {
                    "type": "string"
                  }
                }
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "description": "Sucessfully logged in user",
            "content": {}
          },
          "400": {
            "description": "Invalid request",
            "content": {}
          }
        }
      }
    },
    "/users/v1/{username}": {
      "get": {
        "tags": [
          "users"
        ],
        "summary": "Retrieves user by username",
        "description": "Displays user by username",
        "operationId": "api_views.users.get_by_username",
        "parameters": [
          {
            "name": "username",
            "in": "path",
            "description": "retrieve username data",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successfully display user info",
            "content": {
              "application/json": {
                "schema": {
                  "type": "array",
                  "items": {
                    "type": "object",
                    "properties": {
                      "username": {
                        "type": "string"
                      },
                      "email": {
                        "type": "string"
                      }
                    }
                  }
                }
              }
            }
          },
          "404": {
            "description": "User not found",
            "content": {}
          }
        }
      },
      "delete": {
        "tags": [
          "users"
        ],
        "summary": "Deletes user by username (Only Admins)",
        "description": "Deletes user by username (Only Admins)",
        "operationId": "api_views.users.delete_user",
        "parameters": [
          {
            "name": "username",
            "in": "path",
            "description": "Delete username",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "Sucessfully deleted user",
            "content": {}
          },
          "401": {
            "description": "User not authorized",
            "content": {}
          },
          "404": {
            "description": "User not found",
            "content": {}
          }
        }
      }
    },
    "/users/v1/{username}/email": {
      "put": {
        "tags": [
          "users"
        ],
        "summary": "Update users email",
        "description": "Update a single users email",
        "operationId": "api_views.users.update_email",
        "parameters": [
          {
            "name": "username",
            "in": "path",
            "description": "username to update email",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "description": "field to update",
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "email": {
                    "type": "string"
                  }
                }
              }
            }
          },
          "required": true
        },
        "responses": {
          "204": {
            "description": "Sucessfully updated user email",
            "content": {}
          },
          "400": {
            "description": "Invalid request",
            "content": {}
          },
          "401": {
            "description": "User not authorized",
            "content": {}
          }
        }
      }
    },
    "/users/v1/{username}/password": {
      "put": {
        "tags": [
          "users"
        ],
        "summary": "Update users password",
        "description": "Update users password",
        "operationId": "api_views.users.update_password",
        "parameters": [
          {
            "name": "username",
            "in": "path",
            "description": "username to update password",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "description": "field to update",
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "password": {
                    "type": "string"
                  }
                }
              }
            }
          },
          "required": true
        },
        "responses": {
          "204": {
            "description": "Sucessfully updated users password",
            "content": {}
          },
          "400": {
            "description": "Invalid request",
            "content": {}
          },
          "401": {
            "description": "User not authorized",
            "content": {}
          }
        }
      }
    },
    "/books/v1": {
      "get": {
        "tags": [
          "books"
        ],
        "summary": "Retrieves all books",
        "description": "Retrieves all books",
        "operationId": "api_views.books.get_all_books",
        "responses": {
          "200": {
            "description": "See all books",
            "content": {}
          }
        }
      },
      "post": {
        "tags": [
          "books"
        ],
        "summary": "Add new book",
        "description": "Add new book",
        "operationId": "api_views.books.add_new_book",
        "requestBody": {
          "description": "Add new book with title and secret content only available to the user who added it.",
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "book_title": {
                    "type": "string"
                  },
                  "secret": {
                    "type": "string"
                  }
                }
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "description": "Sucessfully added a book",
            "content": {}
          },
          "400": {
            "description": "Invalid request",
            "content": {}
          },
          "401": {
            "description": "User not authorized",
            "content": {}
          }
        }
      }
    },
    "/books/v1/{book}": {
      "get": {
        "tags": [
          "books"
        ],
        "summary": "Retrieves book by title along with secret",
        "description": "Retrieves book by title along with secret. Only the owner may retrieve it",
        "operationId": "api_views.books.get_by_title",
        "parameters": [
          {
            "name": "book",
            "in": "path",
            "description": "retrieve book data",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successfully retrieve book info",
            "content": {
              "application/json": {
                "schema": {
                  "type": "array",
                  "items": {
                    "type": "object",
                    "properties": {
                      "book_title": {
                        "type": "string"
                      },
                      "secret": {
                        "type": "string"
                      },
                      "owner": {
                        "type": "string"
                      }
                    }
                  }
                }
              }
            }
          },
          "401": {
            "description": "User not authorized",
            "content": {}
          },
          "404": {
            "description": "Book not found",
            "content": {}
          }
        }
      }
    }
  }
}