Machine identities

Service principals, API keys and credential inventory. 11 operations

Expand an endpoint for authentication, parameters, request fields and responses.

GET/api/v1/realms/{realm}/service-principals+

List service principals

AuthenticationadminTokenTrust classadministrativePermissionsrealm.service_principals.read

Parameters

Name	Location	Required	Details
`realm`	path	Yes	Realm name (path-based issuer). Unknown realms return 404. `{"type":"string"}`
`X-Request-Id`	header	—	Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id. `{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}`
`cursor`	query	—	Opaque cursor from a previous page (next_cursor). Cursors are HMAC-bound to the realm and listing. `{"type":"string"}`
`limit`	query	—	Page size; defaults to limits.default_page_size and is capped at limits.max_page_size. `{"type":"integer","minimum":1}`
`limit`	query	—	Page size; defaults to limits.default_page_size and is capped at limits.max_page_size. `{"type":"integer","minimum":1}`

Responses

200 OK

application/json

Field	Type	Required	Description
`items`	array	Yes
`next_cursor`	string	—	Opaque cursor for the next page; empty on the last page (API-004).

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "WWW-Authenticate": {
    "$ref": "#/components/headers/WWW-Authenticate"
  }
}

403 Authenticated but not allowed (code forbidden, mfa_required, step_up_required, recent_authentication_required, grant_ceiling_exceeded, impersonation_restricted, account_unavailable, sso_required, recovery_restricted). Step-up problems carry obligations.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

500 Unexpected error (code internal_error); no stack traces or secrets.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

503 Load shedding, realm unavailable or dependency failure (code unavailable, upstream_unavailable). May include Retry-After.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "Retry-After": {
    "$ref": "#/components/headers/Retry-After"
  }
}

Operation listServicePrincipals · Schema definitions · OpenAPI contract

POST/api/v1/realms/{realm}/service-principals+

Create a service principal

AuthenticationadminTokenTrust classadministrativePermissionsrealm.service_principals.write

Parameters

Name	Location	Required	Details
`realm`	path	Yes	Realm name (path-based issuer). Unknown realms return 404. `{"type":"string"}`
`X-Request-Id`	header	—	Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id. `{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}`
`Idempotency-Key`	header	—	Actor/realm/route-bound idempotency key (API-005) for POST requests, at most 255 characters (422 otherwise), kept for 24 hours; only a digest of the key is stored. The request is identified by its method, exact path and body: a replay with the same path and body returns the stored status and response with Idempotent-Replayed: true; the same key with a different body or another path on the same route (another resource) returns 422 idempotency_key_reused; a request still in progress returns 409. Only successful responses are recorded: when the original request failed (an error or a status of 400 or above) the key is released and a retry runs again. Responses containing one-time secrets (members such as client_secret, token, api_key, access_token, refresh_token, id_token, recovery_codes, secret or webhook_secrets) are never stored or replayed (409 with original_status). `{"type":"string","maxLength":255}`

Request body

application/json · required

Field	Type	Required	Description
`allowed_organization_ids`	array,null	—
`description`	string	—
`is_agent`	boolean	—	An autonomous agent (MCH-017): needs an accountable human owner (owner_user_id; 422 otherwise), privileged roles reach it only through two-party approval, and its tokens carry agent=true (and act.agent=true when it acts for a person). Agents pass through ordinary authorization like any service.
`name`	string	Yes
`owner_organization_id`	string	—
`owner_user_id`	string	—

Complete request schema

{
  "additionalProperties": false,
  "properties": {
    "allowed_organization_ids": {
      "items": {
        "type": "string"
      },
      "type": [
        "array",
        "null"
      ]
    },
    "description": {
      "type": "string"
    },
    "is_agent": {
      "type": "boolean",
      "description": "An autonomous agent (MCH-017): needs an accountable human owner (owner_user_id; 422 otherwise), privileged roles reach it only through two-party approval, and its tokens carry agent=true (and act.agent=true when it acts for a person). Agents pass through ordinary authorization like any service."
    },
    "name": {
      "type": "string",
      "maxLength": 200
    },
    "owner_organization_id": {
      "type": "string"
    },
    "owner_user_id": {
      "type": "string"
    }
  },
  "type": "object",
  "required": [
    "name"
  ]
}

Responses

201 Created

application/json

Field	Type	Required	Description
`allowed_organization_ids`	array,null	Yes
`created_at`	string	Yes
`description`	string	—
`id`	string	Yes
`is_agent`	boolean	Yes	An autonomous agent (MCH-017): needs an accountable human owner (owner_user_id; 422 otherwise), privileged roles reach it only through two-party approval, and its tokens carry agent=true (and act.agent=true when it acts for a person). Agents pass through ordinary authorization like any service.
`name`	string	Yes
`owner_organization_id`	string	—
`owner_user_id`	string	—
`permission_revision`	integer	Yes
`state`	string	Yes	`active \| disabled \| deleted`
`version`	integer	Yes

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "Idempotent-Replayed": {
    "$ref": "#/components/headers/Idempotent-Replayed"
  }
}

400 Malformed request, invalid JSON (duplicate members, unknown fields, wrong types), invalid cursor or invalid transaction (code invalid_request, transaction_invalid, invalid_proof, invitation_invalid).

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "WWW-Authenticate": {
    "$ref": "#/components/headers/WWW-Authenticate"
  }
}

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

409 Conflicts with current state, or an idempotent request with the same key is still in progress / carried a one-time secret (code conflict, unexpected_step, last_owner, last_sign_in_method).

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

413 Body exceeds limits.max_body_bytes (code payload_too_large).

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

415 Wrong Content-Type (code unsupported_media_type).

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

422 Validation failed (code validation_failed, password_policy, idempotency_key_reused); errors maps fields to messages.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

500 Unexpected error (code internal_error); no stack traces or secrets.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

503 Load shedding, realm unavailable or dependency failure (code unavailable, upstream_unavailable). May include Retry-After.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "Retry-After": {
    "$ref": "#/components/headers/Retry-After"
  }
}

Operation createServicePrincipal · Schema definitions · OpenAPI contract

GET/api/v1/realms/{realm}/service-principals/{id}+

Get a service principal

AuthenticationadminTokenTrust classadministrativePermissionsrealm.service_principals.read

Parameters

Name	Location	Required	Details
`realm`	path	Yes	Realm name (path-based issuer). Unknown realms return 404. `{"type":"string"}`
`id`	path	Yes	Resource identifier. `{"type":"string"}`
`X-Request-Id`	header	—	Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id. `{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}`

Responses

200 OK

application/json

Field	Type	Required	Description
`allowed_organization_ids`	array,null	Yes
`created_at`	string	Yes
`description`	string	—
`id`	string	Yes
`is_agent`	boolean	Yes	An autonomous agent (MCH-017): needs an accountable human owner (owner_user_id; 422 otherwise), privileged roles reach it only through two-party approval, and its tokens carry agent=true (and act.agent=true when it acts for a person). Agents pass through ordinary authorization like any service.
`name`	string	Yes
`owner_organization_id`	string	—
`owner_user_id`	string	—
`permission_revision`	integer	Yes
`state`	string	Yes	`active \| disabled \| deleted`
`version`	integer	Yes

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "ETag": {
    "$ref": "#/components/headers/ETag"
  }
}

401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "WWW-Authenticate": {
    "$ref": "#/components/headers/WWW-Authenticate"
  }
}

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

500 Unexpected error (code internal_error); no stack traces or secrets.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

503 Load shedding, realm unavailable or dependency failure (code unavailable, upstream_unavailable). May include Retry-After.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "Retry-After": {
    "$ref": "#/components/headers/Retry-After"
  }
}

Operation getServicePrincipal · Schema definitions · OpenAPI contract

PATCH/api/v1/realms/{realm}/service-principals/{id}+

Update a service principal

AuthenticationadminTokenTrust classadministrativePermissionsrealm.service_principals.write

Parameters

Name	Location	Required	Details
`realm`	path	Yes	Realm name (path-based issuer). Unknown realms return 404. `{"type":"string"}`
`id`	path	Yes	Resource identifier. `{"type":"string"}`
`X-Request-Id`	header	—	Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id. `{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}`
`If-Match`	header	—	Expected resource version from the ETag (W/"v12" or "v12"). Stale versions return 412. `{"type":"string","examples":["W/\"v12\""]}`

Request body

application/json · required

Field	Type	Required	Description
`allowed_organization_ids`	array,null	—
`description`	string	—
`is_agent`	boolean	—	An autonomous agent (MCH-017): needs an accountable human owner (owner_user_id; 422 otherwise), privileged roles reach it only through two-party approval, and its tokens carry agent=true (and act.agent=true when it acts for a person). Agents pass through ordinary authorization like any service.
`name`	string	Yes
`owner_organization_id`	string	—
`owner_user_id`	string	—

Complete request schema

{
  "additionalProperties": false,
  "properties": {
    "allowed_organization_ids": {
      "items": {
        "type": "string"
      },
      "type": [
        "array",
        "null"
      ]
    },
    "description": {
      "type": "string"
    },
    "is_agent": {
      "type": "boolean",
      "description": "An autonomous agent (MCH-017): needs an accountable human owner (owner_user_id; 422 otherwise), privileged roles reach it only through two-party approval, and its tokens carry agent=true (and act.agent=true when it acts for a person). Agents pass through ordinary authorization like any service."
    },
    "name": {
      "type": "string",
      "maxLength": 200
    },
    "owner_organization_id": {
      "type": "string"
    },
    "owner_user_id": {
      "type": "string"
    }
  },
  "type": "object",
  "required": [
    "name"
  ]
}

Responses

200 OK

application/json

Field	Type	Required	Description
`allowed_organization_ids`	array,null	Yes
`created_at`	string	Yes
`description`	string	—
`id`	string	Yes
`is_agent`	boolean	Yes	An autonomous agent (MCH-017): needs an accountable human owner (owner_user_id; 422 otherwise), privileged roles reach it only through two-party approval, and its tokens carry agent=true (and act.agent=true when it acts for a person). Agents pass through ordinary authorization like any service.
`name`	string	Yes
`owner_organization_id`	string	—
`owner_user_id`	string	—
`permission_revision`	integer	Yes
`state`	string	Yes	`active \| disabled \| deleted`
`version`	integer	Yes

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "WWW-Authenticate": {
    "$ref": "#/components/headers/WWW-Authenticate"
  }
}

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

409 Conflicts with current state, or an idempotent request with the same key is still in progress / carried a one-time secret (code conflict, unexpected_step, last_owner, last_sign_in_method).

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

412 If-Match does not match the current version (code precondition_failed).

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

413 Body exceeds limits.max_body_bytes (code payload_too_large).

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

415 Wrong Content-Type (code unsupported_media_type).

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

422 Validation failed (code validation_failed, password_policy, idempotency_key_reused); errors maps fields to messages.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

500 Unexpected error (code internal_error); no stack traces or secrets.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

503 Load shedding, realm unavailable or dependency failure (code unavailable, upstream_unavailable). May include Retry-After.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "Retry-After": {
    "$ref": "#/components/headers/Retry-After"
  }
}

Operation updateServicePrincipal · Schema definitions · OpenAPI contract

DELETE/api/v1/realms/{realm}/service-principals/{id}+

Delete a service principal

AuthenticationadminTokenTrust classadministrativePermissionsrealm.service_principals.write

Parameters

Name	Location	Required	Details
`realm`	path	Yes	Realm name (path-based issuer). Unknown realms return 404. `{"type":"string"}`
`id`	path	Yes	Resource identifier. `{"type":"string"}`
`X-Request-Id`	header	—	Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id. `{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}`

Responses

204 No Content

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "WWW-Authenticate": {
    "$ref": "#/components/headers/WWW-Authenticate"
  }
}

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

409 Conflicts with current state, or an idempotent request with the same key is still in progress / carried a one-time secret (code conflict, unexpected_step, last_owner, last_sign_in_method).

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

500 Unexpected error (code internal_error); no stack traces or secrets.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

503 Load shedding, realm unavailable or dependency failure (code unavailable, upstream_unavailable). May include Retry-After.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "Retry-After": {
    "$ref": "#/components/headers/Retry-After"
  }
}

Operation deleteServicePrincipal · Schema definitions · OpenAPI contract

POST/api/v1/realms/{realm}/service-principals/{id}/disable+

Disable a service principal

Any request body is ignored.

AuthenticationadminTokenTrust classadministrativePermissionsrealm.service_principals.write

Parameters

Name	Location	Required	Details
`realm`	path	Yes	Realm name (path-based issuer). Unknown realms return 404. `{"type":"string"}`
`id`	path	Yes	Resource identifier. `{"type":"string"}`
`X-Request-Id`	header	—	Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id. `{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}`
`Idempotency-Key`	header	—	Actor/realm/route-bound idempotency key (API-005) for POST requests, at most 255 characters (422 otherwise), kept for 24 hours; only a digest of the key is stored. The request is identified by its method, exact path and body: a replay with the same path and body returns the stored status and response with Idempotent-Replayed: true; the same key with a different body or another path on the same route (another resource) returns 422 idempotency_key_reused; a request still in progress returns 409. Only successful responses are recorded: when the original request failed (an error or a status of 400 or above) the key is released and a retry runs again. Responses containing one-time secrets (members such as client_secret, token, api_key, access_token, refresh_token, id_token, recovery_codes, secret or webhook_secrets) are never stored or replayed (409 with original_status). `{"type":"string","maxLength":255}`

Responses

204 No Content

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "Idempotent-Replayed": {
    "$ref": "#/components/headers/Idempotent-Replayed"
  }
}

401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "WWW-Authenticate": {
    "$ref": "#/components/headers/WWW-Authenticate"
  }
}

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

409 Conflicts with current state, or an idempotent request with the same key is still in progress / carried a one-time secret (code conflict, unexpected_step, last_owner, last_sign_in_method).

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

422 Validation failed (code validation_failed, password_policy, idempotency_key_reused); errors maps fields to messages.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

500 Unexpected error (code internal_error); no stack traces or secrets.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

503 Load shedding, realm unavailable or dependency failure (code unavailable, upstream_unavailable). May include Retry-After.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "Retry-After": {
    "$ref": "#/components/headers/Retry-After"
  }
}

Operation disableServicePrincipal · Schema definitions · OpenAPI contract

POST/api/v1/realms/{realm}/service-principals/{id}/enable+

Enable a service principal

Any request body is ignored.

AuthenticationadminTokenTrust classadministrativePermissionsrealm.service_principals.write

Parameters

Name	Location	Required	Details
`realm`	path	Yes	Realm name (path-based issuer). Unknown realms return 404. `{"type":"string"}`
`id`	path	Yes	Resource identifier. `{"type":"string"}`
`X-Request-Id`	header	—	Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id. `{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}`
`Idempotency-Key`	header	—	Actor/realm/route-bound idempotency key (API-005) for POST requests, at most 255 characters (422 otherwise), kept for 24 hours; only a digest of the key is stored. The request is identified by its method, exact path and body: a replay with the same path and body returns the stored status and response with Idempotent-Replayed: true; the same key with a different body or another path on the same route (another resource) returns 422 idempotency_key_reused; a request still in progress returns 409. Only successful responses are recorded: when the original request failed (an error or a status of 400 or above) the key is released and a retry runs again. Responses containing one-time secrets (members such as client_secret, token, api_key, access_token, refresh_token, id_token, recovery_codes, secret or webhook_secrets) are never stored or replayed (409 with original_status). `{"type":"string","maxLength":255}`

Responses

204 No Content

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "Idempotent-Replayed": {
    "$ref": "#/components/headers/Idempotent-Replayed"
  }
}

401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "WWW-Authenticate": {
    "$ref": "#/components/headers/WWW-Authenticate"
  }
}

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

409 Conflicts with current state, or an idempotent request with the same key is still in progress / carried a one-time secret (code conflict, unexpected_step, last_owner, last_sign_in_method).

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

422 Validation failed (code validation_failed, password_policy, idempotency_key_reused); errors maps fields to messages.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

500 Unexpected error (code internal_error); no stack traces or secrets.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

503 Load shedding, realm unavailable or dependency failure (code unavailable, upstream_unavailable). May include Retry-After.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "Retry-After": {
    "$ref": "#/components/headers/Retry-After"
  }
}

Operation enableServicePrincipal · Schema definitions · OpenAPI contract

GET/api/v1/realms/{realm}/api-keys+

List API keys and personal tokens

AuthenticationadminTokenTrust classadministrativePermissionsrealm.api_keys.manage

Parameters

Name	Location	Required	Details
`realm`	path	Yes	Realm name (path-based issuer). Unknown realms return 404. `{"type":"string"}`
`X-Request-Id`	header	—	Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id. `{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}`
`cursor`	query	—	Opaque cursor from a previous page (next_cursor). Cursors are HMAC-bound to the realm and listing. `{"type":"string"}`
`limit`	query	—	Page size; defaults to limits.default_page_size and is capped at limits.max_page_size. `{"type":"integer","minimum":1}`
`owner_type`	query	—	service_principal or user. `{"type":"string"}`
`owner_id`	query	—	Owner identifier. `{"type":"string"}`

Responses

200 OK

application/json

Field	Type	Required	Description
`items`	array	Yes
`next_cursor`	string	—	Opaque cursor for the next page; empty on the last page (API-004).

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "WWW-Authenticate": {
    "$ref": "#/components/headers/WWW-Authenticate"
  }
}

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

500 Unexpected error (code internal_error); no stack traces or secrets.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

503 Load shedding, realm unavailable or dependency failure (code unavailable, upstream_unavailable). May include Retry-After.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "Retry-After": {
    "$ref": "#/components/headers/Retry-After"
  }
}

Operation listAPIKeys · Schema definitions · OpenAPI contract

POST/api/v1/realms/{realm}/api-keys+

Create an API key for a service principal

AuthenticationadminTokenTrust classadministrativePermissionsrealm.api_keys.manage

Parameters

Name	Location	Required	Details
`realm`	path	Yes	Realm name (path-based issuer). Unknown realms return 404. `{"type":"string"}`
`X-Request-Id`	header	—	Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id. `{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}`
`Idempotency-Key`	header	—	Actor/realm/route-bound idempotency key (API-005) for POST requests, at most 255 characters (422 otherwise), kept for 24 hours; only a digest of the key is stored. The request is identified by its method, exact path and body: a replay with the same path and body returns the stored status and response with Idempotent-Replayed: true; the same key with a different body or another path on the same route (another resource) returns 422 idempotency_key_reused; a request still in progress returns 409. Only successful responses are recorded: when the original request failed (an error or a status of 400 or above) the key is released and a retry runs again. Responses containing one-time secrets (members such as client_secret, token, api_key, access_token, refresh_token, id_token, recovery_codes, secret or webhook_secrets) are never stored or replayed (409 with original_status). `{"type":"string","maxLength":255}`

Request body

application/json · required

Field	Type	Required	Description
`audience`	string	Yes
`name`	string	Yes
`organization_id`	string	—
`scopes`	array,null	Yes
`ttl_days`	integer	—	Expiry is mandatory; at most 365 days.
`service_principal_id`	string	Yes

Complete request schema

{
  "additionalProperties": false,
  "properties": {
    "audience": {
      "type": "string"
    },
    "name": {
      "type": "string"
    },
    "organization_id": {
      "type": "string"
    },
    "scopes": {
      "items": {
        "type": "string"
      },
      "type": [
        "array",
        "null"
      ]
    },
    "ttl_days": {
      "type": "integer",
      "maximum": 365,
      "description": "Expiry is mandatory; at most 365 days."
    },
    "service_principal_id": {
      "type": "string"
    }
  },
  "type": "object",
  "required": [
    "audience",
    "name",
    "scopes",
    "service_principal_id"
  ]
}

Responses

201 Created

application/json

Field	Type	Required	Description
`api_key`one-time secret	string	Yes	API key (pa_key_ prefix). Returned exactly once; it is never stored in plaintext, never shown again and never replayed from the idempotency store.
`credential`	MachineCredential	Yes
`notice`	string	Yes

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "Idempotent-Replayed": {
    "$ref": "#/components/headers/Idempotent-Replayed"
  }
}

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "WWW-Authenticate": {
    "$ref": "#/components/headers/WWW-Authenticate"
  }
}

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

409 Conflicts with current state, or an idempotent request with the same key is still in progress / carried a one-time secret (code conflict, unexpected_step, last_owner, last_sign_in_method).

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

413 Body exceeds limits.max_body_bytes (code payload_too_large).

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

415 Wrong Content-Type (code unsupported_media_type).

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

422 Validation failed (code validation_failed, password_policy, idempotency_key_reused); errors maps fields to messages.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

500 Unexpected error (code internal_error); no stack traces or secrets.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

503 Load shedding, realm unavailable or dependency failure (code unavailable, upstream_unavailable). May include Retry-After.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "Retry-After": {
    "$ref": "#/components/headers/Retry-After"
  }
}

Operation createAPIKey · Schema definitions · OpenAPI contract

DELETE/api/v1/realms/{realm}/api-keys/{id}+

Revoke an API key or personal token

AuthenticationadminTokenTrust classadministrativePermissionsrealm.api_keys.manage

Parameters

Name	Location	Required	Details
`realm`	path	Yes	Realm name (path-based issuer). Unknown realms return 404. `{"type":"string"}`
`id`	path	Yes	Resource identifier. `{"type":"string"}`
`X-Request-Id`	header	—	Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id. `{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}`

Responses

204 No Content

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "WWW-Authenticate": {
    "$ref": "#/components/headers/WWW-Authenticate"
  }
}

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

409 Conflicts with current state, or an idempotent request with the same key is still in progress / carried a one-time secret (code conflict, unexpected_step, last_owner, last_sign_in_method).

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

500 Unexpected error (code internal_error); no stack traces or secrets.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

503 Load shedding, realm unavailable or dependency failure (code unavailable, upstream_unavailable). May include Retry-After.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "Retry-After": {
    "$ref": "#/components/headers/Retry-After"
  }
}

Operation revokeAPIKey · Schema definitions · OpenAPI contract

GET/api/v1/realms/{realm}/credential-inventory+

Credential inventory with hygiene flags

Flags credentials expiring within 14 days or unused for 60 days.

AuthenticationadminTokenTrust classadministrativePermissionsrealm.credentials.inventory

Parameters

Name	Location	Required	Details
`realm`	path	Yes	Realm name (path-based issuer). Unknown realms return 404. `{"type":"string"}`
`X-Request-Id`	header	—	Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id. `{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}`
`cursor`	query	—	Opaque cursor from a previous page (next_cursor). Cursors are HMAC-bound to the realm and listing. `{"type":"string"}`
`limit`	query	—	Page size; defaults to limits.default_page_size and is capped at limits.max_page_size. `{"type":"integer","minimum":1}`

Responses

200 OK

application/json

Field	Type	Required	Description
`items`	array	Yes
`next_cursor`	string	—	Opaque cursor for the next page; empty on the last page (API-004).

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "WWW-Authenticate": {
    "$ref": "#/components/headers/WWW-Authenticate"
  }
}

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

500 Unexpected error (code internal_error); no stack traces or secrets.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

503 Load shedding, realm unavailable or dependency failure (code unavailable, upstream_unavailable). May include Retry-After.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "Retry-After": {
    "$ref": "#/components/headers/Retry-After"
  }
}

Operation getCredentialInventory · Schema definitions · OpenAPI contract