# Security Policies ## CreateSecurityPolicy `client.SecurityPolicies.New(ctx, body) (*SecurityPolicyNewResponse, error)` **post** `/gitpod.v1.SecurityService/CreateSecurityPolicy` Creates a new security policy. Use this method to: - Define environment access controls - Configure audited or blocked operations - Manage organization security posture ### Examples - Create security policy: Creates an audit-first Veto Exec policy with one audited bare name and one blocked absolute path. Creation stores an inactive definition; assigning it as the organization default validates materializability. ```yaml organizationId: "b0e12f6c-4c67-429d-a4a6-d9838b5da047" metadata: name: "Veto Exec audit-first" spec: executables: defaultEffect: EFFECT_ALLOW rules: - path: "npx" effect: EFFECT_AUDIT - path: "/usr/bin/curl" effect: EFFECT_BLOCK ``` ### Parameters - `body SecurityPolicyNewParams` - `Metadata param.Field[SecurityPolicyNewParamsMetadata]` - `Name string` - `Spec param.Field[SecurityPolicyNewParamsSpec]` Mandate/deploy security agents, e.g. CrowdStrike. Mandate credential security/proxy use. These can be modeled later as explicit fields if needed. - `Executables SecurityPolicyNewParamsSpecExecutables` executables is the public Veto Exec GA policy surface. - `DefaultEffect SecurityPolicyNewParamsSpecExecutablesDefaultEffect` default_effect controls executables that do not match a rule. For Veto Exec, omit this field or set it to EFFECT_ALLOW. EFFECT_UNSPECIFIED is normalized to EFFECT_ALLOW. - `const SecurityPolicyNewParamsSpecExecutablesDefaultEffectEffectUnspecified SecurityPolicyNewParamsSpecExecutablesDefaultEffect = "EFFECT_UNSPECIFIED"` - `const SecurityPolicyNewParamsSpecExecutablesDefaultEffectEffectAllow SecurityPolicyNewParamsSpecExecutablesDefaultEffect = "EFFECT_ALLOW"` - `const SecurityPolicyNewParamsSpecExecutablesDefaultEffectEffectBlock SecurityPolicyNewParamsSpecExecutablesDefaultEffect = "EFFECT_BLOCK"` - `const SecurityPolicyNewParamsSpecExecutablesDefaultEffectEffectAudit SecurityPolicyNewParamsSpecExecutablesDefaultEffect = "EFFECT_AUDIT"` - `Rules []SecurityPolicyNewParamsSpecExecutablesRule` rules contains executable-specific audit or block decisions. - `Effect SecurityPolicyNewParamsSpecExecutablesRulesEffect` effect must be EFFECT_AUDIT or EFFECT_BLOCK. EFFECT_ALLOW is not supported on an executable rule. - `const SecurityPolicyNewParamsSpecExecutablesRulesEffectEffectUnspecified SecurityPolicyNewParamsSpecExecutablesRulesEffect = "EFFECT_UNSPECIFIED"` - `const SecurityPolicyNewParamsSpecExecutablesRulesEffectEffectAllow SecurityPolicyNewParamsSpecExecutablesRulesEffect = "EFFECT_ALLOW"` - `const SecurityPolicyNewParamsSpecExecutablesRulesEffectEffectBlock SecurityPolicyNewParamsSpecExecutablesRulesEffect = "EFFECT_BLOCK"` - `const SecurityPolicyNewParamsSpecExecutablesRulesEffectEffectAudit SecurityPolicyNewParamsSpecExecutablesRulesEffect = "EFFECT_AUDIT"` - `Path string` path is either an absolute executable path, such as /usr/bin/curl, or a bare executable name, such as npx. Bare names are expanded by runtime discovery. Surrounding whitespace is ignored. Empty or whitespace-only selectors and relative paths with directory separators are invalid. Enforcement uses executable content hashes, so different paths with identical content share one runtime decision and block wins conflicts. - `OrganizationID param.Field[string]` ### Returns - `type SecurityPolicyNewResponse struct{…}` - `SecurityPolicy SecurityPolicy` - `Metadata SecurityPolicyMetadata` - `Name string` - `Spec SecurityPolicySpec` Mandate/deploy security agents, e.g. CrowdStrike. Mandate credential security/proxy use. These can be modeled later as explicit fields if needed. - `Executables SecurityPolicySpecExecutables` executables is the public Veto Exec GA policy surface. - `DefaultEffect SecurityPolicySpecExecutablesDefaultEffect` default_effect controls executables that do not match a rule. For Veto Exec, omit this field or set it to EFFECT_ALLOW. EFFECT_UNSPECIFIED is normalized to EFFECT_ALLOW. - `const SecurityPolicySpecExecutablesDefaultEffectEffectUnspecified SecurityPolicySpecExecutablesDefaultEffect = "EFFECT_UNSPECIFIED"` - `const SecurityPolicySpecExecutablesDefaultEffectEffectAllow SecurityPolicySpecExecutablesDefaultEffect = "EFFECT_ALLOW"` - `const SecurityPolicySpecExecutablesDefaultEffectEffectBlock SecurityPolicySpecExecutablesDefaultEffect = "EFFECT_BLOCK"` - `const SecurityPolicySpecExecutablesDefaultEffectEffectAudit SecurityPolicySpecExecutablesDefaultEffect = "EFFECT_AUDIT"` - `Rules []SecurityPolicySpecExecutablesRule` rules contains executable-specific audit or block decisions. - `Effect SecurityPolicySpecExecutablesRulesEffect` effect must be EFFECT_AUDIT or EFFECT_BLOCK. EFFECT_ALLOW is not supported on an executable rule. - `const SecurityPolicySpecExecutablesRulesEffectEffectUnspecified SecurityPolicySpecExecutablesRulesEffect = "EFFECT_UNSPECIFIED"` - `const SecurityPolicySpecExecutablesRulesEffectEffectAllow SecurityPolicySpecExecutablesRulesEffect = "EFFECT_ALLOW"` - `const SecurityPolicySpecExecutablesRulesEffectEffectBlock SecurityPolicySpecExecutablesRulesEffect = "EFFECT_BLOCK"` - `const SecurityPolicySpecExecutablesRulesEffectEffectAudit SecurityPolicySpecExecutablesRulesEffect = "EFFECT_AUDIT"` - `Path string` path is either an absolute executable path, such as /usr/bin/curl, or a bare executable name, such as npx. Bare names are expanded by runtime discovery. Surrounding whitespace is ignored. Empty or whitespace-only selectors and relative paths with directory separators are invalid. Enforcement uses executable content hashes, so different paths with identical content share one runtime decision and block wins conflicts. - `ID string` - `CreatedAt Time` A Timestamp represents a point in time independent of any time zone or local calendar, encoded as a count of seconds and fractions of seconds at nanosecond resolution. The count is relative to an epoch at UTC midnight on January 1, 1970, in the proleptic Gregorian calendar which extends the Gregorian calendar backwards to year one. All minutes are 60 seconds long. Leap seconds are "smeared" so that no leap second table is needed for interpretation, using a [24-hour linear smear](https://developers.google.com/time/smear). The range is from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59.999999999Z. By restricting to that range, we ensure that we can convert to and from [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) date strings. # Examples Example 1: Compute Timestamp from POSIX `time()`. Timestamp timestamp; timestamp.set_seconds(time(NULL)); timestamp.set_nanos(0); Example 2: Compute Timestamp from POSIX `gettimeofday()`. struct timeval tv; gettimeofday(&tv, NULL); Timestamp timestamp; timestamp.set_seconds(tv.tv_sec); timestamp.set_nanos(tv.tv_usec * 1000); Example 3: Compute Timestamp from Win32 `GetSystemTimeAsFileTime()`. FILETIME ft; GetSystemTimeAsFileTime(&ft); UINT64 ticks = (((UINT64)ft.dwHighDateTime) << 32) | ft.dwLowDateTime; // A Windows tick is 100 nanoseconds. Windows epoch 1601-01-01T00:00:00Z // is 11644473600 seconds before Unix epoch 1970-01-01T00:00:00Z. Timestamp timestamp; timestamp.set_seconds((INT64) ((ticks / 10000000) - 11644473600LL)); timestamp.set_nanos((INT32) ((ticks % 10000000) * 100)); Example 4: Compute Timestamp from Java `System.currentTimeMillis()`. long millis = System.currentTimeMillis(); Timestamp timestamp = Timestamp.newBuilder().setSeconds(millis / 1000) .setNanos((int) ((millis % 1000) * 1000000)).build(); Example 5: Compute Timestamp from Java `Instant.now()`. Instant now = Instant.now(); Timestamp timestamp = Timestamp.newBuilder().setSeconds(now.getEpochSecond()) .setNanos(now.getNano()).build(); Example 6: Compute Timestamp from current time in Python. timestamp = Timestamp() timestamp.GetCurrentTime() # JSON Mapping In JSON format, the Timestamp type is encoded as a string in the [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) format. That is, the format is "{year}-{month}-{day}T{hour}:{min}:{sec}[.{frac_sec}]Z" where {year} is always expressed using four digits while {month}, {day}, {hour}, {min}, and {sec} are zero-padded to two digits each. The fractional seconds, which can go up to 9 digits (i.e. up to 1 nanosecond resolution), are optional. The "Z" suffix indicates the timezone ("UTC"); the timezone is required. A proto3 JSON serializer should always use UTC (as indicated by "Z") when printing the Timestamp type and a proto3 JSON parser should be able to accept both UTC and other timezones (as indicated by an offset). For example, "2017-01-15T01:30:15.01Z" encodes 15.01 seconds past 01:30 UTC on January 15, 2017. In JavaScript, one can convert a Date object to this format using the standard [toISOString()](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/toISOString) method. In Python, a standard `datetime.datetime` object can be converted to this format using [`strftime`](https://docs.python.org/2/library/time.html#time.strftime) with the time format spec '%Y-%m-%dT%H:%M:%S.%fZ'. Likewise, in Java, one can use the Joda Time's [`ISODateTimeFormat.dateTime()`](http://joda-time.sourceforge.net/apidocs/org/joda/time/format/ISODateTimeFormat.html#dateTime\(\)) to obtain a formatter capable of generating timestamps in this format. - `OrganizationID string` - `UpdatedAt Time` A Timestamp represents a point in time independent of any time zone or local calendar, encoded as a count of seconds and fractions of seconds at nanosecond resolution. The count is relative to an epoch at UTC midnight on January 1, 1970, in the proleptic Gregorian calendar which extends the Gregorian calendar backwards to year one. All minutes are 60 seconds long. Leap seconds are "smeared" so that no leap second table is needed for interpretation, using a [24-hour linear smear](https://developers.google.com/time/smear). The range is from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59.999999999Z. By restricting to that range, we ensure that we can convert to and from [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) date strings. # Examples Example 1: Compute Timestamp from POSIX `time()`. Timestamp timestamp; timestamp.set_seconds(time(NULL)); timestamp.set_nanos(0); Example 2: Compute Timestamp from POSIX `gettimeofday()`. struct timeval tv; gettimeofday(&tv, NULL); Timestamp timestamp; timestamp.set_seconds(tv.tv_sec); timestamp.set_nanos(tv.tv_usec * 1000); Example 3: Compute Timestamp from Win32 `GetSystemTimeAsFileTime()`. FILETIME ft; GetSystemTimeAsFileTime(&ft); UINT64 ticks = (((UINT64)ft.dwHighDateTime) << 32) | ft.dwLowDateTime; // A Windows tick is 100 nanoseconds. Windows epoch 1601-01-01T00:00:00Z // is 11644473600 seconds before Unix epoch 1970-01-01T00:00:00Z. Timestamp timestamp; timestamp.set_seconds((INT64) ((ticks / 10000000) - 11644473600LL)); timestamp.set_nanos((INT32) ((ticks % 10000000) * 100)); Example 4: Compute Timestamp from Java `System.currentTimeMillis()`. long millis = System.currentTimeMillis(); Timestamp timestamp = Timestamp.newBuilder().setSeconds(millis / 1000) .setNanos((int) ((millis % 1000) * 1000000)).build(); Example 5: Compute Timestamp from Java `Instant.now()`. Instant now = Instant.now(); Timestamp timestamp = Timestamp.newBuilder().setSeconds(now.getEpochSecond()) .setNanos(now.getNano()).build(); Example 6: Compute Timestamp from current time in Python. timestamp = Timestamp() timestamp.GetCurrentTime() # JSON Mapping In JSON format, the Timestamp type is encoded as a string in the [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) format. That is, the format is "{year}-{month}-{day}T{hour}:{min}:{sec}[.{frac_sec}]Z" where {year} is always expressed using four digits while {month}, {day}, {hour}, {min}, and {sec} are zero-padded to two digits each. The fractional seconds, which can go up to 9 digits (i.e. up to 1 nanosecond resolution), are optional. The "Z" suffix indicates the timezone ("UTC"); the timezone is required. A proto3 JSON serializer should always use UTC (as indicated by "Z") when printing the Timestamp type and a proto3 JSON parser should be able to accept both UTC and other timezones (as indicated by an offset). For example, "2017-01-15T01:30:15.01Z" encodes 15.01 seconds past 01:30 UTC on January 15, 2017. In JavaScript, one can convert a Date object to this format using the standard [toISOString()](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/toISOString) method. In Python, a standard `datetime.datetime` object can be converted to this format using [`strftime`](https://docs.python.org/2/library/time.html#time.strftime) with the time format spec '%Y-%m-%dT%H:%M:%S.%fZ'. Likewise, in Java, one can use the Joda Time's [`ISODateTimeFormat.dateTime()`](http://joda-time.sourceforge.net/apidocs/org/joda/time/format/ISODateTimeFormat.html#dateTime\(\)) to obtain a formatter capable of generating timestamps in this format. ### Example ```go package main import ( "context" "fmt" "github.com/gitpod-io/gitpod-sdk-go" "github.com/gitpod-io/gitpod-sdk-go/option" ) func main() { client := gitpod.NewClient( option.WithBearerToken("My Bearer Token"), ) securityPolicy, err := client.SecurityPolicies.New(context.TODO(), gitpod.SecurityPolicyNewParams{ Metadata: gitpod.F(gitpod.SecurityPolicyNewParamsMetadata{ Name: gitpod.F("Veto Exec audit-first"), }), Spec: gitpod.F(gitpod.SecurityPolicyNewParamsSpec{ Executables: gitpod.F(gitpod.SecurityPolicyNewParamsSpecExecutables{ DefaultEffect: gitpod.F(gitpod.SecurityPolicyNewParamsSpecExecutablesDefaultEffectEffectAllow), Rules: gitpod.F([]gitpod.SecurityPolicyNewParamsSpecExecutablesRule{gitpod.SecurityPolicyNewParamsSpecExecutablesRule{ Effect: gitpod.F(gitpod.SecurityPolicyNewParamsSpecExecutablesRulesEffectEffectAudit), Path: gitpod.F("npx"), }, gitpod.SecurityPolicyNewParamsSpecExecutablesRule{ Effect: gitpod.F(gitpod.SecurityPolicyNewParamsSpecExecutablesRulesEffectEffectBlock), Path: gitpod.F("/usr/bin/curl"), }}), }), }), OrganizationID: gitpod.F("b0e12f6c-4c67-429d-a4a6-d9838b5da047"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", securityPolicy.SecurityPolicy) } ``` #### Response ```json { "securityPolicy": { "metadata": { "name": "x" }, "spec": { "blockDevices": { "defaultEffect": "EFFECT_UNSPECIFIED" }, "data": { "defaultEffect": "EFFECT_UNSPECIFIED", "rules": [ { "destination": { "host": "host" }, "effect": "EFFECT_UNSPECIFIED", "source": { "file": "file", "integration": "integration", "selector": "selector" } } ] }, "executables": { "defaultEffect": "EFFECT_UNSPECIFIED", "rules": [ { "effect": "EFFECT_UNSPECIFIED", "path": "path" } ] }, "files": { "defaultActions": [ "ACTION_UNSPECIFIED" ], "defaultEffect": "EFFECT_UNSPECIFIED", "rules": [ { "actions": [ "ACTION_UNSPECIFIED" ], "effect": "EFFECT_UNSPECIFIED", "path": "path" } ] }, "ports": { "maxAdmissionLevel": "ADMISSION_LEVEL_UNSPECIFIED" } }, "id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "createdAt": "2019-12-27T18:11:19.117Z", "organizationId": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "updatedAt": "2019-12-27T18:11:19.117Z" } } ``` ## DeleteSecurityPolicy `client.SecurityPolicies.Delete(ctx, body) (*SecurityPolicyDeleteResponse, error)` **post** `/gitpod.v1.SecurityService/DeleteSecurityPolicy` Deletes a security policy. Use this method to: - Remove obsolete security policies - Clean up unused policy definitions ### Examples - Delete security policy: Permanently removes a security policy. ```yaml securityPolicyId: "d2c94c27-3b76-4a42-b88c-95a85e392c68" ``` ### Parameters - `body SecurityPolicyDeleteParams` - `SecurityPolicyID param.Field[string]` ### Returns - `type SecurityPolicyDeleteResponse interface{…}` ### Example ```go package main import ( "context" "fmt" "github.com/gitpod-io/gitpod-sdk-go" "github.com/gitpod-io/gitpod-sdk-go/option" ) func main() { client := gitpod.NewClient( option.WithBearerToken("My Bearer Token"), ) securityPolicy, err := client.SecurityPolicies.Delete(context.TODO(), gitpod.SecurityPolicyDeleteParams{ SecurityPolicyID: gitpod.F("d2c94c27-3b76-4a42-b88c-95a85e392c68"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", securityPolicy) } ``` #### Response ```json {} ``` ## ListSecurityPolicies `client.SecurityPolicies.List(ctx, params) (*SecurityPoliciesPage[SecurityPolicy], error)` **post** `/gitpod.v1.SecurityService/ListSecurityPolicies` Lists security policies. Use this method to: - View all security policies in an organization - Audit configured security controls ### Examples - List organization policies: Shows security policies with pagination. ```yaml filter: organizationId: "b0e12f6c-4c67-429d-a4a6-d9838b5da047" pagination: pageSize: 20 ``` ### Parameters - `params SecurityPolicyListParams` - `Token param.Field[string]` Query param - `PageSize param.Field[int64]` Query param - `Filter param.Field[SecurityPolicyListParamsFilter]` Body param - `OrganizationID string` - `Search string` - `SecurityPolicyIDs []string` - `Pagination param.Field[SecurityPolicyListParamsPagination]` Body param - `Token string` Token for the next set of results that was returned as next_token of a PaginationResponse - `PageSize int64` Page size is the maximum number of results to retrieve per page. Defaults to 25. Maximum 100. ### Returns - `type SecurityPolicy struct{…}` - `Metadata SecurityPolicyMetadata` - `Name string` - `Spec SecurityPolicySpec` Mandate/deploy security agents, e.g. CrowdStrike. Mandate credential security/proxy use. These can be modeled later as explicit fields if needed. - `Executables SecurityPolicySpecExecutables` executables is the public Veto Exec GA policy surface. - `DefaultEffect SecurityPolicySpecExecutablesDefaultEffect` default_effect controls executables that do not match a rule. For Veto Exec, omit this field or set it to EFFECT_ALLOW. EFFECT_UNSPECIFIED is normalized to EFFECT_ALLOW. - `const SecurityPolicySpecExecutablesDefaultEffectEffectUnspecified SecurityPolicySpecExecutablesDefaultEffect = "EFFECT_UNSPECIFIED"` - `const SecurityPolicySpecExecutablesDefaultEffectEffectAllow SecurityPolicySpecExecutablesDefaultEffect = "EFFECT_ALLOW"` - `const SecurityPolicySpecExecutablesDefaultEffectEffectBlock SecurityPolicySpecExecutablesDefaultEffect = "EFFECT_BLOCK"` - `const SecurityPolicySpecExecutablesDefaultEffectEffectAudit SecurityPolicySpecExecutablesDefaultEffect = "EFFECT_AUDIT"` - `Rules []SecurityPolicySpecExecutablesRule` rules contains executable-specific audit or block decisions. - `Effect SecurityPolicySpecExecutablesRulesEffect` effect must be EFFECT_AUDIT or EFFECT_BLOCK. EFFECT_ALLOW is not supported on an executable rule. - `const SecurityPolicySpecExecutablesRulesEffectEffectUnspecified SecurityPolicySpecExecutablesRulesEffect = "EFFECT_UNSPECIFIED"` - `const SecurityPolicySpecExecutablesRulesEffectEffectAllow SecurityPolicySpecExecutablesRulesEffect = "EFFECT_ALLOW"` - `const SecurityPolicySpecExecutablesRulesEffectEffectBlock SecurityPolicySpecExecutablesRulesEffect = "EFFECT_BLOCK"` - `const SecurityPolicySpecExecutablesRulesEffectEffectAudit SecurityPolicySpecExecutablesRulesEffect = "EFFECT_AUDIT"` - `Path string` path is either an absolute executable path, such as /usr/bin/curl, or a bare executable name, such as npx. Bare names are expanded by runtime discovery. Surrounding whitespace is ignored. Empty or whitespace-only selectors and relative paths with directory separators are invalid. Enforcement uses executable content hashes, so different paths with identical content share one runtime decision and block wins conflicts. - `ID string` - `CreatedAt Time` A Timestamp represents a point in time independent of any time zone or local calendar, encoded as a count of seconds and fractions of seconds at nanosecond resolution. The count is relative to an epoch at UTC midnight on January 1, 1970, in the proleptic Gregorian calendar which extends the Gregorian calendar backwards to year one. All minutes are 60 seconds long. Leap seconds are "smeared" so that no leap second table is needed for interpretation, using a [24-hour linear smear](https://developers.google.com/time/smear). The range is from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59.999999999Z. By restricting to that range, we ensure that we can convert to and from [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) date strings. # Examples Example 1: Compute Timestamp from POSIX `time()`. Timestamp timestamp; timestamp.set_seconds(time(NULL)); timestamp.set_nanos(0); Example 2: Compute Timestamp from POSIX `gettimeofday()`. struct timeval tv; gettimeofday(&tv, NULL); Timestamp timestamp; timestamp.set_seconds(tv.tv_sec); timestamp.set_nanos(tv.tv_usec * 1000); Example 3: Compute Timestamp from Win32 `GetSystemTimeAsFileTime()`. FILETIME ft; GetSystemTimeAsFileTime(&ft); UINT64 ticks = (((UINT64)ft.dwHighDateTime) << 32) | ft.dwLowDateTime; // A Windows tick is 100 nanoseconds. Windows epoch 1601-01-01T00:00:00Z // is 11644473600 seconds before Unix epoch 1970-01-01T00:00:00Z. Timestamp timestamp; timestamp.set_seconds((INT64) ((ticks / 10000000) - 11644473600LL)); timestamp.set_nanos((INT32) ((ticks % 10000000) * 100)); Example 4: Compute Timestamp from Java `System.currentTimeMillis()`. long millis = System.currentTimeMillis(); Timestamp timestamp = Timestamp.newBuilder().setSeconds(millis / 1000) .setNanos((int) ((millis % 1000) * 1000000)).build(); Example 5: Compute Timestamp from Java `Instant.now()`. Instant now = Instant.now(); Timestamp timestamp = Timestamp.newBuilder().setSeconds(now.getEpochSecond()) .setNanos(now.getNano()).build(); Example 6: Compute Timestamp from current time in Python. timestamp = Timestamp() timestamp.GetCurrentTime() # JSON Mapping In JSON format, the Timestamp type is encoded as a string in the [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) format. That is, the format is "{year}-{month}-{day}T{hour}:{min}:{sec}[.{frac_sec}]Z" where {year} is always expressed using four digits while {month}, {day}, {hour}, {min}, and {sec} are zero-padded to two digits each. The fractional seconds, which can go up to 9 digits (i.e. up to 1 nanosecond resolution), are optional. The "Z" suffix indicates the timezone ("UTC"); the timezone is required. A proto3 JSON serializer should always use UTC (as indicated by "Z") when printing the Timestamp type and a proto3 JSON parser should be able to accept both UTC and other timezones (as indicated by an offset). For example, "2017-01-15T01:30:15.01Z" encodes 15.01 seconds past 01:30 UTC on January 15, 2017. In JavaScript, one can convert a Date object to this format using the standard [toISOString()](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/toISOString) method. In Python, a standard `datetime.datetime` object can be converted to this format using [`strftime`](https://docs.python.org/2/library/time.html#time.strftime) with the time format spec '%Y-%m-%dT%H:%M:%S.%fZ'. Likewise, in Java, one can use the Joda Time's [`ISODateTimeFormat.dateTime()`](http://joda-time.sourceforge.net/apidocs/org/joda/time/format/ISODateTimeFormat.html#dateTime\(\)) to obtain a formatter capable of generating timestamps in this format. - `OrganizationID string` - `UpdatedAt Time` A Timestamp represents a point in time independent of any time zone or local calendar, encoded as a count of seconds and fractions of seconds at nanosecond resolution. The count is relative to an epoch at UTC midnight on January 1, 1970, in the proleptic Gregorian calendar which extends the Gregorian calendar backwards to year one. All minutes are 60 seconds long. Leap seconds are "smeared" so that no leap second table is needed for interpretation, using a [24-hour linear smear](https://developers.google.com/time/smear). The range is from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59.999999999Z. By restricting to that range, we ensure that we can convert to and from [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) date strings. # Examples Example 1: Compute Timestamp from POSIX `time()`. Timestamp timestamp; timestamp.set_seconds(time(NULL)); timestamp.set_nanos(0); Example 2: Compute Timestamp from POSIX `gettimeofday()`. struct timeval tv; gettimeofday(&tv, NULL); Timestamp timestamp; timestamp.set_seconds(tv.tv_sec); timestamp.set_nanos(tv.tv_usec * 1000); Example 3: Compute Timestamp from Win32 `GetSystemTimeAsFileTime()`. FILETIME ft; GetSystemTimeAsFileTime(&ft); UINT64 ticks = (((UINT64)ft.dwHighDateTime) << 32) | ft.dwLowDateTime; // A Windows tick is 100 nanoseconds. Windows epoch 1601-01-01T00:00:00Z // is 11644473600 seconds before Unix epoch 1970-01-01T00:00:00Z. Timestamp timestamp; timestamp.set_seconds((INT64) ((ticks / 10000000) - 11644473600LL)); timestamp.set_nanos((INT32) ((ticks % 10000000) * 100)); Example 4: Compute Timestamp from Java `System.currentTimeMillis()`. long millis = System.currentTimeMillis(); Timestamp timestamp = Timestamp.newBuilder().setSeconds(millis / 1000) .setNanos((int) ((millis % 1000) * 1000000)).build(); Example 5: Compute Timestamp from Java `Instant.now()`. Instant now = Instant.now(); Timestamp timestamp = Timestamp.newBuilder().setSeconds(now.getEpochSecond()) .setNanos(now.getNano()).build(); Example 6: Compute Timestamp from current time in Python. timestamp = Timestamp() timestamp.GetCurrentTime() # JSON Mapping In JSON format, the Timestamp type is encoded as a string in the [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) format. That is, the format is "{year}-{month}-{day}T{hour}:{min}:{sec}[.{frac_sec}]Z" where {year} is always expressed using four digits while {month}, {day}, {hour}, {min}, and {sec} are zero-padded to two digits each. The fractional seconds, which can go up to 9 digits (i.e. up to 1 nanosecond resolution), are optional. The "Z" suffix indicates the timezone ("UTC"); the timezone is required. A proto3 JSON serializer should always use UTC (as indicated by "Z") when printing the Timestamp type and a proto3 JSON parser should be able to accept both UTC and other timezones (as indicated by an offset). For example, "2017-01-15T01:30:15.01Z" encodes 15.01 seconds past 01:30 UTC on January 15, 2017. In JavaScript, one can convert a Date object to this format using the standard [toISOString()](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/toISOString) method. In Python, a standard `datetime.datetime` object can be converted to this format using [`strftime`](https://docs.python.org/2/library/time.html#time.strftime) with the time format spec '%Y-%m-%dT%H:%M:%S.%fZ'. Likewise, in Java, one can use the Joda Time's [`ISODateTimeFormat.dateTime()`](http://joda-time.sourceforge.net/apidocs/org/joda/time/format/ISODateTimeFormat.html#dateTime\(\)) to obtain a formatter capable of generating timestamps in this format. ### Example ```go package main import ( "context" "fmt" "github.com/gitpod-io/gitpod-sdk-go" "github.com/gitpod-io/gitpod-sdk-go/option" ) func main() { client := gitpod.NewClient( option.WithBearerToken("My Bearer Token"), ) page, err := client.SecurityPolicies.List(context.TODO(), gitpod.SecurityPolicyListParams{ Filter: gitpod.F(gitpod.SecurityPolicyListParamsFilter{ OrganizationID: gitpod.F("b0e12f6c-4c67-429d-a4a6-d9838b5da047"), }), Pagination: gitpod.F(gitpod.SecurityPolicyListParamsPagination{ PageSize: gitpod.F(int64(20)), }), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", page) } ``` #### Response ```json { "pagination": { "nextToken": "nextToken" }, "securityPolicies": [ { "metadata": { "name": "x" }, "spec": { "blockDevices": { "defaultEffect": "EFFECT_UNSPECIFIED" }, "data": { "defaultEffect": "EFFECT_UNSPECIFIED", "rules": [ { "destination": { "host": "host" }, "effect": "EFFECT_UNSPECIFIED", "source": { "file": "file", "integration": "integration", "selector": "selector" } } ] }, "executables": { "defaultEffect": "EFFECT_UNSPECIFIED", "rules": [ { "effect": "EFFECT_UNSPECIFIED", "path": "path" } ] }, "files": { "defaultActions": [ "ACTION_UNSPECIFIED" ], "defaultEffect": "EFFECT_UNSPECIFIED", "rules": [ { "actions": [ "ACTION_UNSPECIFIED" ], "effect": "EFFECT_UNSPECIFIED", "path": "path" } ] }, "ports": { "maxAdmissionLevel": "ADMISSION_LEVEL_UNSPECIFIED" } }, "id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "createdAt": "2019-12-27T18:11:19.117Z", "organizationId": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "updatedAt": "2019-12-27T18:11:19.117Z" } ] } ``` ## GetSecurityPolicy `client.SecurityPolicies.Get(ctx, body) (*SecurityPolicyGetResponse, error)` **post** `/gitpod.v1.SecurityService/GetSecurityPolicy` Gets details about a specific security policy. Use this method to: - View security policy configuration - Inspect enforcement rules ### Examples - Get security policy: Retrieves a security policy by ID. ```yaml securityPolicyId: "d2c94c27-3b76-4a42-b88c-95a85e392c68" ``` ### Parameters - `body SecurityPolicyGetParams` - `SecurityPolicyID param.Field[string]` ### Returns - `type SecurityPolicyGetResponse struct{…}` - `SecurityPolicy SecurityPolicy` - `Metadata SecurityPolicyMetadata` - `Name string` - `Spec SecurityPolicySpec` Mandate/deploy security agents, e.g. CrowdStrike. Mandate credential security/proxy use. These can be modeled later as explicit fields if needed. - `Executables SecurityPolicySpecExecutables` executables is the public Veto Exec GA policy surface. - `DefaultEffect SecurityPolicySpecExecutablesDefaultEffect` default_effect controls executables that do not match a rule. For Veto Exec, omit this field or set it to EFFECT_ALLOW. EFFECT_UNSPECIFIED is normalized to EFFECT_ALLOW. - `const SecurityPolicySpecExecutablesDefaultEffectEffectUnspecified SecurityPolicySpecExecutablesDefaultEffect = "EFFECT_UNSPECIFIED"` - `const SecurityPolicySpecExecutablesDefaultEffectEffectAllow SecurityPolicySpecExecutablesDefaultEffect = "EFFECT_ALLOW"` - `const SecurityPolicySpecExecutablesDefaultEffectEffectBlock SecurityPolicySpecExecutablesDefaultEffect = "EFFECT_BLOCK"` - `const SecurityPolicySpecExecutablesDefaultEffectEffectAudit SecurityPolicySpecExecutablesDefaultEffect = "EFFECT_AUDIT"` - `Rules []SecurityPolicySpecExecutablesRule` rules contains executable-specific audit or block decisions. - `Effect SecurityPolicySpecExecutablesRulesEffect` effect must be EFFECT_AUDIT or EFFECT_BLOCK. EFFECT_ALLOW is not supported on an executable rule. - `const SecurityPolicySpecExecutablesRulesEffectEffectUnspecified SecurityPolicySpecExecutablesRulesEffect = "EFFECT_UNSPECIFIED"` - `const SecurityPolicySpecExecutablesRulesEffectEffectAllow SecurityPolicySpecExecutablesRulesEffect = "EFFECT_ALLOW"` - `const SecurityPolicySpecExecutablesRulesEffectEffectBlock SecurityPolicySpecExecutablesRulesEffect = "EFFECT_BLOCK"` - `const SecurityPolicySpecExecutablesRulesEffectEffectAudit SecurityPolicySpecExecutablesRulesEffect = "EFFECT_AUDIT"` - `Path string` path is either an absolute executable path, such as /usr/bin/curl, or a bare executable name, such as npx. Bare names are expanded by runtime discovery. Surrounding whitespace is ignored. Empty or whitespace-only selectors and relative paths with directory separators are invalid. Enforcement uses executable content hashes, so different paths with identical content share one runtime decision and block wins conflicts. - `ID string` - `CreatedAt Time` A Timestamp represents a point in time independent of any time zone or local calendar, encoded as a count of seconds and fractions of seconds at nanosecond resolution. The count is relative to an epoch at UTC midnight on January 1, 1970, in the proleptic Gregorian calendar which extends the Gregorian calendar backwards to year one. All minutes are 60 seconds long. Leap seconds are "smeared" so that no leap second table is needed for interpretation, using a [24-hour linear smear](https://developers.google.com/time/smear). The range is from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59.999999999Z. By restricting to that range, we ensure that we can convert to and from [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) date strings. # Examples Example 1: Compute Timestamp from POSIX `time()`. Timestamp timestamp; timestamp.set_seconds(time(NULL)); timestamp.set_nanos(0); Example 2: Compute Timestamp from POSIX `gettimeofday()`. struct timeval tv; gettimeofday(&tv, NULL); Timestamp timestamp; timestamp.set_seconds(tv.tv_sec); timestamp.set_nanos(tv.tv_usec * 1000); Example 3: Compute Timestamp from Win32 `GetSystemTimeAsFileTime()`. FILETIME ft; GetSystemTimeAsFileTime(&ft); UINT64 ticks = (((UINT64)ft.dwHighDateTime) << 32) | ft.dwLowDateTime; // A Windows tick is 100 nanoseconds. Windows epoch 1601-01-01T00:00:00Z // is 11644473600 seconds before Unix epoch 1970-01-01T00:00:00Z. Timestamp timestamp; timestamp.set_seconds((INT64) ((ticks / 10000000) - 11644473600LL)); timestamp.set_nanos((INT32) ((ticks % 10000000) * 100)); Example 4: Compute Timestamp from Java `System.currentTimeMillis()`. long millis = System.currentTimeMillis(); Timestamp timestamp = Timestamp.newBuilder().setSeconds(millis / 1000) .setNanos((int) ((millis % 1000) * 1000000)).build(); Example 5: Compute Timestamp from Java `Instant.now()`. Instant now = Instant.now(); Timestamp timestamp = Timestamp.newBuilder().setSeconds(now.getEpochSecond()) .setNanos(now.getNano()).build(); Example 6: Compute Timestamp from current time in Python. timestamp = Timestamp() timestamp.GetCurrentTime() # JSON Mapping In JSON format, the Timestamp type is encoded as a string in the [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) format. That is, the format is "{year}-{month}-{day}T{hour}:{min}:{sec}[.{frac_sec}]Z" where {year} is always expressed using four digits while {month}, {day}, {hour}, {min}, and {sec} are zero-padded to two digits each. The fractional seconds, which can go up to 9 digits (i.e. up to 1 nanosecond resolution), are optional. The "Z" suffix indicates the timezone ("UTC"); the timezone is required. A proto3 JSON serializer should always use UTC (as indicated by "Z") when printing the Timestamp type and a proto3 JSON parser should be able to accept both UTC and other timezones (as indicated by an offset). For example, "2017-01-15T01:30:15.01Z" encodes 15.01 seconds past 01:30 UTC on January 15, 2017. In JavaScript, one can convert a Date object to this format using the standard [toISOString()](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/toISOString) method. In Python, a standard `datetime.datetime` object can be converted to this format using [`strftime`](https://docs.python.org/2/library/time.html#time.strftime) with the time format spec '%Y-%m-%dT%H:%M:%S.%fZ'. Likewise, in Java, one can use the Joda Time's [`ISODateTimeFormat.dateTime()`](http://joda-time.sourceforge.net/apidocs/org/joda/time/format/ISODateTimeFormat.html#dateTime\(\)) to obtain a formatter capable of generating timestamps in this format. - `OrganizationID string` - `UpdatedAt Time` A Timestamp represents a point in time independent of any time zone or local calendar, encoded as a count of seconds and fractions of seconds at nanosecond resolution. The count is relative to an epoch at UTC midnight on January 1, 1970, in the proleptic Gregorian calendar which extends the Gregorian calendar backwards to year one. All minutes are 60 seconds long. Leap seconds are "smeared" so that no leap second table is needed for interpretation, using a [24-hour linear smear](https://developers.google.com/time/smear). The range is from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59.999999999Z. By restricting to that range, we ensure that we can convert to and from [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) date strings. # Examples Example 1: Compute Timestamp from POSIX `time()`. Timestamp timestamp; timestamp.set_seconds(time(NULL)); timestamp.set_nanos(0); Example 2: Compute Timestamp from POSIX `gettimeofday()`. struct timeval tv; gettimeofday(&tv, NULL); Timestamp timestamp; timestamp.set_seconds(tv.tv_sec); timestamp.set_nanos(tv.tv_usec * 1000); Example 3: Compute Timestamp from Win32 `GetSystemTimeAsFileTime()`. FILETIME ft; GetSystemTimeAsFileTime(&ft); UINT64 ticks = (((UINT64)ft.dwHighDateTime) << 32) | ft.dwLowDateTime; // A Windows tick is 100 nanoseconds. Windows epoch 1601-01-01T00:00:00Z // is 11644473600 seconds before Unix epoch 1970-01-01T00:00:00Z. Timestamp timestamp; timestamp.set_seconds((INT64) ((ticks / 10000000) - 11644473600LL)); timestamp.set_nanos((INT32) ((ticks % 10000000) * 100)); Example 4: Compute Timestamp from Java `System.currentTimeMillis()`. long millis = System.currentTimeMillis(); Timestamp timestamp = Timestamp.newBuilder().setSeconds(millis / 1000) .setNanos((int) ((millis % 1000) * 1000000)).build(); Example 5: Compute Timestamp from Java `Instant.now()`. Instant now = Instant.now(); Timestamp timestamp = Timestamp.newBuilder().setSeconds(now.getEpochSecond()) .setNanos(now.getNano()).build(); Example 6: Compute Timestamp from current time in Python. timestamp = Timestamp() timestamp.GetCurrentTime() # JSON Mapping In JSON format, the Timestamp type is encoded as a string in the [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) format. That is, the format is "{year}-{month}-{day}T{hour}:{min}:{sec}[.{frac_sec}]Z" where {year} is always expressed using four digits while {month}, {day}, {hour}, {min}, and {sec} are zero-padded to two digits each. The fractional seconds, which can go up to 9 digits (i.e. up to 1 nanosecond resolution), are optional. The "Z" suffix indicates the timezone ("UTC"); the timezone is required. A proto3 JSON serializer should always use UTC (as indicated by "Z") when printing the Timestamp type and a proto3 JSON parser should be able to accept both UTC and other timezones (as indicated by an offset). For example, "2017-01-15T01:30:15.01Z" encodes 15.01 seconds past 01:30 UTC on January 15, 2017. In JavaScript, one can convert a Date object to this format using the standard [toISOString()](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/toISOString) method. In Python, a standard `datetime.datetime` object can be converted to this format using [`strftime`](https://docs.python.org/2/library/time.html#time.strftime) with the time format spec '%Y-%m-%dT%H:%M:%S.%fZ'. Likewise, in Java, one can use the Joda Time's [`ISODateTimeFormat.dateTime()`](http://joda-time.sourceforge.net/apidocs/org/joda/time/format/ISODateTimeFormat.html#dateTime\(\)) to obtain a formatter capable of generating timestamps in this format. ### Example ```go package main import ( "context" "fmt" "github.com/gitpod-io/gitpod-sdk-go" "github.com/gitpod-io/gitpod-sdk-go/option" ) func main() { client := gitpod.NewClient( option.WithBearerToken("My Bearer Token"), ) securityPolicy, err := client.SecurityPolicies.Get(context.TODO(), gitpod.SecurityPolicyGetParams{ SecurityPolicyID: gitpod.F("d2c94c27-3b76-4a42-b88c-95a85e392c68"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", securityPolicy.SecurityPolicy) } ``` #### Response ```json { "securityPolicy": { "metadata": { "name": "x" }, "spec": { "blockDevices": { "defaultEffect": "EFFECT_UNSPECIFIED" }, "data": { "defaultEffect": "EFFECT_UNSPECIFIED", "rules": [ { "destination": { "host": "host" }, "effect": "EFFECT_UNSPECIFIED", "source": { "file": "file", "integration": "integration", "selector": "selector" } } ] }, "executables": { "defaultEffect": "EFFECT_UNSPECIFIED", "rules": [ { "effect": "EFFECT_UNSPECIFIED", "path": "path" } ] }, "files": { "defaultActions": [ "ACTION_UNSPECIFIED" ], "defaultEffect": "EFFECT_UNSPECIFIED", "rules": [ { "actions": [ "ACTION_UNSPECIFIED" ], "effect": "EFFECT_UNSPECIFIED", "path": "path" } ] }, "ports": { "maxAdmissionLevel": "ADMISSION_LEVEL_UNSPECIFIED" } }, "id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "createdAt": "2019-12-27T18:11:19.117Z", "organizationId": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "updatedAt": "2019-12-27T18:11:19.117Z" } } ``` ## UpdateSecurityPolicy `client.SecurityPolicies.Update(ctx, body) (*SecurityPolicyUpdateResponse, error)` **post** `/gitpod.v1.SecurityService/UpdateSecurityPolicy` Updates a security policy. Use this method to: - Rename a security policy - Change enforcement rules - Update auditing behavior ### Examples - Update security policy: Promotes one executable rule from audit to block while leaving unmatched executables allowed. Updating an assigned policy validates materializability; updating an unassigned policy only stores its spec. ```yaml securityPolicyId: "d2c94c27-3b76-4a42-b88c-95a85e392c68" spec: executables: defaultEffect: EFFECT_ALLOW rules: - path: "npx" effect: EFFECT_BLOCK - path: "/usr/bin/curl" effect: EFFECT_BLOCK ``` ### Parameters - `body SecurityPolicyUpdateParams` - `Metadata param.Field[SecurityPolicyUpdateParamsMetadata]` - `Name string` - `SecurityPolicyID param.Field[string]` - `Spec param.Field[SecurityPolicyUpdateParamsSpec]` Mandate/deploy security agents, e.g. CrowdStrike. Mandate credential security/proxy use. These can be modeled later as explicit fields if needed. - `Executables SecurityPolicyUpdateParamsSpecExecutables` executables is the public Veto Exec GA policy surface. - `DefaultEffect SecurityPolicyUpdateParamsSpecExecutablesDefaultEffect` default_effect controls executables that do not match a rule. For Veto Exec, omit this field or set it to EFFECT_ALLOW. EFFECT_UNSPECIFIED is normalized to EFFECT_ALLOW. - `const SecurityPolicyUpdateParamsSpecExecutablesDefaultEffectEffectUnspecified SecurityPolicyUpdateParamsSpecExecutablesDefaultEffect = "EFFECT_UNSPECIFIED"` - `const SecurityPolicyUpdateParamsSpecExecutablesDefaultEffectEffectAllow SecurityPolicyUpdateParamsSpecExecutablesDefaultEffect = "EFFECT_ALLOW"` - `const SecurityPolicyUpdateParamsSpecExecutablesDefaultEffectEffectBlock SecurityPolicyUpdateParamsSpecExecutablesDefaultEffect = "EFFECT_BLOCK"` - `const SecurityPolicyUpdateParamsSpecExecutablesDefaultEffectEffectAudit SecurityPolicyUpdateParamsSpecExecutablesDefaultEffect = "EFFECT_AUDIT"` - `Rules []SecurityPolicyUpdateParamsSpecExecutablesRule` rules contains executable-specific audit or block decisions. - `Effect SecurityPolicyUpdateParamsSpecExecutablesRulesEffect` effect must be EFFECT_AUDIT or EFFECT_BLOCK. EFFECT_ALLOW is not supported on an executable rule. - `const SecurityPolicyUpdateParamsSpecExecutablesRulesEffectEffectUnspecified SecurityPolicyUpdateParamsSpecExecutablesRulesEffect = "EFFECT_UNSPECIFIED"` - `const SecurityPolicyUpdateParamsSpecExecutablesRulesEffectEffectAllow SecurityPolicyUpdateParamsSpecExecutablesRulesEffect = "EFFECT_ALLOW"` - `const SecurityPolicyUpdateParamsSpecExecutablesRulesEffectEffectBlock SecurityPolicyUpdateParamsSpecExecutablesRulesEffect = "EFFECT_BLOCK"` - `const SecurityPolicyUpdateParamsSpecExecutablesRulesEffectEffectAudit SecurityPolicyUpdateParamsSpecExecutablesRulesEffect = "EFFECT_AUDIT"` - `Path string` path is either an absolute executable path, such as /usr/bin/curl, or a bare executable name, such as npx. Bare names are expanded by runtime discovery. Surrounding whitespace is ignored. Empty or whitespace-only selectors and relative paths with directory separators are invalid. Enforcement uses executable content hashes, so different paths with identical content share one runtime decision and block wins conflicts. ### Returns - `type SecurityPolicyUpdateResponse struct{…}` - `SecurityPolicy SecurityPolicy` - `Metadata SecurityPolicyMetadata` - `Name string` - `Spec SecurityPolicySpec` Mandate/deploy security agents, e.g. CrowdStrike. Mandate credential security/proxy use. These can be modeled later as explicit fields if needed. - `Executables SecurityPolicySpecExecutables` executables is the public Veto Exec GA policy surface. - `DefaultEffect SecurityPolicySpecExecutablesDefaultEffect` default_effect controls executables that do not match a rule. For Veto Exec, omit this field or set it to EFFECT_ALLOW. EFFECT_UNSPECIFIED is normalized to EFFECT_ALLOW. - `const SecurityPolicySpecExecutablesDefaultEffectEffectUnspecified SecurityPolicySpecExecutablesDefaultEffect = "EFFECT_UNSPECIFIED"` - `const SecurityPolicySpecExecutablesDefaultEffectEffectAllow SecurityPolicySpecExecutablesDefaultEffect = "EFFECT_ALLOW"` - `const SecurityPolicySpecExecutablesDefaultEffectEffectBlock SecurityPolicySpecExecutablesDefaultEffect = "EFFECT_BLOCK"` - `const SecurityPolicySpecExecutablesDefaultEffectEffectAudit SecurityPolicySpecExecutablesDefaultEffect = "EFFECT_AUDIT"` - `Rules []SecurityPolicySpecExecutablesRule` rules contains executable-specific audit or block decisions. - `Effect SecurityPolicySpecExecutablesRulesEffect` effect must be EFFECT_AUDIT or EFFECT_BLOCK. EFFECT_ALLOW is not supported on an executable rule. - `const SecurityPolicySpecExecutablesRulesEffectEffectUnspecified SecurityPolicySpecExecutablesRulesEffect = "EFFECT_UNSPECIFIED"` - `const SecurityPolicySpecExecutablesRulesEffectEffectAllow SecurityPolicySpecExecutablesRulesEffect = "EFFECT_ALLOW"` - `const SecurityPolicySpecExecutablesRulesEffectEffectBlock SecurityPolicySpecExecutablesRulesEffect = "EFFECT_BLOCK"` - `const SecurityPolicySpecExecutablesRulesEffectEffectAudit SecurityPolicySpecExecutablesRulesEffect = "EFFECT_AUDIT"` - `Path string` path is either an absolute executable path, such as /usr/bin/curl, or a bare executable name, such as npx. Bare names are expanded by runtime discovery. Surrounding whitespace is ignored. Empty or whitespace-only selectors and relative paths with directory separators are invalid. Enforcement uses executable content hashes, so different paths with identical content share one runtime decision and block wins conflicts. - `ID string` - `CreatedAt Time` A Timestamp represents a point in time independent of any time zone or local calendar, encoded as a count of seconds and fractions of seconds at nanosecond resolution. The count is relative to an epoch at UTC midnight on January 1, 1970, in the proleptic Gregorian calendar which extends the Gregorian calendar backwards to year one. All minutes are 60 seconds long. Leap seconds are "smeared" so that no leap second table is needed for interpretation, using a [24-hour linear smear](https://developers.google.com/time/smear). The range is from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59.999999999Z. By restricting to that range, we ensure that we can convert to and from [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) date strings. # Examples Example 1: Compute Timestamp from POSIX `time()`. Timestamp timestamp; timestamp.set_seconds(time(NULL)); timestamp.set_nanos(0); Example 2: Compute Timestamp from POSIX `gettimeofday()`. struct timeval tv; gettimeofday(&tv, NULL); Timestamp timestamp; timestamp.set_seconds(tv.tv_sec); timestamp.set_nanos(tv.tv_usec * 1000); Example 3: Compute Timestamp from Win32 `GetSystemTimeAsFileTime()`. FILETIME ft; GetSystemTimeAsFileTime(&ft); UINT64 ticks = (((UINT64)ft.dwHighDateTime) << 32) | ft.dwLowDateTime; // A Windows tick is 100 nanoseconds. Windows epoch 1601-01-01T00:00:00Z // is 11644473600 seconds before Unix epoch 1970-01-01T00:00:00Z. Timestamp timestamp; timestamp.set_seconds((INT64) ((ticks / 10000000) - 11644473600LL)); timestamp.set_nanos((INT32) ((ticks % 10000000) * 100)); Example 4: Compute Timestamp from Java `System.currentTimeMillis()`. long millis = System.currentTimeMillis(); Timestamp timestamp = Timestamp.newBuilder().setSeconds(millis / 1000) .setNanos((int) ((millis % 1000) * 1000000)).build(); Example 5: Compute Timestamp from Java `Instant.now()`. Instant now = Instant.now(); Timestamp timestamp = Timestamp.newBuilder().setSeconds(now.getEpochSecond()) .setNanos(now.getNano()).build(); Example 6: Compute Timestamp from current time in Python. timestamp = Timestamp() timestamp.GetCurrentTime() # JSON Mapping In JSON format, the Timestamp type is encoded as a string in the [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) format. That is, the format is "{year}-{month}-{day}T{hour}:{min}:{sec}[.{frac_sec}]Z" where {year} is always expressed using four digits while {month}, {day}, {hour}, {min}, and {sec} are zero-padded to two digits each. The fractional seconds, which can go up to 9 digits (i.e. up to 1 nanosecond resolution), are optional. The "Z" suffix indicates the timezone ("UTC"); the timezone is required. A proto3 JSON serializer should always use UTC (as indicated by "Z") when printing the Timestamp type and a proto3 JSON parser should be able to accept both UTC and other timezones (as indicated by an offset). For example, "2017-01-15T01:30:15.01Z" encodes 15.01 seconds past 01:30 UTC on January 15, 2017. In JavaScript, one can convert a Date object to this format using the standard [toISOString()](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/toISOString) method. In Python, a standard `datetime.datetime` object can be converted to this format using [`strftime`](https://docs.python.org/2/library/time.html#time.strftime) with the time format spec '%Y-%m-%dT%H:%M:%S.%fZ'. Likewise, in Java, one can use the Joda Time's [`ISODateTimeFormat.dateTime()`](http://joda-time.sourceforge.net/apidocs/org/joda/time/format/ISODateTimeFormat.html#dateTime\(\)) to obtain a formatter capable of generating timestamps in this format. - `OrganizationID string` - `UpdatedAt Time` A Timestamp represents a point in time independent of any time zone or local calendar, encoded as a count of seconds and fractions of seconds at nanosecond resolution. The count is relative to an epoch at UTC midnight on January 1, 1970, in the proleptic Gregorian calendar which extends the Gregorian calendar backwards to year one. All minutes are 60 seconds long. Leap seconds are "smeared" so that no leap second table is needed for interpretation, using a [24-hour linear smear](https://developers.google.com/time/smear). The range is from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59.999999999Z. By restricting to that range, we ensure that we can convert to and from [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) date strings. # Examples Example 1: Compute Timestamp from POSIX `time()`. Timestamp timestamp; timestamp.set_seconds(time(NULL)); timestamp.set_nanos(0); Example 2: Compute Timestamp from POSIX `gettimeofday()`. struct timeval tv; gettimeofday(&tv, NULL); Timestamp timestamp; timestamp.set_seconds(tv.tv_sec); timestamp.set_nanos(tv.tv_usec * 1000); Example 3: Compute Timestamp from Win32 `GetSystemTimeAsFileTime()`. FILETIME ft; GetSystemTimeAsFileTime(&ft); UINT64 ticks = (((UINT64)ft.dwHighDateTime) << 32) | ft.dwLowDateTime; // A Windows tick is 100 nanoseconds. Windows epoch 1601-01-01T00:00:00Z // is 11644473600 seconds before Unix epoch 1970-01-01T00:00:00Z. Timestamp timestamp; timestamp.set_seconds((INT64) ((ticks / 10000000) - 11644473600LL)); timestamp.set_nanos((INT32) ((ticks % 10000000) * 100)); Example 4: Compute Timestamp from Java `System.currentTimeMillis()`. long millis = System.currentTimeMillis(); Timestamp timestamp = Timestamp.newBuilder().setSeconds(millis / 1000) .setNanos((int) ((millis % 1000) * 1000000)).build(); Example 5: Compute Timestamp from Java `Instant.now()`. Instant now = Instant.now(); Timestamp timestamp = Timestamp.newBuilder().setSeconds(now.getEpochSecond()) .setNanos(now.getNano()).build(); Example 6: Compute Timestamp from current time in Python. timestamp = Timestamp() timestamp.GetCurrentTime() # JSON Mapping In JSON format, the Timestamp type is encoded as a string in the [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) format. That is, the format is "{year}-{month}-{day}T{hour}:{min}:{sec}[.{frac_sec}]Z" where {year} is always expressed using four digits while {month}, {day}, {hour}, {min}, and {sec} are zero-padded to two digits each. The fractional seconds, which can go up to 9 digits (i.e. up to 1 nanosecond resolution), are optional. The "Z" suffix indicates the timezone ("UTC"); the timezone is required. A proto3 JSON serializer should always use UTC (as indicated by "Z") when printing the Timestamp type and a proto3 JSON parser should be able to accept both UTC and other timezones (as indicated by an offset). For example, "2017-01-15T01:30:15.01Z" encodes 15.01 seconds past 01:30 UTC on January 15, 2017. In JavaScript, one can convert a Date object to this format using the standard [toISOString()](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/toISOString) method. In Python, a standard `datetime.datetime` object can be converted to this format using [`strftime`](https://docs.python.org/2/library/time.html#time.strftime) with the time format spec '%Y-%m-%dT%H:%M:%S.%fZ'. Likewise, in Java, one can use the Joda Time's [`ISODateTimeFormat.dateTime()`](http://joda-time.sourceforge.net/apidocs/org/joda/time/format/ISODateTimeFormat.html#dateTime\(\)) to obtain a formatter capable of generating timestamps in this format. ### Example ```go package main import ( "context" "fmt" "github.com/gitpod-io/gitpod-sdk-go" "github.com/gitpod-io/gitpod-sdk-go/option" ) func main() { client := gitpod.NewClient( option.WithBearerToken("My Bearer Token"), ) securityPolicy, err := client.SecurityPolicies.Update(context.TODO(), gitpod.SecurityPolicyUpdateParams{ SecurityPolicyID: gitpod.F("d2c94c27-3b76-4a42-b88c-95a85e392c68"), Spec: gitpod.F(gitpod.SecurityPolicyUpdateParamsSpec{ Executables: gitpod.F(gitpod.SecurityPolicyUpdateParamsSpecExecutables{ DefaultEffect: gitpod.F(gitpod.SecurityPolicyUpdateParamsSpecExecutablesDefaultEffectEffectAllow), Rules: gitpod.F([]gitpod.SecurityPolicyUpdateParamsSpecExecutablesRule{gitpod.SecurityPolicyUpdateParamsSpecExecutablesRule{ Effect: gitpod.F(gitpod.SecurityPolicyUpdateParamsSpecExecutablesRulesEffectEffectBlock), Path: gitpod.F("npx"), }, gitpod.SecurityPolicyUpdateParamsSpecExecutablesRule{ Effect: gitpod.F(gitpod.SecurityPolicyUpdateParamsSpecExecutablesRulesEffectEffectBlock), Path: gitpod.F("/usr/bin/curl"), }}), }), }), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", securityPolicy.SecurityPolicy) } ``` #### Response ```json { "securityPolicy": { "metadata": { "name": "x" }, "spec": { "blockDevices": { "defaultEffect": "EFFECT_UNSPECIFIED" }, "data": { "defaultEffect": "EFFECT_UNSPECIFIED", "rules": [ { "destination": { "host": "host" }, "effect": "EFFECT_UNSPECIFIED", "source": { "file": "file", "integration": "integration", "selector": "selector" } } ] }, "executables": { "defaultEffect": "EFFECT_UNSPECIFIED", "rules": [ { "effect": "EFFECT_UNSPECIFIED", "path": "path" } ] }, "files": { "defaultActions": [ "ACTION_UNSPECIFIED" ], "defaultEffect": "EFFECT_UNSPECIFIED", "rules": [ { "actions": [ "ACTION_UNSPECIFIED" ], "effect": "EFFECT_UNSPECIFIED", "path": "path" } ] }, "ports": { "maxAdmissionLevel": "ADMISSION_LEVEL_UNSPECIFIED" } }, "id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "createdAt": "2019-12-27T18:11:19.117Z", "organizationId": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "updatedAt": "2019-12-27T18:11:19.117Z" } } ``` ## Domain Types ### Security Policy - `type SecurityPolicy struct{…}` - `Metadata SecurityPolicyMetadata` - `Name string` - `Spec SecurityPolicySpec` Mandate/deploy security agents, e.g. CrowdStrike. Mandate credential security/proxy use. These can be modeled later as explicit fields if needed. - `Executables SecurityPolicySpecExecutables` executables is the public Veto Exec GA policy surface. - `DefaultEffect SecurityPolicySpecExecutablesDefaultEffect` default_effect controls executables that do not match a rule. For Veto Exec, omit this field or set it to EFFECT_ALLOW. EFFECT_UNSPECIFIED is normalized to EFFECT_ALLOW. - `const SecurityPolicySpecExecutablesDefaultEffectEffectUnspecified SecurityPolicySpecExecutablesDefaultEffect = "EFFECT_UNSPECIFIED"` - `const SecurityPolicySpecExecutablesDefaultEffectEffectAllow SecurityPolicySpecExecutablesDefaultEffect = "EFFECT_ALLOW"` - `const SecurityPolicySpecExecutablesDefaultEffectEffectBlock SecurityPolicySpecExecutablesDefaultEffect = "EFFECT_BLOCK"` - `const SecurityPolicySpecExecutablesDefaultEffectEffectAudit SecurityPolicySpecExecutablesDefaultEffect = "EFFECT_AUDIT"` - `Rules []SecurityPolicySpecExecutablesRule` rules contains executable-specific audit or block decisions. - `Effect SecurityPolicySpecExecutablesRulesEffect` effect must be EFFECT_AUDIT or EFFECT_BLOCK. EFFECT_ALLOW is not supported on an executable rule. - `const SecurityPolicySpecExecutablesRulesEffectEffectUnspecified SecurityPolicySpecExecutablesRulesEffect = "EFFECT_UNSPECIFIED"` - `const SecurityPolicySpecExecutablesRulesEffectEffectAllow SecurityPolicySpecExecutablesRulesEffect = "EFFECT_ALLOW"` - `const SecurityPolicySpecExecutablesRulesEffectEffectBlock SecurityPolicySpecExecutablesRulesEffect = "EFFECT_BLOCK"` - `const SecurityPolicySpecExecutablesRulesEffectEffectAudit SecurityPolicySpecExecutablesRulesEffect = "EFFECT_AUDIT"` - `Path string` path is either an absolute executable path, such as /usr/bin/curl, or a bare executable name, such as npx. Bare names are expanded by runtime discovery. Surrounding whitespace is ignored. Empty or whitespace-only selectors and relative paths with directory separators are invalid. Enforcement uses executable content hashes, so different paths with identical content share one runtime decision and block wins conflicts. - `ID string` - `CreatedAt Time` A Timestamp represents a point in time independent of any time zone or local calendar, encoded as a count of seconds and fractions of seconds at nanosecond resolution. The count is relative to an epoch at UTC midnight on January 1, 1970, in the proleptic Gregorian calendar which extends the Gregorian calendar backwards to year one. All minutes are 60 seconds long. Leap seconds are "smeared" so that no leap second table is needed for interpretation, using a [24-hour linear smear](https://developers.google.com/time/smear). The range is from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59.999999999Z. By restricting to that range, we ensure that we can convert to and from [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) date strings. # Examples Example 1: Compute Timestamp from POSIX `time()`. Timestamp timestamp; timestamp.set_seconds(time(NULL)); timestamp.set_nanos(0); Example 2: Compute Timestamp from POSIX `gettimeofday()`. struct timeval tv; gettimeofday(&tv, NULL); Timestamp timestamp; timestamp.set_seconds(tv.tv_sec); timestamp.set_nanos(tv.tv_usec * 1000); Example 3: Compute Timestamp from Win32 `GetSystemTimeAsFileTime()`. FILETIME ft; GetSystemTimeAsFileTime(&ft); UINT64 ticks = (((UINT64)ft.dwHighDateTime) << 32) | ft.dwLowDateTime; // A Windows tick is 100 nanoseconds. Windows epoch 1601-01-01T00:00:00Z // is 11644473600 seconds before Unix epoch 1970-01-01T00:00:00Z. Timestamp timestamp; timestamp.set_seconds((INT64) ((ticks / 10000000) - 11644473600LL)); timestamp.set_nanos((INT32) ((ticks % 10000000) * 100)); Example 4: Compute Timestamp from Java `System.currentTimeMillis()`. long millis = System.currentTimeMillis(); Timestamp timestamp = Timestamp.newBuilder().setSeconds(millis / 1000) .setNanos((int) ((millis % 1000) * 1000000)).build(); Example 5: Compute Timestamp from Java `Instant.now()`. Instant now = Instant.now(); Timestamp timestamp = Timestamp.newBuilder().setSeconds(now.getEpochSecond()) .setNanos(now.getNano()).build(); Example 6: Compute Timestamp from current time in Python. timestamp = Timestamp() timestamp.GetCurrentTime() # JSON Mapping In JSON format, the Timestamp type is encoded as a string in the [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) format. That is, the format is "{year}-{month}-{day}T{hour}:{min}:{sec}[.{frac_sec}]Z" where {year} is always expressed using four digits while {month}, {day}, {hour}, {min}, and {sec} are zero-padded to two digits each. The fractional seconds, which can go up to 9 digits (i.e. up to 1 nanosecond resolution), are optional. The "Z" suffix indicates the timezone ("UTC"); the timezone is required. A proto3 JSON serializer should always use UTC (as indicated by "Z") when printing the Timestamp type and a proto3 JSON parser should be able to accept both UTC and other timezones (as indicated by an offset). For example, "2017-01-15T01:30:15.01Z" encodes 15.01 seconds past 01:30 UTC on January 15, 2017. In JavaScript, one can convert a Date object to this format using the standard [toISOString()](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/toISOString) method. In Python, a standard `datetime.datetime` object can be converted to this format using [`strftime`](https://docs.python.org/2/library/time.html#time.strftime) with the time format spec '%Y-%m-%dT%H:%M:%S.%fZ'. Likewise, in Java, one can use the Joda Time's [`ISODateTimeFormat.dateTime()`](http://joda-time.sourceforge.net/apidocs/org/joda/time/format/ISODateTimeFormat.html#dateTime\(\)) to obtain a formatter capable of generating timestamps in this format. - `OrganizationID string` - `UpdatedAt Time` A Timestamp represents a point in time independent of any time zone or local calendar, encoded as a count of seconds and fractions of seconds at nanosecond resolution. The count is relative to an epoch at UTC midnight on January 1, 1970, in the proleptic Gregorian calendar which extends the Gregorian calendar backwards to year one. All minutes are 60 seconds long. Leap seconds are "smeared" so that no leap second table is needed for interpretation, using a [24-hour linear smear](https://developers.google.com/time/smear). The range is from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59.999999999Z. By restricting to that range, we ensure that we can convert to and from [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) date strings. # Examples Example 1: Compute Timestamp from POSIX `time()`. Timestamp timestamp; timestamp.set_seconds(time(NULL)); timestamp.set_nanos(0); Example 2: Compute Timestamp from POSIX `gettimeofday()`. struct timeval tv; gettimeofday(&tv, NULL); Timestamp timestamp; timestamp.set_seconds(tv.tv_sec); timestamp.set_nanos(tv.tv_usec * 1000); Example 3: Compute Timestamp from Win32 `GetSystemTimeAsFileTime()`. FILETIME ft; GetSystemTimeAsFileTime(&ft); UINT64 ticks = (((UINT64)ft.dwHighDateTime) << 32) | ft.dwLowDateTime; // A Windows tick is 100 nanoseconds. Windows epoch 1601-01-01T00:00:00Z // is 11644473600 seconds before Unix epoch 1970-01-01T00:00:00Z. Timestamp timestamp; timestamp.set_seconds((INT64) ((ticks / 10000000) - 11644473600LL)); timestamp.set_nanos((INT32) ((ticks % 10000000) * 100)); Example 4: Compute Timestamp from Java `System.currentTimeMillis()`. long millis = System.currentTimeMillis(); Timestamp timestamp = Timestamp.newBuilder().setSeconds(millis / 1000) .setNanos((int) ((millis % 1000) * 1000000)).build(); Example 5: Compute Timestamp from Java `Instant.now()`. Instant now = Instant.now(); Timestamp timestamp = Timestamp.newBuilder().setSeconds(now.getEpochSecond()) .setNanos(now.getNano()).build(); Example 6: Compute Timestamp from current time in Python. timestamp = Timestamp() timestamp.GetCurrentTime() # JSON Mapping In JSON format, the Timestamp type is encoded as a string in the [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) format. That is, the format is "{year}-{month}-{day}T{hour}:{min}:{sec}[.{frac_sec}]Z" where {year} is always expressed using four digits while {month}, {day}, {hour}, {min}, and {sec} are zero-padded to two digits each. The fractional seconds, which can go up to 9 digits (i.e. up to 1 nanosecond resolution), are optional. The "Z" suffix indicates the timezone ("UTC"); the timezone is required. A proto3 JSON serializer should always use UTC (as indicated by "Z") when printing the Timestamp type and a proto3 JSON parser should be able to accept both UTC and other timezones (as indicated by an offset). For example, "2017-01-15T01:30:15.01Z" encodes 15.01 seconds past 01:30 UTC on January 15, 2017. In JavaScript, one can convert a Date object to this format using the standard [toISOString()](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/toISOString) method. In Python, a standard `datetime.datetime` object can be converted to this format using [`strftime`](https://docs.python.org/2/library/time.html#time.strftime) with the time format spec '%Y-%m-%dT%H:%M:%S.%fZ'. Likewise, in Java, one can use the Joda Time's [`ISODateTimeFormat.dateTime()`](http://joda-time.sourceforge.net/apidocs/org/joda/time/format/ISODateTimeFormat.html#dateTime\(\)) to obtain a formatter capable of generating timestamps in this format.