Schema definitions
Complete component schemas from the API contract.
Search field names with your browser's Find command. Referenced types link within the downloadable contract.
AdminUser
{
"type": "object",
"description": "Administrative user view.",
"properties": {
"id": {
"type": "string"
},
"state": {
"type": "string",
"enum": [
"pending_verification",
"active",
"suspended",
"locked",
"recovery_restricted",
"pending_deletion",
"deleted"
]
},
"display_name": {
"type": "string"
},
"given_name": {
"type": "string"
},
"family_name": {
"type": "string"
},
"locale": {
"type": "string"
},
"zoneinfo": {
"type": "string"
},
"profile": {
"type": [
"object",
"null"
],
"additionalProperties": true
},
"identifiers": {
"type": "array",
"items": {
"$ref": "#/components/schemas/UserIdentifier"
}
},
"required_actions": {
"type": [
"array",
"null"
],
"items": {
"type": "string",
"enum": [
"update_password",
"verify_email",
"configure_totp",
"accept_terms",
"complete_profile",
"verify_contact"
]
}
},
"created_at": {
"type": "string",
"format": "date-time"
},
"updated_at": {
"type": "string",
"format": "date-time"
},
"version": {
"type": "integer",
"format": "int64"
},
"deletion_scheduled_at": {
"type": [
"string",
"null"
],
"format": "date-time"
},
"admin_metadata": {
"type": [
"object",
"null"
],
"additionalProperties": true
},
"protected": {
"type": "boolean"
},
"authz_revision": {
"type": "integer",
"format": "int64"
},
"last_login_at": {
"type": [
"string",
"null"
],
"format": "date-time"
},
"created_via": {
"type": "string"
},
"locked_until": {
"type": [
"string",
"null"
],
"format": "date-time"
}
},
"required": [
"id",
"state",
"display_name",
"given_name",
"family_name",
"locale",
"zoneinfo",
"profile",
"identifiers",
"required_actions",
"created_at",
"updated_at",
"version",
"deletion_scheduled_at",
"admin_metadata",
"protected",
"authz_revision",
"last_login_at",
"created_via",
"locked_until"
]
}AdminUserPatch
{
"additionalProperties": false,
"properties": {
"admin_metadata": {
"additionalProperties": {},
"type": [
"object",
"null"
]
},
"display_name": {
"type": [
"string",
"null"
]
},
"family_name": {
"type": [
"string",
"null"
]
},
"given_name": {
"type": [
"string",
"null"
]
},
"locale": {
"type": [
"string",
"null"
]
},
"profile": {
"additionalProperties": {},
"type": [
"object",
"null"
]
},
"zoneinfo": {
"type": [
"string",
"null"
]
}
},
"type": "object"
}ApplicationImpersonationPolicy
{
"additionalProperties": false,
"properties": {
"allowed_scopes": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"contract_validated_at": {
"type": "string"
},
"contract_version": {
"type": "string"
},
"support_client_ids": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"write_scopes": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"write_actions": {
"description": "Reviewed state-changing actions an allowlisted_write support token may perform through the decision API (IMP-011).",
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
}
},
"type": "object"
}ApplicationScope
{
"additionalProperties": false,
"properties": {
"consent_text": {
"type": "string"
},
"description": {
"type": "string"
},
"id": {
"type": "string"
},
"is_default": {
"type": "boolean",
"description": "Granted by default (APP-007) when a request names the scope's resource but none of its scopes, subject to the checks of a requested scope; see ScopeInput.is_default. Has no effect on protocol (oidc) scopes."
},
"kind": {
"type": "string"
},
"name": {
"type": "string"
},
"resource_id": {
"type": "string"
},
"sensitivity": {
"type": "string"
}
},
"required": [
"id",
"is_default",
"kind",
"name",
"sensitivity"
],
"type": "object"
}ApplicationTokenPolicy
{
"additionalProperties": false,
"properties": {
"access_token_ttl_seconds": {
"type": "integer"
},
"refresh_absolute_seconds": {
"type": "integer"
},
"refresh_idle_seconds": {
"type": "integer"
},
"require_dpop": {
"type": "boolean"
},
"require_mfa": {
"type": "boolean"
},
"require_par": {
"type": "boolean"
},
"max_session_age_seconds": {
"type": "integer",
"minimum": 0,
"maximum": 7776000,
"description": "Re-authenticate users whose SSO session is older than this (SES-002)."
}
},
"type": "object"
}AuditEvent
{
"additionalProperties": false,
"properties": {
"actor": {
"$ref": "#/components/schemas/AuditRef"
},
"batch_id": {
"type": "string"
},
"category": {
"type": "string"
},
"client_id": {
"type": "string"
},
"content_hash": {
"type": "string"
},
"grant_id": {
"type": "string"
},
"id": {
"type": "string"
},
"impersonation_grant_id": {
"type": "string"
},
"ip_context": {
"type": "string"
},
"metadata": {
"additionalProperties": {},
"type": [
"object",
"null"
]
},
"occurred_at": {
"format": "date-time",
"type": "string"
},
"org_id": {
"type": "string"
},
"outcome": {
"type": "string"
},
"realm_id": {
"type": "string"
},
"reason_code": {
"type": "string"
},
"reporting_service": {
"type": "string"
},
"request_id": {
"type": "string"
},
"schema_version": {
"type": "integer"
},
"session_id": {
"type": "string"
},
"source": {
"type": "string"
},
"subject": {
"oneOf": [
{
"$ref": "#/components/schemas/AuditRef"
},
{
"type": "null"
}
]
},
"target": {
"oneOf": [
{
"$ref": "#/components/schemas/AuditRef"
},
{
"type": "null"
}
]
},
"type": {
"type": "string"
}
},
"required": [
"actor",
"id",
"occurred_at",
"outcome",
"schema_version",
"source",
"type"
],
"type": "object"
}AuditRef
{
"additionalProperties": false,
"properties": {
"id": {
"type": "string"
},
"session_id": {
"type": "string"
},
"type": {
"type": "string"
}
},
"required": [
"id",
"type"
],
"type": "object"
}AuditVerificationReport
{
"additionalProperties": false,
"properties": {
"batches_checked": {
"type": "integer"
},
"events_checked": {
"type": "integer"
},
"ok": {
"type": "boolean"
},
"problems": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"unsealed_events": {
"type": "integer"
}
},
"required": [
"batches_checked",
"events_checked",
"ok",
"problems",
"unsealed_events"
],
"type": "object"
}AuthzScope
{
"additionalProperties": false,
"properties": {
"id": {
"type": "string"
},
"type": {
"type": "string",
"description": "realm, organization or project."
}
},
"type": "object"
}AuthzSubject
{
"additionalProperties": false,
"properties": {
"id": {
"type": "string"
},
"type": {
"type": "string",
"description": "user, group or service_principal."
}
},
"type": "object"
}ClaimFieldMapping
{
"additionalProperties": false,
"properties": {
"claim": {
"type": "string"
},
"mode": {
"type": "string",
"enum": [
"on_create",
"sync"
],
"description": "on_create (default) fills the field only at account creation; sync refreshes it on every upstream login."
}
},
"type": "object"
}ClaimMapping
{
"additionalProperties": false,
"properties": {
"display_name": {
"$ref": "#/components/schemas/ClaimFieldMapping"
},
"family_name": {
"$ref": "#/components/schemas/ClaimFieldMapping"
},
"given_name": {
"$ref": "#/components/schemas/ClaimFieldMapping"
},
"locale": {
"$ref": "#/components/schemas/ClaimFieldMapping"
},
"zoneinfo": {
"$ref": "#/components/schemas/ClaimFieldMapping"
}
},
"type": "object"
}Client
{
"additionalProperties": false,
"properties": {
"access_token_claims": {
"additionalProperties": {},
"type": [
"object",
"null"
]
},
"allow_offline_access": {
"type": "boolean"
},
"allow_remember_me": {
"type": "boolean"
},
"allowed_origins": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"backchannel_logout_uri": {
"type": "string"
},
"frontchannel_logout_uri": {
"type": "string",
"description": "Front-channel logout (SES-018): loaded in an iframe when a session the client took part in ends at the logout endpoint. Same scheme, host and port as a registered redirect URI. Browser privacy controls may keep it from working; back-channel logout is the reliable mechanism."
},
"frontchannel_logout_session_required": {
"type": "boolean",
"description": "Add iss and sid to frontchannel_logout_uri. Requires frontchannel_logout_uri."
},
"id_token_encrypted_response_alg": {
"type": "string",
"enum": [
"RSA-OAEP-256",
"ECDH-ES",
"ECDH-ES+A128KW",
"ECDH-ES+A256KW"
],
"description": "TOK-020: encrypt ID tokens (signed, then encrypted: a nested JWT) to the client's newest active registered public key that fits (use enc or no use; RSA for RSA-OAEP-256, EC for ECDH-ES). Issuance fails with unauthorized_client when no key fits."
},
"id_token_encrypted_response_enc": {
"type": "string",
"enum": [
"A128GCM",
"A256GCM"
],
"description": "Required with id_token_encrypted_response_alg (the specification default A128CBC-HS256 is not offered)."
},
"userinfo_signed_response_alg": {
"type": "string",
"enum": [
"RS256",
"PS256",
"ES256",
"EdDSA"
],
"description": "OIDC-013: return UserInfo as a JWT signed with the realm key; must be the realm's signing algorithm."
},
"userinfo_encrypted_response_alg": {
"type": "string",
"enum": [
"RSA-OAEP-256",
"ECDH-ES",
"ECDH-ES+A128KW",
"ECDH-ES+A256KW"
]
},
"userinfo_encrypted_response_enc": {
"type": "string",
"enum": [
"A128GCM",
"A256GCM"
]
},
"authorization_signed_response_alg": {
"type": "string",
"enum": [
"RS256",
"PS256",
"ES256",
"EdDSA"
],
"description": "JARM (ADV-002): the signing algorithm of JWT authorization responses; must be the realm's (responses are always signed with the realm key)."
},
"authorization_encrypted_response_alg": {
"type": "string",
"enum": [
"RSA-OAEP-256",
"ECDH-ES",
"ECDH-ES+A128KW",
"ECDH-ES+A256KW"
],
"description": "JARM: encrypt JWT authorization responses (nested, signed first) to the client's registered key."
},
"authorization_encrypted_response_enc": {
"type": "string",
"enum": [
"A128GCM",
"A256GCM"
]
},
"tls_client_auth_subject_dn": {
"type": "string",
"description": "tls_client_auth (RFC 8705): the certificate must chain to a realm client trust anchor and carry exactly one registered identity: this subject DN (RFC 4514 as Go prints it) or one SAN below."
},
"tls_client_auth_san_dns": {
"type": "string"
},
"tls_client_auth_san_uri": {
"type": "string"
},
"tls_client_auth_san_ip": {
"type": "string"
},
"tls_client_auth_san_email": {
"type": "string"
},
"tls_client_certificate_bound_access_tokens": {
"type": "boolean",
"description": "TOK-019: every access token is bound to the presented TLS client certificate (cnf x5t#S256); a token request without a certificate is refused (invalid_request), never answered with a bearer token."
},
"client_id": {
"type": "string"
},
"client_type": {
"type": "string",
"enum": [
"confidential",
"public_browser",
"native",
"device",
"machine"
]
},
"consent_mode": {
"type": "string"
},
"consent_terms_version": {
"type": "string"
},
"contacts": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"created_at": {
"format": "date-time",
"type": "string"
},
"default_resource_id": {
"type": "string"
},
"description": {
"type": "string"
},
"dynamically_registered": {
"type": "boolean"
},
"environment": {
"type": "string"
},
"first_party": {
"type": "boolean"
},
"grant_types": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"id": {
"type": "string"
},
"id_token_claims": {
"additionalProperties": {},
"type": [
"object",
"null"
]
},
"login_ui_url": {
"type": "string"
},
"name": {
"type": "string"
},
"owner_user_id": {
"type": "string"
},
"post_logout_redirect_uris": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"project_id": {
"type": "string"
},
"realm_id": {
"type": "string"
},
"redirect_uris": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"sector_identifier": {
"type": "string"
},
"protocol": {
"type": "string",
"enum": [
"oidc",
"saml"
],
"description": "saml for the client backing a SAML application; managed only through /saml/applications (PUT /clients/{client} answers 409) and refused by every OAuth endpoint."
},
"security_profile": {
"type": "string"
},
"service_principal_id": {
"type": "string"
},
"state": {
"type": "string",
"enum": [
"active",
"suspended",
"decommissioned"
]
},
"subject_type": {
"type": "string"
},
"token_endpoint_auth_method": {
"type": "string"
},
"token_policy": {
"$ref": "#/components/schemas/ApplicationTokenPolicy"
},
"updated_at": {
"format": "date-time",
"type": "string"
},
"version": {
"format": "int64",
"type": "integer"
}
},
"required": [
"allow_offline_access",
"allow_remember_me",
"allowed_origins",
"client_id",
"client_type",
"consent_mode",
"created_at",
"dynamically_registered",
"environment",
"first_party",
"grant_types",
"id",
"name",
"post_logout_redirect_uris",
"realm_id",
"redirect_uris",
"security_profile",
"state",
"subject_type",
"token_endpoint_auth_method",
"token_policy",
"updated_at",
"version"
],
"type": "object"
}ClientCredential
{
"additionalProperties": false,
"properties": {
"created_at": {
"format": "date-time",
"type": "string"
},
"display_prefix": {
"type": "string"
},
"expires_at": {
"format": "date-time",
"type": [
"string",
"null"
]
},
"id": {
"type": "string"
},
"key_id": {
"type": "string"
},
"kind": {
"type": "string"
},
"last_used_at": {
"format": "date-time",
"type": [
"string",
"null"
]
},
"state": {
"type": "string"
}
},
"required": [
"created_at",
"id",
"kind",
"state"
],
"type": "object"
}ClientInput
{
"additionalProperties": false,
"properties": {
"access_token_claims": {
"additionalProperties": {},
"type": [
"object",
"null"
],
"description": "Static values, or attribute mappings {\"$attr\": \"user.<given_name|family_name|display_name|locale|zoneinfo>\" or \"profile.<claimable attribute>\", \"transform\": \"lower|upper\", \"default\": \"...\"} (APP-011). At most 20 claims; reserved claims are refused; profile attributes not marked claimable are never released."
},
"allow_offline_access": {
"type": "boolean"
},
"allow_remember_me": {
"type": "boolean"
},
"allowed_origins": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"backchannel_logout_uri": {
"type": "string"
},
"frontchannel_logout_uri": {
"type": "string",
"description": "Front-channel logout (SES-018): loaded in an iframe when a session the client took part in ends at the logout endpoint. Same scheme, host and port as a registered redirect URI. Browser privacy controls may keep it from working; back-channel logout is the reliable mechanism."
},
"frontchannel_logout_session_required": {
"type": "boolean",
"description": "Add iss and sid to frontchannel_logout_uri. Requires frontchannel_logout_uri."
},
"id_token_encrypted_response_alg": {
"type": "string",
"enum": [
"RSA-OAEP-256",
"ECDH-ES",
"ECDH-ES+A128KW",
"ECDH-ES+A256KW"
],
"description": "TOK-020: encrypt ID tokens (signed, then encrypted: a nested JWT) to the client's newest active registered public key that fits (use enc or no use; RSA for RSA-OAEP-256, EC for ECDH-ES). Issuance fails with unauthorized_client when no key fits."
},
"id_token_encrypted_response_enc": {
"type": "string",
"enum": [
"A128GCM",
"A256GCM"
],
"description": "Required with id_token_encrypted_response_alg (the specification default A128CBC-HS256 is not offered)."
},
"userinfo_signed_response_alg": {
"type": "string",
"enum": [
"RS256",
"PS256",
"ES256",
"EdDSA"
],
"description": "OIDC-013: return UserInfo as a JWT signed with the realm key; must be the realm's signing algorithm."
},
"userinfo_encrypted_response_alg": {
"type": "string",
"enum": [
"RSA-OAEP-256",
"ECDH-ES",
"ECDH-ES+A128KW",
"ECDH-ES+A256KW"
]
},
"userinfo_encrypted_response_enc": {
"type": "string",
"enum": [
"A128GCM",
"A256GCM"
]
},
"authorization_signed_response_alg": {
"type": "string",
"enum": [
"RS256",
"PS256",
"ES256",
"EdDSA"
],
"description": "JARM (ADV-002): the signing algorithm of JWT authorization responses; must be the realm's (responses are always signed with the realm key)."
},
"authorization_encrypted_response_alg": {
"type": "string",
"enum": [
"RSA-OAEP-256",
"ECDH-ES",
"ECDH-ES+A128KW",
"ECDH-ES+A256KW"
],
"description": "JARM: encrypt JWT authorization responses (nested, signed first) to the client's registered key."
},
"authorization_encrypted_response_enc": {
"type": "string",
"enum": [
"A128GCM",
"A256GCM"
]
},
"tls_client_auth_subject_dn": {
"type": "string",
"description": "tls_client_auth (RFC 8705): the certificate must chain to a realm client trust anchor and carry exactly one registered identity: this subject DN (RFC 4514 as Go prints it) or one SAN below."
},
"tls_client_auth_san_dns": {
"type": "string"
},
"tls_client_auth_san_uri": {
"type": "string"
},
"tls_client_auth_san_ip": {
"type": "string"
},
"tls_client_auth_san_email": {
"type": "string"
},
"tls_client_certificate_bound_access_tokens": {
"type": "boolean",
"description": "TOK-019: every access token is bound to the presented TLS client certificate (cnf x5t#S256); a token request without a certificate is refused (invalid_request), never answered with a bearer token."
},
"client_id": {
"type": "string",
"maxLength": 128,
"description": "Generated when omitted; at most 128 URL-safe characters."
},
"client_type": {
"type": "string",
"enum": [
"confidential",
"public_browser",
"native",
"device",
"machine"
]
},
"consent_mode": {
"type": "string",
"description": "Defaults to preauthorized for first-party clients and required otherwise."
},
"consent_terms_version": {
"type": "string",
"maxLength": 64,
"description": "The client's current terms (APP-013). Consents record the version they were given for; a consent for another version no longer covers the client, so users are asked again."
},
"contacts": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"default_resource_id": {
"type": "string"
},
"description": {
"type": "string"
},
"environment": {
"type": "string",
"description": "Defaults to production (or the project's environment); controls redirect URI and origin registration rules. Fixed at registration (APP-015): register a new client instead of changing it. Clients of a project must use the project's environment, and token exchange never accepts a token minted for a client of another environment."
},
"first_party": {
"type": "boolean"
},
"grant_types": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
],
"description": "Allowed per client type; password and implicit grants are unsupported. Defaults depend on client_type."
},
"id_token_claims": {
"additionalProperties": {},
"type": [
"object",
"null"
],
"description": "Static values, or attribute mappings {\"$attr\": \"user.<given_name|family_name|display_name|locale|zoneinfo>\" or \"profile.<claimable attribute>\", \"transform\": \"lower|upper\", \"default\": \"...\"} (APP-011). At most 20 claims; reserved claims are refused and standard user claims are released by scope, never mapped; profile attributes not marked claimable are never released."
},
"jwks": {
"description": "Public JWK Set for private_key_jwt client authentication."
},
"login_ui_url": {
"type": "string"
},
"name": {
"type": "string",
"maxLength": 200
},
"owner_user_id": {
"type": "string"
},
"post_logout_redirect_uris": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"project_id": {
"type": "string"
},
"redirect_uris": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"sector_identifier": {
"type": "string"
},
"security_profile": {
"type": "string",
"enum": [
"standard",
"third_party",
"privileged",
"high_assurance",
"fapi2"
],
"description": "Defaults to standard. fapi2 (ADV-001) enforces the FAPI 2.0 Security Profile: confidential client, private_key_jwt (PS256, ES256 or EdDSA) or mutual TLS, authorization code (and refresh tokens) only, PAR required, sender-constrained tokens (require_dpop or tls_client_certificate_bound_access_tokens), https redirects, a realm signing algorithm of PS256/ES256/EdDSA, 60-second codes, access tokens of at most 10 minutes, refresh tokens not rotated. Not certified by the OpenID Foundation."
},
"service_principal_id": {
"type": "string"
},
"subject_type": {
"type": "string",
"enum": [
"public",
"pairwise"
],
"description": "Defaults to public; pairwise requires sector_identifier."
},
"token_endpoint_auth_method": {
"type": "string",
"enum": [
"client_secret_basic",
"client_secret_post",
"private_key_jwt",
"none",
"tls_client_auth",
"self_signed_tls_client_auth"
],
"description": "Defaults to client_secret_basic for confidential and machine clients and none for public, native and device clients. tls_client_auth and self_signed_tls_client_auth (RFC 8705, MCH-014; confidential and machine clients) authenticate with the TLS client certificate presented on the mutual-TLS endpoint (or through a trusted proxy)."
},
"token_policy": {
"$ref": "#/components/schemas/ApplicationTokenPolicy"
}
},
"type": "object",
"required": [
"client_type",
"name"
]
}ConfigDocument
{
"type": "object",
"description": "Configuration-as-code document (also published as api/schemas/config-document.schema.json).",
"additionalProperties": false,
"properties": {
"client_resource_grants": {
"additionalProperties": {
"additionalProperties": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"type": [
"object",
"null"
]
},
"type": [
"object",
"null"
],
"description": "client_id -> resource audience -> allowed scopes."
},
"clients": {
"items": {
"$ref": "#/components/schemas/ClientInput"
},
"type": [
"array",
"null"
]
},
"format": {
"type": "string"
},
"permissions": {
"items": {
"$ref": "#/components/schemas/Permission"
},
"type": [
"array",
"null"
]
},
"policy": {
"oneOf": [
{
"$ref": "#/components/schemas/RealmPolicy"
},
{
"type": "null"
}
]
},
"resources": {
"items": {
"$ref": "#/components/schemas/ResourceInput"
},
"type": [
"array",
"null"
]
},
"roles": {
"items": {
"$ref": "#/components/schemas/RoleInput"
},
"type": [
"array",
"null"
]
}
}
}ConfigPlan
{
"additionalProperties": false,
"properties": {
"drift": {
"items": {
"type": "string"
},
"type": "array",
"description": "Existing objects that differ from the document, with the differing members (SDK-012), for example \"client web-bff: redirect_uris differ\". An import never rewrites existing objects: reconcile them through the API."
},
"create": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"errors": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"notes": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"unchanged": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"update": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
}
},
"required": [
"create",
"errors",
"notes",
"unchanged",
"update"
],
"type": "object"
}Consent
{
"type": "object",
"properties": {
"id": {
"type": "string"
},
"client_id": {
"type": "string"
},
"client_name": {
"type": "string"
},
"scopes": {
"type": [
"array",
"null"
],
"items": {
"type": "string"
}
},
"granted_at": {
"type": "string",
"format": "date-time"
},
"client": {
"type": "string",
"description": "Client reference (cli_...)."
},
"resource_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"terms_version": {
"type": "string"
},
"mode": {
"type": "string",
"enum": [
"user",
"preauthorized"
],
"description": "user: given by the user on the consent screen; preauthorized: covered by an administrative pre-authorization."
},
"preauthorization_id": {
"type": "string"
},
"revoked_at": {
"type": "string",
"format": "date-time"
}
},
"required": [
"id",
"client_id",
"client_name",
"scopes",
"granted_at"
]
}CredentialInventoryItem
{
"additionalProperties": false,
"properties": {
"created_at": {
"format": "date-time",
"type": "string"
},
"display_prefix": {
"type": "string"
},
"expires_at": {
"format": "date-time",
"type": "string"
},
"flags": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"id": {
"type": "string"
},
"kind": {
"type": "string"
},
"last_used_at": {
"format": "date-time",
"type": [
"string",
"null"
]
},
"name": {
"type": "string"
},
"organization_id": {
"type": "string"
},
"owner_id": {
"type": "string"
},
"owner_type": {
"type": "string"
},
"resource_id": {
"type": "string"
},
"revoked_at": {
"format": "date-time",
"type": [
"string",
"null"
]
},
"scopes": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"state": {
"type": "string"
}
},
"required": [
"created_at",
"display_prefix",
"expires_at",
"flags",
"id",
"kind",
"name",
"owner_id",
"owner_type",
"resource_id",
"scopes",
"state"
],
"type": "object"
}CustomerSupportGrant
{
"type": "object",
"properties": {
"id": {
"type": "string"
},
"organization_id": {
"type": "string"
},
"mode": {
"type": "string"
},
"state": {
"type": "string"
},
"expires_at": {
"type": "string",
"format": "date-time"
},
"created_at": {
"type": "string",
"format": "date-time"
},
"revoked_at": {
"type": [
"string",
"null"
],
"format": "date-time"
}
},
"required": [
"id",
"organization_id",
"mode",
"state",
"expires_at",
"created_at",
"revoked_at"
]
}Policy
{
"type": "object",
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
},
"description": {
"type": "string"
},
"scope_type": {
"type": "string",
"enum": [
"realm",
"organization"
]
},
"scope_id": {
"type": "string"
},
"state": {
"type": "string",
"enum": [
"draft",
"active",
"disabled"
]
},
"active_version": {
"type": "integer"
},
"requires_approval": {
"type": "boolean"
},
"version": {
"type": "integer"
},
"created_at": {
"type": "string",
"format": "date-time"
},
"updated_at": {
"type": "string",
"format": "date-time"
}
}
}PolicyCreate
{
"type": "object",
"properties": {
"owner_user_id": {
"type": "string",
"description": "Accountable owner (DOM-009); defaults to the creating user."
},
"name": {
"type": "string",
"maxLength": 100
},
"description": {
"type": "string"
},
"scope_type": {
"type": "string",
"enum": [
"realm",
"organization"
]
},
"scope_id": {
"type": "string"
},
"requires_approval": {
"type": "boolean"
},
"definition": {
"$ref": "#/components/schemas/PolicyDefinition"
},
"note": {
"type": "string",
"maxLength": 500
}
},
"required": [
"name",
"definition"
],
"additionalProperties": false
}PolicyVersion
{
"type": "object",
"properties": {
"id": {
"type": "string"
},
"policy_id": {
"type": "string"
},
"version_number": {
"type": "integer"
},
"definition": {
"$ref": "#/components/schemas/PolicyDefinition"
},
"definition_hash": {
"type": "string"
},
"status": {
"type": "string",
"enum": [
"staged",
"approved",
"published",
"superseded",
"rejected"
]
},
"author_id": {
"type": "string"
},
"approved_by_id": {
"type": "string"
},
"note": {
"type": "string"
},
"created_at": {
"type": "string",
"format": "date-time"
},
"approved_at": {
"type": "string",
"format": "date-time"
},
"published_at": {
"type": "string",
"format": "date-time"
}
}
}PolicyDefinition
{
"type": "object",
"description": "Typed, bounded policy (≤ 50 rules, condition depth ≤ 8, ≤ 64 nodes, ≤ 64 KiB). Attributes: action, subject.* (id, type, assurance, acr, roles, is_support, actor_id, client_id, org_id, auth_age_seconds), resource.* (type, id, org_id), context.* (asserted by the calling service), environment.* (now_unix, hour_utc, weekday).",
"properties": {
"description": {
"type": "string"
},
"target": {
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"type": "string",
"description": "Exact action or namespace prefix ending in .*"
}
},
"resource_types": {
"type": "array",
"items": {
"type": "string"
}
}
},
"required": [
"actions"
],
"additionalProperties": false
},
"rules": {
"type": "array",
"maxItems": 50,
"items": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"description": {
"type": "string"
},
"effect": {
"type": "string",
"enum": [
"deny",
"require"
]
},
"actions": {
"type": "array",
"items": {
"type": "string"
}
},
"when": {
"$ref": "#/components/schemas/PolicyCondition"
},
"reason_code": {
"type": "string"
},
"obligations": {
"type": "array",
"items": {
"type": "object",
"properties": {
"type": {
"type": "string",
"enum": [
"reauthenticate",
"approval",
"justification"
]
},
"required_profile": {
"type": "string",
"enum": [
"mfa",
"phishing_resistant"
]
},
"max_age_seconds": {
"type": "integer"
},
"approvals": {
"type": "integer"
}
},
"required": [
"type"
],
"additionalProperties": false
}
}
},
"required": [
"id",
"effect"
],
"additionalProperties": false
}
}
},
"required": [
"target",
"rules"
],
"additionalProperties": false
}PolicyCondition
{
"type": "object",
"description": "Exactly one of all, any, not or op. Comparisons over missing attributes are unknown, and unknown rule conditions apply the rule (fail closed).",
"properties": {
"all": {
"type": "array",
"items": {
"$ref": "#/components/schemas/PolicyCondition"
}
},
"any": {
"type": "array",
"items": {
"$ref": "#/components/schemas/PolicyCondition"
}
},
"not": {
"$ref": "#/components/schemas/PolicyCondition"
},
"op": {
"type": "string",
"enum": [
"eq",
"ne",
"lt",
"le",
"gt",
"ge",
"in",
"contains",
"starts_with",
"exists"
]
},
"attr": {
"type": "string"
},
"value": {},
"value_attr": {
"type": "string"
}
},
"additionalProperties": false
}Decision
{
"additionalProperties": false,
"properties": {
"allowed": {
"type": "boolean"
},
"cache_ttl_seconds": {
"type": "integer",
"description": "Cache contract (AZ-019): reuse the decision for at most this many seconds, only for requests with the same cache_key; 0 means do not cache. Decisions that involve ABAC policies, hooks, step-up obligations, support access or privileged actions are never cacheable."
},
"cache_key": {
"type": "string",
"description": "Opaque key covering realm, subject, actor, client, organization, resource, action, the subject's authorization revision, the policy version and the asserted context; any role, membership or policy change produces a different key."
},
"decision_id": {
"type": "string"
},
"obligations": {
"items": {
"additionalProperties": {},
"type": [
"object",
"null"
]
},
"type": [
"array",
"null"
]
},
"policy_version": {
"type": "string"
},
"reason_code": {
"type": "string"
}
},
"required": [
"allowed",
"cache_ttl_seconds",
"decision_id",
"obligations",
"policy_version",
"reason_code"
],
"type": "object"
}DecisionRequest
{
"additionalProperties": false,
"properties": {
"action": {
"type": "string"
},
"context": {
"additionalProperties": {},
"type": [
"object",
"null"
]
},
"resource": {
"additionalProperties": false,
"properties": {
"id": {
"type": "string"
},
"org_id": {
"type": "string"
},
"project_id": {
"type": "string",
"maxLength": 128,
"description": "Project the resource belongs to (AZ-002): the subject's project-scoped roles for it are evaluated too, and only there. It must exist in the realm and, with an organization, belong to it (owned, or shared through an active project grant)."
},
"type": {
"type": "string"
}
},
"required": [
"id",
"org_id",
"type"
],
"type": "object"
},
"subject": {
"additionalProperties": false,
"properties": {
"id": {
"type": "string"
},
"type": {
"type": "string"
}
},
"required": [
"id",
"type"
],
"type": [
"object",
"null"
],
"description": "Free-form subject; only evaluated for callers holding realm.authorization.simulate."
},
"subject_token": {
"type": "string",
"x-secret": true,
"description": "The end user's access token, validated with introspection authority of the calling resource server."
}
},
"type": "object"
}DevMail
{
"type": "object",
"properties": {
"id": {
"type": "string"
},
"recipient": {
"type": "string"
},
"subject": {
"type": "string"
},
"body": {
"type": "string"
},
"template": {
"type": "string"
},
"created_at": {
"type": "string",
"format": "date-time"
}
}
}DeviceAuthorizationResponse
{
"additionalProperties": false,
"properties": {
"device_code": {
"type": "string",
"x-secret": true
},
"expires_in": {
"type": "integer"
},
"interval": {
"type": "integer"
},
"user_code": {
"type": "string"
},
"verification_uri": {
"type": "string"
},
"verification_uri_complete": {
"type": "string"
}
},
"required": [
"device_code",
"expires_in",
"interval",
"user_code",
"verification_uri"
],
"type": "object"
}Domain
{
"additionalProperties": false,
"properties": {
"challenge_expires_at": {
"format": "date-time",
"type": [
"string",
"null"
]
},
"created_at": {
"format": "date-time",
"type": "string"
},
"domain": {
"type": "string"
},
"id": {
"type": "string"
},
"recheck_at": {
"format": "date-time",
"type": [
"string",
"null"
]
},
"state": {
"type": "string"
},
"verified_at": {
"format": "date-time",
"type": [
"string",
"null"
]
}
},
"required": [
"created_at",
"domain",
"id",
"state"
],
"type": "object"
}DomainChallenge
{
"additionalProperties": false,
"properties": {
"dns_record_name": {
"type": "string"
},
"dns_record_type": {
"type": "string"
},
"dns_record_value": {
"type": "string"
},
"domain": {
"$ref": "#/components/schemas/Domain"
}
},
"required": [
"dns_record_name",
"dns_record_type",
"dns_record_value",
"domain"
],
"type": "object"
}EffectivePermissions
{
"type": "object",
"properties": {
"scope": {
"$ref": "#/components/schemas/AuthzScope"
},
"roles": {
"type": [
"array",
"null"
],
"items": {
"type": "string"
}
},
"permissions": {
"type": [
"array",
"null"
],
"items": {
"type": "string"
}
},
"provenance": {
"type": "object",
"additionalProperties": {
"type": [
"array",
"null"
],
"items": {
"type": "string"
}
},
"description": "permission -> granting role names"
},
"denied_permissions": {
"type": "array",
"items": {
"type": "string"
}
},
"sources": {
"type": "array",
"description": "Assignments producing the permissions (AZ-009): via realm, organization, group or project; conditional grants report whether they apply now. Realm-level sources are redacted for organization administrators.",
"items": {
"type": "object",
"properties": {
"assignment_id": {
"type": "string"
},
"role_id": {
"type": "string"
},
"role_name": {
"type": "string"
},
"via": {
"type": "string",
"enum": [
"realm",
"organization",
"group",
"project"
]
},
"group_id": {
"type": "string"
},
"conditional": {
"type": "boolean"
},
"applies": {
"type": "boolean"
},
"expires_at": {
"type": "string",
"format": "date-time"
},
"permissions": {
"type": "array",
"items": {
"type": "string"
}
},
"redacted": {
"type": "boolean"
}
}
}
},
"policies": {
"type": "array",
"description": "Published policies that may restrict decisions; named only for callers holding realm.policies.read. Definitions are never included.",
"items": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
},
"version": {
"type": "integer"
},
"scope": {
"type": "string"
}
}
}
},
"restricting_policies": {
"type": "integer"
},
"project_id": {
"type": "string",
"description": "The project whose project-scoped assignments were evaluated with the scope (query parameter project_id, AZ-002)."
}
},
"required": [
"scope",
"roles",
"permissions",
"provenance"
]
}ExchangePolicy
{
"additionalProperties": false,
"properties": {
"accept_from_audiences": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"max_scopes": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
}
},
"type": "object"
}Group
{
"additionalProperties": false,
"properties": {
"created_at": {
"format": "date-time",
"type": "string"
},
"description": {
"type": "string"
},
"external_id": {
"type": "string"
},
"id": {
"type": "string"
},
"metadata": {
"additionalProperties": {},
"type": [
"object",
"null"
]
},
"name": {
"type": "string"
},
"organization_id": {
"type": "string"
},
"parent_id": {
"type": "string"
},
"source": {
"type": "string"
},
"version": {
"format": "int64",
"type": "integer"
}
},
"required": [
"created_at",
"id",
"metadata",
"name",
"organization_id",
"source",
"version"
],
"type": "object"
}GroupInput
{
"additionalProperties": false,
"properties": {
"description": {
"type": "string"
},
"external_id": {
"type": "string"
},
"metadata": {
"additionalProperties": {},
"type": [
"object",
"null"
]
},
"name": {
"type": "string"
},
"parent_id": {
"type": [
"string",
"null"
]
}
},
"type": "object"
}GroupMember
{
"type": "object",
"properties": {
"membership_id": {
"type": "string"
},
"user_id": {
"type": "string"
},
"source": {
"type": "string"
},
"added_at": {
"type": "string",
"format": "date-time"
}
},
"required": [
"membership_id",
"user_id",
"source",
"added_at"
]
}IdentityProvider
{
"additionalProperties": false,
"properties": {
"adapter": {
"type": "string",
"description": "The provider adapter; saml for a SAML connection (FED-014)."
},
"alias": {
"type": "string"
},
"claim_mapping": {
"$ref": "#/components/schemas/ClaimMapping"
},
"config": {
"$ref": "#/components/schemas/IdentityProviderConfig"
},
"created_at": {
"format": "date-time",
"type": "string"
},
"display_name": {
"type": "string"
},
"has_client_secret": {
"type": "boolean"
},
"id": {
"type": "string"
},
"issuer": {
"type": "string"
},
"jit_default_role_id": {
"type": "string"
},
"jit_provisioning": {
"type": "boolean"
},
"kind": {
"type": "string",
"description": "oidc, oauth2_social or saml. SAML connections are listed here; PUT answers 409 for them (manage them under /saml/connections) and POST /identity-providers/{id}/test reports SAML certificate diagnostics without contacting the provider."
},
"linking_policy": {
"type": "string"
},
"mapping_revision": {
"format": "int64",
"type": "integer"
},
"organization_id": {
"type": "string"
},
"state": {
"type": "string"
},
"trust_upstream_mfa": {
"type": "boolean"
},
"updated_at": {
"format": "date-time",
"type": "string"
},
"version": {
"format": "int64",
"type": "integer"
}
},
"required": [
"adapter",
"alias",
"claim_mapping",
"config",
"created_at",
"display_name",
"has_client_secret",
"id",
"issuer",
"jit_provisioning",
"kind",
"linking_policy",
"mapping_revision",
"state",
"trust_upstream_mfa",
"updated_at",
"version"
],
"type": "object"
}IdentityProviderConfig
{
"additionalProperties": false,
"properties": {
"algorithms": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"allowed_email_domains": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"allowed_tenants": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"api_base_url": {
"type": "string"
},
"authorization_endpoint": {
"type": "string"
},
"client_auth": {
"type": "string",
"enum": [
"client_secret_basic",
"client_secret_post"
],
"description": "Defaults to client_secret_basic."
},
"client_id": {
"type": "string"
},
"discovery_url": {
"type": "string"
},
"end_session_endpoint": {
"type": "string"
},
"jwks_uri": {
"type": "string"
},
"multi_tenant_issuer": {
"type": "boolean"
},
"scopes": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
],
"maxItems": 20,
"description": "OIDC connections must request openid."
},
"tenant_claim": {
"type": "string"
},
"token_endpoint": {
"type": "string"
},
"trusted_acr_values": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
}
},
"type": "object",
"required": [
"client_id"
]
}IdentityProviderDiagnostics
{
"additionalProperties": false,
"properties": {
"authorization_endpoint": {
"type": "string"
},
"issuer": {
"type": "string"
},
"jwks_uri": {
"type": "string"
},
"ok": {
"type": "boolean"
},
"problems": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"signing_keys": {
"type": "integer"
},
"supports_pkce_s256": {
"type": "boolean"
},
"token_endpoint": {
"type": "string"
}
},
"required": [
"issuer",
"ok",
"problems",
"signing_keys",
"supports_pkce_s256"
],
"type": "object"
}IdentityProviderInput
{
"additionalProperties": false,
"properties": {
"adapter": {
"type": "string",
"pattern": "^[a-z][a-z0-9_-]{0,31}$",
"description": "Defaults to oidc. Built-in adapters (FED-002): oidc (generic OpenID Connect), github (OAuth 2.0 with the REST user API; numeric account ID as subject; only verified emails), google (fixed issuer https://accounts.google.com; allowed_tenants restricts to Workspace domains through the hd claim), microsoft (Entra ID work and school accounts: issuer https://login.microsoftonline.com/{tenant}/v2.0 selected by tid, allowed_tenants required; its email claim is never treated as verified, so trusted_verified_email linking is refused). Deployments can register further adapters in code; unknown names are refused."
},
"alias": {
"type": "string",
"description": "Lower-case letters, digits and dashes (2..63). Part of the registered callback URL; cannot be changed."
},
"claim_mapping": {
"oneOf": [
{
"$ref": "#/components/schemas/ClaimMapping"
},
{
"type": "null"
}
]
},
"client_secret": {
"type": [
"string",
"null"
],
"x-secret": true,
"format": "password",
"description": "Upstream client secret (write-only; stored encrypted and never returned, see has_client_secret). On PUT, omit to keep the current secret; an empty string clears it."
},
"config": {
"$ref": "#/components/schemas/IdentityProviderConfig"
},
"display_name": {
"type": "string",
"maxLength": 100
},
"issuer": {
"type": "string",
"description": "Upstream issuer; required for OIDC connections. May contain {tenant} for multi-tenant issuers. Cannot change while identities are linked."
},
"jit_default_role_id": {
"type": "string"
},
"jit_provisioning": {
"type": "boolean"
},
"linking_policy": {
"type": "string",
"enum": [
"verify_existing",
"trusted_verified_email",
"create_only"
]
},
"organization_id": {
"type": "string"
},
"state": {
"type": "string",
"enum": [
"active",
"disabled"
]
},
"trust_upstream_mfa": {
"type": "boolean"
}
},
"type": "object",
"required": [
"alias",
"config",
"display_name"
]
}ImpersonationGrant
{
"additionalProperties": false,
"properties": {
"actor_user_id": {
"type": "string"
},
"created_at": {
"format": "date-time",
"type": "string"
},
"expires_at": {
"format": "date-time",
"type": "string"
},
"id": {
"type": "string"
},
"mode": {
"type": "string"
},
"organization_id": {
"type": "string"
},
"request_id": {
"type": "string"
},
"resource_id": {
"type": "string"
},
"revoke_reason": {
"type": "string"
},
"revoked_at": {
"format": "date-time",
"type": [
"string",
"null"
]
},
"scope_ceiling": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"state": {
"type": "string"
},
"target_user_id": {
"type": "string"
}
},
"required": [
"actor_user_id",
"created_at",
"expires_at",
"id",
"mode",
"organization_id",
"request_id",
"resource_id",
"scope_ceiling",
"state",
"target_user_id"
],
"type": "object"
}ImpersonationIssued
{
"additionalProperties": false,
"properties": {
"access_token": {
"type": "string",
"x-secret": true,
"description": "Support (impersonation) access token. Returned once; never replayed."
},
"expires_in": {
"type": "integer"
},
"grant": {
"$ref": "#/components/schemas/ImpersonationGrant"
},
"scope": {
"type": "string"
},
"token_type": {
"type": "string"
}
},
"required": [
"access_token",
"expires_in",
"grant",
"scope",
"token_type"
],
"type": "object"
}ImpersonationRequest
{
"additionalProperties": false,
"properties": {
"actor_user_id": {
"type": "string"
},
"approval_required": {
"type": "string"
},
"approved_by": {
"type": "string"
},
"created_at": {
"format": "date-time",
"type": "string"
},
"expires_at": {
"format": "date-time",
"type": "string"
},
"id": {
"type": "string"
},
"mode": {
"type": "string"
},
"organization_id": {
"type": "string"
},
"resource_id": {
"type": "string"
},
"scopes": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"state": {
"type": "string"
},
"target_user_id": {
"type": "string"
},
"ticket_reference": {
"type": "string"
}
},
"required": [
"actor_user_id",
"approval_required",
"created_at",
"expires_at",
"id",
"mode",
"organization_id",
"resource_id",
"scopes",
"state",
"target_user_id"
],
"type": "object"
}ImpersonationRequestInput
{
"additionalProperties": false,
"properties": {
"audience": {
"type": "string"
},
"client_id": {
"type": "string"
},
"mode": {
"type": "string",
"enum": [
"read_only",
"allowlisted_write"
]
},
"organization_id": {
"type": "string"
},
"reason": {
"type": "string"
},
"scopes": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"target_user_id": {
"type": "string"
},
"ticket_reference": {
"type": "string"
},
"ttl_seconds": {
"type": "integer"
}
},
"type": "object",
"required": [
"reason",
"target_user_id"
]
}IntrospectionResponse
{
"type": "object",
"additionalProperties": true,
"description": "RFC 7662 introspection response. Inactive, unknown, revoked or out-of-audience tokens return only {\"active\": false}.",
"properties": {
"active": {
"type": "boolean"
},
"iss": {
"type": "string"
},
"sub": {
"type": "string"
},
"aud": {
"type": "string"
},
"client_id": {
"type": "string"
},
"scope": {
"type": "string"
},
"exp": {
"type": "integer",
"format": "int64"
},
"iat": {
"type": "integer",
"format": "int64"
},
"jti": {
"type": "string"
},
"token_kind": {
"type": "string"
},
"token_type": {
"type": "string",
"enum": [
"Bearer",
"DPoP"
],
"description": "DPoP for a token bound to a DPoP key (cnf.jkt, RFC 9449 section 6.2); Bearer otherwise, also for certificate-bound tokens (RFC 8705)."
},
"authz_version": {
"type": "integer",
"format": "int64"
},
"org_id": {
"type": "string"
},
"sid": {
"type": "string"
},
"auth_time": {
"type": "integer",
"format": "int64"
},
"acr": {
"type": "string"
},
"act": {
"type": "object",
"additionalProperties": true
},
"cnf": {
"type": "object",
"additionalProperties": true
},
"agent": {
"type": "boolean",
"const": true,
"description": "Present (true) when the subject is a service principal registered as an autonomous agent (MCH-017): for its JWT and opaque access tokens and its API keys."
},
"subject_type": {
"type": "string"
},
"impersonation_grant_id": {
"type": "string"
}
},
"required": [
"active"
]
}Invitation
{
"additionalProperties": false,
"properties": {
"accepted_at": {
"format": "date-time",
"type": [
"string",
"null"
]
},
"accepted_by_user_id": {
"type": "string"
},
"allowed_domains": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"created_at": {
"format": "date-time",
"type": "string"
},
"delivery_state": {
"type": "string"
},
"expires_at": {
"format": "date-time",
"type": "string"
},
"id": {
"type": "string"
},
"inviter_id": {
"type": "string"
},
"inviter_type": {
"type": "string"
},
"max_uses": {
"type": "integer"
},
"batch_id": {
"type": "string"
},
"superseded_by": {
"type": "string",
"description": "Set when an administrator reassigned this invitation (INV-014)."
},
"membership_id": {
"type": "string"
},
"organization_id": {
"type": "string"
},
"project_id": {
"type": "string"
},
"purpose": {
"type": "string"
},
"role_ids": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"secret_version": {
"type": "integer"
},
"send_count": {
"type": "integer"
},
"state": {
"type": "string"
},
"target_email": {
"type": "string"
},
"target_user_id": {
"type": "string"
},
"use_count": {
"type": "integer"
},
"version": {
"format": "int64",
"type": "integer"
}
},
"required": [
"created_at",
"delivery_state",
"expires_at",
"id",
"inviter_id",
"inviter_type",
"max_uses",
"organization_id",
"purpose",
"role_ids",
"secret_version",
"send_count",
"state",
"use_count",
"version"
],
"type": "object"
}InvitationAcceptance
{
"additionalProperties": false,
"description": "Organization invitations return membership_id; project invitations (INV-012) return project_id and assignment_ids and create no membership.",
"properties": {
"invitation_id": {
"type": "string"
},
"membership_id": {
"type": "string"
},
"organization_id": {
"type": "string"
},
"project_id": {
"type": "string"
},
"assignment_ids": {
"type": "array",
"items": {
"type": "string"
}
}
},
"required": [
"invitation_id",
"organization_id"
],
"type": "object"
}InvitationInput
{
"additionalProperties": false,
"properties": {
"allowed_domains": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"email": {
"type": "string",
"description": "Target email; an email or user_id is required unless purpose is shared_link."
},
"locale": {
"type": "string"
},
"max_uses": {
"type": "integer"
},
"message": {
"type": "string"
},
"project_id": {
"type": "string"
},
"purpose": {
"type": "string",
"enum": [
"organization_membership",
"project_access",
"shared_link"
],
"description": "Defaults to organization_membership."
},
"role_ids": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
],
"maxItems": 10
},
"ttl_hours": {
"type": "integer"
},
"user_id": {
"type": "string"
}
},
"type": "object"
}InvitationInspection
{
"additionalProperties": false,
"properties": {
"expires_at": {
"format": "date-time",
"type": "string"
},
"organization_id": {
"type": "string"
},
"organization_name": {
"type": "string"
},
"purpose": {
"type": "string"
},
"requires_account": {
"type": "boolean"
}
},
"required": [
"expires_at",
"organization_id",
"organization_name",
"purpose",
"requires_account"
],
"type": "object"
}JWKSet
{
"type": "object",
"description": "Public verification keys (RFC 7517). Never contains private key material.",
"properties": {
"keys": {
"type": "array",
"items": {
"type": "object",
"additionalProperties": true
}
}
},
"required": [
"keys"
]
}Job
{
"additionalProperties": false,
"properties": {
"attempts": {
"type": "integer"
},
"cancel_requested": {
"type": "boolean"
},
"created_at": {
"format": "date-time",
"type": "string"
},
"dry_run": {
"type": "boolean"
},
"finished_at": {
"format": "date-time",
"type": [
"string",
"null"
]
},
"has_protected_result": {
"type": "boolean"
},
"id": {
"type": "string"
},
"input": {
"additionalProperties": {},
"type": [
"object",
"null"
],
"description": "The non-secret job input as submitted. Secret-bearing input (user.import records with password verifiers, TOTP seeds and contact data) is stored as protected input: encrypted at rest, never returned here, and erased when the job finishes."
},
"last_error": {
"type": "string"
},
"organization_id": {
"type": "string"
},
"progress": {
"additionalProperties": {},
"type": [
"object",
"null"
]
},
"realm_id": {
"type": "string"
},
"requested_by_id": {
"type": "string"
},
"requested_by_type": {
"type": "string"
},
"result": {
"additionalProperties": {},
"type": [
"object",
"null"
]
},
"result_expires_at": {
"format": "date-time",
"type": [
"string",
"null"
]
},
"state": {
"type": "string",
"description": "queued, running, succeeded, failed or cancelled."
},
"type": {
"type": "string"
}
},
"required": [
"attempts",
"cancel_requested",
"created_at",
"dry_run",
"has_protected_result",
"id",
"progress",
"requested_by_id",
"requested_by_type",
"state",
"type"
],
"type": "object"
}JobAccepted
{
"type": "object",
"description": "Reference to an asynchronous job; poll GET /api/v1/realms/{realm}/jobs/{id}.",
"properties": {
"job_id": {
"type": "string"
}
},
"required": [
"job_id"
]
}JoinRequest
{
"additionalProperties": false,
"properties": {
"reviewer_ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Assigned reviewers; empty when any member holding org.join_requests.review may decide. Always empty in the requester's own listing."
},
"created_at": {
"format": "date-time",
"type": "string"
},
"decided_at": {
"format": "date-time",
"type": [
"string",
"null"
]
},
"decided_by": {
"type": "string"
},
"expires_at": {
"format": "date-time",
"type": "string"
},
"id": {
"type": "string"
},
"organization_id": {
"type": "string"
},
"reason": {
"type": "string"
},
"state": {
"type": "string"
},
"user_id": {
"type": "string"
}
},
"required": [
"created_at",
"expires_at",
"id",
"organization_id",
"state",
"user_id"
],
"type": "object"
}LinkedIdentity
{
"additionalProperties": false,
"properties": {
"created_at": {
"format": "date-time",
"type": "string"
},
"email_hint": {
"type": "string"
},
"id": {
"type": "string"
},
"last_used_at": {
"format": "date-time",
"type": [
"string",
"null"
]
},
"provenance": {
"type": "string"
},
"provider": {
"type": "string"
},
"provider_display_name": {
"type": "string"
},
"provider_id": {
"type": "string"
}
},
"required": [
"created_at",
"id",
"provenance",
"provider",
"provider_display_name",
"provider_id"
],
"type": "object"
}MachineCredential
{
"additionalProperties": false,
"properties": {
"created_at": {
"format": "date-time",
"type": "string"
},
"display_prefix": {
"type": "string"
},
"expires_at": {
"format": "date-time",
"type": "string"
},
"id": {
"type": "string"
},
"kind": {
"type": "string",
"enum": [
"api_key",
"personal_token"
]
},
"last_used_at": {
"format": "date-time",
"type": [
"string",
"null"
]
},
"name": {
"type": "string"
},
"organization_id": {
"type": "string"
},
"owner_id": {
"type": "string"
},
"owner_type": {
"type": "string"
},
"resource_id": {
"type": "string"
},
"revoked_at": {
"format": "date-time",
"type": [
"string",
"null"
]
},
"scopes": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"state": {
"type": "string"
}
},
"required": [
"created_at",
"display_prefix",
"expires_at",
"id",
"kind",
"name",
"owner_id",
"owner_type",
"resource_id",
"scopes",
"state"
],
"type": "object"
}MachineCredentialInput
{
"additionalProperties": false,
"properties": {
"audience": {
"type": "string"
},
"name": {
"type": "string"
},
"organization_id": {
"type": "string"
},
"scopes": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"ttl_days": {
"type": "integer",
"maximum": 365,
"description": "Expiry is mandatory; at most 365 days."
}
},
"type": "object",
"required": [
"audience",
"name",
"scopes"
]
}MaskedUser
{
"type": "object",
"description": "Masked view returned to support operators holding only support.users.read (identifier values are masked).",
"properties": {
"id": {
"type": "string"
},
"state": {
"type": "string"
},
"display_name": {
"type": "string"
},
"identifiers": {
"type": "array",
"items": {
"$ref": "#/components/schemas/UserIdentifier"
}
},
"created_at": {
"type": "string",
"format": "date-time"
},
"last_login_at": {
"type": [
"string",
"null"
],
"format": "date-time"
}
},
"required": [
"id",
"state",
"display_name",
"identifiers",
"created_at",
"last_login_at"
]
}Membership
{
"additionalProperties": false,
"properties": {
"created_at": {
"format": "date-time",
"type": "string"
},
"display_name": {
"type": "string"
},
"email": {
"type": "string"
},
"expires_at": {
"format": "date-time",
"type": [
"string",
"null"
]
},
"external_id": {
"type": "string"
},
"id": {
"type": "string"
},
"joined_at": {
"format": "date-time",
"type": [
"string",
"null"
]
},
"metadata": {
"type": "object",
"additionalProperties": true,
"description": "Organization membership metadata (USR-009), at most limits.metadata_bytes as JSON. Present only for callers holding org.members.write in the organization; never shown to the member or put in tokens."
},
"organization_id": {
"type": "string"
},
"removed_at": {
"format": "date-time",
"type": [
"string",
"null"
]
},
"revision": {
"format": "int64",
"type": "integer"
},
"roles": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"source": {
"type": "string"
},
"source_reference": {
"type": "string"
},
"state": {
"type": "string"
},
"user_id": {
"type": "string"
}
},
"required": [
"created_at",
"id",
"organization_id",
"revision",
"source",
"state",
"user_id"
],
"type": "object"
}MembershipSummary
{
"type": "object",
"properties": {
"membership_id": {
"type": "string"
},
"organization_id": {
"type": "string"
},
"slug": {
"type": "string"
},
"display_name": {
"type": "string"
},
"membership_state": {
"type": "string"
},
"organization_state": {
"type": "string"
},
"joined_at": {
"type": [
"string",
"null"
],
"format": "date-time"
}
},
"required": [
"membership_id",
"organization_id",
"slug",
"display_name",
"membership_state",
"organization_state",
"joined_at"
]
}NotificationJob
{
"additionalProperties": false,
"properties": {
"attempts": {
"type": "integer"
},
"channel": {
"type": "string"
},
"created_at": {
"format": "date-time",
"type": "string"
},
"id": {
"type": "string"
},
"last_error": {
"type": "string"
},
"recipient_hint": {
"type": "string"
},
"reference_id": {
"type": "string"
},
"reference_type": {
"type": "string"
},
"state": {
"type": "string"
},
"template": {
"type": "string"
},
"updated_at": {
"format": "date-time",
"type": "string"
}
},
"required": [
"attempts",
"channel",
"created_at",
"id",
"recipient_hint",
"state",
"template",
"updated_at"
],
"type": "object"
}NotificationTemplate
{
"type": "object",
"properties": {
"id": {
"type": "string"
},
"organization_id": {
"type": "string"
},
"event_type": {
"type": "string"
},
"locale": {
"type": "string"
},
"subject": {
"type": "string"
},
"body_text": {
"type": "string"
},
"version": {
"type": "integer"
}
},
"required": [
"id",
"organization_id",
"event_type",
"locale",
"subject",
"body_text",
"version"
]
}OAuthError
{
"type": "object",
"description": "OAuth 2.0 error response (RFC 6749 section 5.2) used by protocol endpoints.",
"properties": {
"error": {
"type": "string"
},
"error_description": {
"type": "string"
}
},
"required": [
"error"
]
}Obligation
{
"type": "object",
"description": "A mandatory condition the caller must satisfy (or deny).",
"properties": {
"type": {
"type": "string",
"enum": [
"reauthenticate"
]
},
"required_profile": {
"type": "string"
},
"max_age_seconds": {
"type": "integer"
}
},
"required": [
"type"
]
}OpenIDConfiguration
{
"type": "object",
"description": "OpenID Provider / OAuth 2.0 Authorization Server metadata. Optional endpoints are advertised only when the capability is enabled.",
"properties": {
"issuer": {
"type": "string",
"format": "uri"
},
"authorization_endpoint": {
"type": "string"
},
"token_endpoint": {
"type": "string"
},
"jwks_uri": {
"type": "string"
},
"userinfo_endpoint": {
"type": "string"
},
"introspection_endpoint": {
"type": "string"
},
"revocation_endpoint": {
"type": "string"
},
"end_session_endpoint": {
"type": "string"
},
"device_authorization_endpoint": {
"type": "string"
},
"pushed_authorization_request_endpoint": {
"type": "string"
},
"registration_endpoint": {
"type": "string"
},
"check_session_iframe": {
"type": "string",
"description": "OpenID Connect Session Management 1.0 (OIDC-014); present only when the realm turned it on."
},
"response_types_supported": {
"type": "array",
"items": {
"type": "string"
}
},
"response_modes_supported": {
"type": "array",
"items": {
"type": "string"
}
},
"grant_types_supported": {
"type": "array",
"items": {
"type": "string"
}
},
"subject_types_supported": {
"type": "array",
"items": {
"type": "string"
}
},
"id_token_signing_alg_values_supported": {
"type": "array",
"items": {
"type": "string"
}
},
"userinfo_signing_alg_values_supported": {
"type": "array",
"items": {
"type": "string"
}
},
"token_endpoint_auth_methods_supported": {
"type": "array",
"items": {
"type": "string"
}
},
"token_endpoint_auth_signing_alg_values_supported": {
"type": "array",
"items": {
"type": "string"
}
},
"introspection_endpoint_auth_methods_supported": {
"type": "array",
"items": {
"type": "string"
}
},
"revocation_endpoint_auth_methods_supported": {
"type": "array",
"items": {
"type": "string"
}
},
"code_challenge_methods_supported": {
"type": "array",
"items": {
"type": "string"
}
},
"scopes_supported": {
"type": "array",
"items": {
"type": "string"
}
},
"claims_supported": {
"type": "array",
"items": {
"type": "string"
}
},
"claims_parameter_supported": {
"type": "boolean"
},
"request_parameter_supported": {
"type": "boolean"
},
"request_uri_parameter_supported": {
"type": "boolean"
},
"require_request_uri_registration": {
"type": "boolean"
},
"require_pushed_authorization_requests": {
"type": "boolean"
},
"prompt_values_supported": {
"type": "array",
"items": {
"type": "string"
}
},
"acr_values_supported": {
"type": "array",
"items": {
"type": "string"
}
},
"authorization_response_iss_parameter_supported": {
"type": "boolean"
},
"authorization_signing_alg_values_supported": {
"type": "array",
"items": {
"type": "string"
},
"description": "JARM (ADV-002): algorithms of the published signing keys."
},
"authorization_encryption_alg_values_supported": {
"type": "array",
"items": {
"type": "string"
},
"description": "JARM response encryption: RSA-OAEP-256, ECDH-ES, ECDH-ES+A128KW, ECDH-ES+A256KW."
},
"authorization_encryption_enc_values_supported": {
"type": "array",
"items": {
"type": "string"
},
"description": "JARM content encryption: A128GCM, A256GCM."
},
"id_token_encryption_alg_values_supported": {
"type": "array",
"items": {
"type": "string"
},
"description": "TOK-020: RSA-OAEP-256, ECDH-ES, ECDH-ES+A128KW, ECDH-ES+A256KW."
},
"id_token_encryption_enc_values_supported": {
"type": "array",
"items": {
"type": "string"
},
"description": "A128GCM, A256GCM."
},
"userinfo_encryption_alg_values_supported": {
"type": "array",
"items": {
"type": "string"
},
"description": "OIDC-013: RSA-OAEP-256, ECDH-ES, ECDH-ES+A128KW, ECDH-ES+A256KW."
},
"userinfo_encryption_enc_values_supported": {
"type": "array",
"items": {
"type": "string"
},
"description": "A128GCM, A256GCM."
},
"tls_client_certificate_bound_access_tokens": {
"type": "boolean",
"description": "true when client certificates reach the server (server.mtls_listen or server.client_cert_header; RFC 8705, TOK-019); false otherwise."
},
"mtls_endpoint_aliases": {
"type": "object",
"description": "RFC 8705 §5: the mutual-TLS listener's endpoints, present only when server.mtls_origin is set. pushed_authorization_request_endpoint and device_authorization_endpoint appear with those capabilities.",
"properties": {
"token_endpoint": {
"type": "string"
},
"introspection_endpoint": {
"type": "string"
},
"revocation_endpoint": {
"type": "string"
},
"userinfo_endpoint": {
"type": "string"
},
"pushed_authorization_request_endpoint": {
"type": "string"
},
"device_authorization_endpoint": {
"type": "string"
}
},
"additionalProperties": false
},
"frontchannel_logout_supported": {
"type": "boolean",
"description": "OIDC Front-Channel Logout 1.0 (SES-018): true with the logout endpoint."
},
"frontchannel_logout_session_supported": {
"type": "boolean",
"description": "true with the logout endpoint: iss and sid are added to the front-channel logout URI when the client asks for them."
},
"backchannel_logout_supported": {
"type": "boolean"
},
"backchannel_logout_session_supported": {
"type": "boolean"
},
"dpop_signing_alg_values_supported": {
"type": "array",
"items": {
"type": "string"
}
},
"service_documentation": {
"type": "string"
}
},
"required": [
"issuer",
"authorization_endpoint",
"token_endpoint",
"jwks_uri",
"response_types_supported",
"subject_types_supported",
"id_token_signing_alg_values_supported"
]
}OrgPolicy
{
"additionalProperties": false,
"properties": {
"audit_retention_days": {
"type": "integer",
"minimum": 30,
"maximum": 3650,
"description": "Keeps this organization's audit evidence at least this many days (AUD-009); it never shortens the realm's or deployment's retention."
},
"personal_tokens": {
"type": "string",
"enum": [
"allowed",
"disabled"
],
"description": "disabled forbids personal access tokens in this organization's context (MCH-006)."
},
"personal_token_max_days": {
"type": "integer",
"minimum": 0,
"maximum": 365
},
"registration_mode": {
"type": "string",
"enum": [
"inherit",
"public",
"closed",
"invitation_only",
"domain_restricted"
],
"description": "Narrows realm registration in this organization's context (REG-001): requested organization, invited organization, or the organization owning the email domain. It can only tighten the realm mode."
},
"allowed_scopes": {
"type": "array",
"items": {
"type": "string"
},
"description": "Organization scope ceiling (TOK-008); tokens in this organization's context carry only these business scopes."
},
"allowed_email_domains": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"allowed_login_methods": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"impersonation_approval": {
"type": "string"
},
"invitations_enabled": {
"type": [
"boolean",
"null"
]
},
"join_requests_enabled": {
"type": "boolean"
},
"mfa_required": {
"type": "boolean"
},
"session_absolute_seconds": {
"type": "integer"
},
"session_idle_seconds": {
"type": "integer"
},
"sso_provider_id": {
"type": "string"
},
"sso_required": {
"type": "boolean"
},
"support_access_opt_out": {
"type": "boolean"
}
},
"type": "object"
}Organization
{
"additionalProperties": false,
"properties": {
"authz_revision": {
"format": "int64",
"type": "integer"
},
"contact": {
"additionalProperties": {},
"type": [
"object",
"null"
]
},
"created_at": {
"format": "date-time",
"type": "string"
},
"display_name": {
"type": "string"
},
"external_id": {
"type": "string"
},
"id": {
"type": "string"
},
"locale": {
"type": "string"
},
"metadata": {
"additionalProperties": {},
"type": [
"object",
"null"
]
},
"policy": {
"$ref": "#/components/schemas/OrgPolicy"
},
"realm_id": {
"type": "string"
},
"slug": {
"type": "string"
},
"state": {
"type": "string"
},
"time_zone": {
"type": "string"
},
"updated_at": {
"format": "date-time",
"type": "string"
},
"version": {
"format": "int64",
"type": "integer"
}
},
"required": [
"authz_revision",
"contact",
"created_at",
"display_name",
"id",
"metadata",
"policy",
"realm_id",
"slug",
"state",
"updated_at",
"version"
],
"type": "object"
}OrganizationDeletionPreview
{
"additionalProperties": false,
"properties": {
"active_grants": {
"type": "integer"
},
"active_members": {
"type": "integer"
},
"active_support_grants": {
"type": "integer"
},
"owned_projects": {
"type": "integer"
},
"owned_clients": {
"type": "integer",
"description": "Active clients of the organization's projects and service principals; suspended at once."
},
"pending_invitations": {
"type": "integer"
},
"provisioning_connectors": {
"type": "integer"
},
"role_assignments": {
"type": "integer",
"description": "Role assignments scoped to the organization; removed."
},
"groups": {
"type": "integer"
},
"verified_domains": {
"type": "integer"
},
"owned_service_principals": {
"type": "integer",
"description": "Service principals owned by the organization; disabled at once."
},
"active_automation_credentials": {
"type": "integer",
"description": "API keys and personal tokens in the organization; revoked at once."
},
"webhook_subscriptions": {
"type": "integer",
"description": "Organization webhooks; disabled at once and deleted with their secrets when the deletion finishes."
},
"identity_providers": {
"type": "integer",
"description": "Organization identity providers; disabled at once, client secrets erased when the deletion finishes."
},
"mail_server_configured": {
"type": "boolean",
"description": "An organization mail server (TEN-022); its configuration and credential are erased."
},
"consent_preauthorizations": {
"type": "integer",
"description": "Live administrative consent pre-authorizations for the organization; revoked at once."
},
"export_results": {
"type": "integer",
"description": "Job results (exports) of the organization still downloadable; erased at once."
},
"pending_jobs": {
"type": "integer",
"description": "Queued or running jobs of the organization; cancelled at once."
},
"retained_audit_events": {
"type": "integer",
"description": "Audit events about the organization; retained under the audit retention policy and legal holds."
},
"active_legal_holds": {
"type": "integer",
"description": "Active legal holds that keep evidence of the organization: realm-wide holds, holds on the organization, and holds on an account that is a member of it (in any membership state)."
},
"retained": {
"type": "array",
"items": {
"type": "string"
},
"description": "What the deletion keeps."
}
},
"required": [
"active_grants",
"active_members",
"active_support_grants",
"owned_projects",
"pending_invitations",
"provisioning_connectors"
],
"type": "object"
}OrganizationInput
{
"additionalProperties": false,
"properties": {
"contact": {
"additionalProperties": {},
"type": [
"object",
"null"
]
},
"display_name": {
"type": "string",
"maxLength": 200
},
"external_id": {
"type": "string"
},
"locale": {
"type": "string"
},
"metadata": {
"additionalProperties": {},
"type": [
"object",
"null"
]
},
"policy": {
"oneOf": [
{
"$ref": "#/components/schemas/OrgPolicy"
},
{
"type": "null"
}
]
},
"slug": {
"type": "string",
"description": "2-63 lowercase letters, digits or dashes; derived when omitted."
},
"time_zone": {
"type": "string"
}
},
"type": "object",
"required": [
"display_name"
]
}Passkey
{
"additionalProperties": false,
"properties": {
"aaguid": {
"type": "string"
},
"attestation_trusted": {
"type": "boolean",
"description": "PASS-009: the attestation chained to trusted metadata; otherwise the AAGUID is self-reported."
},
"attestation_format": {
"type": "string"
},
"backup_eligible": {
"type": "boolean"
},
"created_at": {
"format": "date-time",
"type": "string"
},
"discoverable": {
"type": "boolean"
},
"id": {
"type": "string"
},
"last_used_at": {
"format": "date-time",
"type": [
"string",
"null"
]
},
"name": {
"type": "string"
},
"synced": {
"type": "boolean"
},
"transports": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"user_verified": {
"type": "boolean"
}
},
"required": [
"backup_eligible",
"created_at",
"discoverable",
"id",
"name",
"synced",
"transports",
"user_verified"
],
"type": "object"
}PasskeyRegistrationOptions
{
"type": "object",
"properties": {
"ceremony_id": {
"type": "string"
},
"public_key": {
"type": "object",
"additionalProperties": true,
"description": "W3C WebAuthn PublicKeyCredentialCreationOptions (JSON encoding) to pass to navigator.credentials.create()."
},
"expires_at": {
"type": "string",
"format": "date-time"
}
},
"required": [
"ceremony_id",
"public_key",
"expires_at"
]
}PasswordResetRequested
{
"additionalProperties": false,
"properties": {
"expires_at": {
"format": "date-time",
"type": "string"
},
"message": {
"type": "string"
},
"reset_id": {
"type": "string"
}
},
"required": [
"expires_at",
"message",
"reset_id"
],
"type": "object"
}Permission
{
"additionalProperties": false,
"properties": {
"built_in": {
"type": "boolean"
},
"description": {
"type": "string"
},
"id": {
"type": "string"
},
"name": {
"type": "string"
},
"namespace": {
"type": "string"
},
"owner_resource_id": {
"type": "string"
},
"resource_type": {
"type": "string"
},
"sensitivity": {
"type": "string",
"description": "Defaults to normal. Privileged permissions produce step-up obligations in decisions."
}
},
"type": "object",
"required": [
"name"
]
}RememberedDevice
{
"type": "object",
"properties": {
"id": {
"type": "string"
},
"label": {
"type": "string"
},
"created_at": {
"type": "string",
"format": "date-time"
},
"last_used_at": {
"type": "string",
"format": "date-time"
},
"expires_at": {
"type": "string",
"format": "date-time"
}
}
}AssignmentRequest
{
"type": "object",
"properties": {
"id": {
"type": "string"
},
"role_id": {
"type": "string"
},
"subject": {
"type": "object",
"properties": {
"type": {
"type": "string"
},
"id": {
"type": "string"
}
}
},
"scope": {
"type": "object",
"properties": {
"type": {
"type": "string"
},
"id": {
"type": "string"
}
}
},
"conditions": {
"$ref": "#/components/schemas/GrantConditions"
},
"valid_from": {
"type": "string",
"format": "date-time"
},
"assignment_expires_at": {
"type": "string",
"format": "date-time"
},
"reason": {
"type": "string"
},
"requested_by": {
"type": "string"
},
"state": {
"type": "string",
"enum": [
"pending",
"approved",
"rejected",
"expired"
]
},
"decided_by": {
"type": "string"
},
"decided_at": {
"type": "string",
"format": "date-time"
},
"assignment_id": {
"type": "string"
},
"expires_at": {
"type": "string",
"format": "date-time"
},
"created_at": {
"type": "string",
"format": "date-time"
}
}
}HookInput
{
"type": "object",
"properties": {
"owner_user_id": {
"type": "string",
"description": "Accountable owner (DOM-009); defaults to the creating user."
},
"name": {
"type": "string"
},
"kind": {
"type": "string",
"enum": [
"registration.eligibility",
"profile.validation",
"token.claims",
"authorization.decision",
"authentication.risk"
]
},
"url": {
"type": "string",
"format": "uri"
},
"timeout_ms": {
"type": "integer",
"minimum": 100,
"maximum": 5000
},
"failure_mode": {
"type": "string",
"enum": [
"deny",
"skip"
]
},
"client_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"allow_private_network": {
"type": "boolean"
},
"state": {
"type": "string",
"enum": [
"active",
"disabled"
]
},
"contract_version": {
"type": "integer",
"enum": [
1
],
"description": "Hook contract version (EXT-018), sent as ProudAuth-Hook-Version; default 1. See api/hooks."
}
},
"required": [
"name",
"kind",
"url"
],
"additionalProperties": false
}Hook
{
"type": "object",
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
},
"kind": {
"type": "string"
},
"url": {
"type": "string"
},
"timeout_ms": {
"type": "integer"
},
"failure_mode": {
"type": "string"
},
"client_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"allow_private_network": {
"type": "boolean"
},
"state": {
"type": "string"
},
"invocations": {
"type": "integer"
},
"failures": {
"type": "integer"
},
"last_latency_ms": {
"type": "integer"
},
"last_failure_at": {
"type": "string",
"format": "date-time"
},
"last_error": {
"type": "string"
},
"contract_version": {
"type": "integer",
"description": "Hook contract version (EXT-018)."
},
"plugin_id": {
"type": "string",
"description": "Set when a plugin manages the hook; PUT and DELETE then return 409 (EXT-014)."
},
"version": {
"type": "integer"
},
"created_at": {
"type": "string",
"format": "date-time"
}
}
}ActivityEvent
{
"type": "object",
"properties": {
"type": {
"type": "string"
},
"occurred_at": {
"type": "string",
"format": "date-time"
},
"outcome": {
"type": "string"
},
"network": {
"type": "string",
"description": "Privacy-reduced network context."
},
"client_id": {
"type": "string"
},
"performed_by": {
"type": "string",
"description": "Actor type when someone other than the account owner acted."
},
"support_grant_id": {
"type": "string"
},
"reason_code": {
"type": "string"
},
"details": {
"type": "object"
}
}
}InvitationBatchResult
{
"type": "object",
"properties": {
"index": {
"type": "integer"
},
"status": {
"type": "integer",
"description": "HTTP status the entry would have produced on its own."
},
"invitation_id": {
"type": "string"
},
"error": {
"type": "object",
"description": "Problem summary (code, title, detail, errors) for a failed entry."
}
},
"required": [
"index",
"status"
]
}ProjectGrant
{
"type": "object",
"properties": {
"id": {
"type": "string"
},
"project_id": {
"type": "string"
},
"organization_id": {
"type": "string"
},
"allowed_role_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"state": {
"type": "string",
"enum": [
"active",
"suspended",
"revoked"
]
},
"valid_until": {
"type": "string",
"format": "date-time"
},
"created_at": {
"type": "string",
"format": "date-time"
}
}
}GrantConditions
{
"type": "object",
"additionalProperties": false,
"description": "Conditions on a role assignment (AZ-012). Unknown members are rejected; a condition that cannot be evaluated for the trusted request context fails closed. The support capability members (IMP-002, IMP-007) apply only to support access and bound the organizations, target categories, modes and scopes an operator may use, re-checked on every use of a grant.",
"properties": {
"client_ids": {
"type": "array",
"maxItems": 50,
"items": {
"type": "string"
}
},
"resources": {
"type": "array",
"maxItems": 50,
"items": {
"type": "string"
},
"description": "Resource IDs or audiences."
},
"min_assurance": {
"type": "string",
"enum": [
"mfa",
"phishing_resistant"
]
},
"max_auth_age_seconds": {
"type": "integer",
"minimum": 0,
"maximum": 86400
},
"active_hours_utc": {
"type": "array",
"minItems": 2,
"maxItems": 2,
"items": {
"type": "integer"
}
},
"weekdays": {
"type": "array",
"items": {
"type": "integer",
"minimum": 0,
"maximum": 6
}
},
"organization_ids": {
"type": "array",
"maxItems": 200,
"items": {
"type": "string"
}
},
"subject_categories": {
"type": "array",
"items": {
"type": "string",
"enum": [
"member",
"guest"
]
}
},
"support_modes": {
"type": "array",
"items": {
"type": "string",
"enum": [
"read_only",
"allowlisted_write"
]
}
},
"support_scopes": {
"type": "array",
"maxItems": 50,
"items": {
"type": "string"
}
}
}
}ScimResource
{
"type": "object",
"description": "A SCIM resource or discovery document.",
"additionalProperties": true,
"properties": {
"schemas": {
"type": "array",
"items": {
"type": "string"
}
},
"id": {
"type": "string"
},
"externalId": {
"type": "string"
},
"meta": {
"type": "object",
"additionalProperties": true
}
}
}ScimListResponse
{
"type": "object",
"properties": {
"schemas": {
"type": "array",
"items": {
"type": "string"
}
},
"totalResults": {
"type": "integer"
},
"startIndex": {
"type": "integer"
},
"itemsPerPage": {
"type": "integer"
},
"Resources": {
"type": "array",
"items": {
"$ref": "#/components/schemas/ScimResource"
}
}
},
"required": [
"schemas",
"totalResults"
]
}ScimUser
{
"type": "object",
"additionalProperties": true,
"properties": {
"schemas": {
"type": "array",
"items": {
"type": "string"
}
},
"userName": {
"type": "string"
},
"externalId": {
"type": "string"
},
"displayName": {
"type": "string"
},
"name": {
"type": "object",
"properties": {
"givenName": {
"type": "string"
},
"familyName": {
"type": "string"
}
}
},
"emails": {
"type": "array",
"items": {
"type": "object",
"properties": {
"value": {
"type": "string"
},
"type": {
"type": "string"
},
"primary": {
"type": "boolean"
}
}
}
},
"active": {
"type": "boolean",
"description": "Membership state in the connector organization."
}
},
"required": [
"userName"
]
}ScimGroup
{
"type": "object",
"additionalProperties": true,
"properties": {
"schemas": {
"type": "array",
"items": {
"type": "string"
}
},
"displayName": {
"type": "string"
},
"externalId": {
"type": "string"
},
"members": {
"type": "array",
"items": {
"type": "object",
"properties": {
"value": {
"type": "string"
}
}
}
}
},
"required": [
"displayName"
]
}ScimPatchOp
{
"type": "object",
"additionalProperties": true,
"properties": {
"schemas": {
"type": "array",
"items": {
"type": "string"
}
},
"Operations": {
"type": "array",
"items": {
"type": "object",
"properties": {
"op": {
"type": "string",
"description": "add, replace or remove (case-insensitive)."
},
"path": {
"type": "string"
},
"value": {}
},
"required": [
"op"
]
}
}
},
"required": [
"Operations"
]
}ScimErrorDocument
{
"type": "object",
"properties": {
"schemas": {
"type": "array",
"items": {
"type": "string"
}
},
"status": {
"type": "string"
},
"scimType": {
"type": "string"
},
"detail": {
"type": "string"
}
},
"required": [
"schemas",
"status"
]
}ProvisioningConnectorInput
{
"type": "object",
"additionalProperties": false,
"properties": {
"name": {
"type": "string"
},
"kind": {
"type": "string",
"enum": [
"scim_inbound"
]
},
"allowed_resource_types": {
"type": "array",
"items": {
"type": "string",
"enum": [
"User",
"Group"
]
}
},
"role_ceiling_ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Roles the connector may ever grant; within the creator own ceiling."
},
"group_role_mappings": {
"type": "object",
"additionalProperties": {
"type": "array",
"items": {
"type": "string"
}
},
"description": "Approved mappings from SCIM group display names to role IDs within the ceiling."
},
"default_role_id": {
"type": "string"
},
"config": {
"type": "object",
"additionalProperties": true
}
},
"required": [
"name"
]
}ProvisioningConnector
{
"type": "object",
"properties": {
"id": {
"type": "string"
},
"organization_id": {
"type": "string"
},
"name": {
"type": "string"
},
"kind": {
"type": "string"
},
"state": {
"type": "string",
"enum": [
"active",
"disabled"
]
},
"allowed_resource_types": {
"type": "array",
"items": {
"type": "string"
}
},
"role_ceiling_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"group_role_mappings": {
"type": "object",
"additionalProperties": {
"type": "array",
"items": {
"type": "string"
}
}
},
"default_role_id": {
"type": "string"
},
"config": {
"type": "object",
"additionalProperties": true
},
"last_sync_at": {
"type": "string",
"format": "date-time"
},
"last_error": {
"type": "string"
},
"stats": {
"type": "object",
"additionalProperties": true
},
"version": {
"type": "integer"
},
"created_at": {
"type": "string",
"format": "date-time"
},
"updated_at": {
"type": "string",
"format": "date-time"
}
},
"required": [
"id",
"name",
"state",
"version"
]
}WorkloadTrustInput
{
"type": "object",
"additionalProperties": false,
"properties": {
"name": {
"type": "string",
"maxLength": 100
},
"profile": {
"type": "string",
"enum": [
"generic",
"github_actions",
"kubernetes",
"spiffe"
]
},
"issuer": {
"type": "string",
"description": "https issuer the assertion's iss must equal (github_actions defaults to https://token.actions.githubusercontent.com; spiffe defaults to spiffe://<trust domain> for JWT-SVIDs without iss)."
},
"jwks_uri": {
"type": "string"
},
"jwks": {
"type": "object",
"description": "Inline JSON Web Key Set of the issuer's public signing keys (1 to 20)."
},
"audience": {
"type": "string",
"description": "The exact audience the assertion must carry (in aud, string or array)."
},
"subject": {
"type": "string",
"description": "Exact subject, or a prefix ending in * where the profile allows it."
},
"claim_constraints": {
"type": "object",
"additionalProperties": {
"type": "array",
"items": {
"type": "string"
}
},
"description": "Claims that must have one of the listed values; nested claims use / (for example kubernetes.io/namespace). iss, sub, aud, exp, nbf, iat and jti are not allowed here."
},
"algorithms": {
"type": "array",
"items": {
"type": "string",
"enum": [
"RS256",
"PS256",
"ES256",
"ES384",
"EdDSA"
]
}
},
"max_assertion_lifetime_seconds": {
"type": "integer",
"minimum": 60,
"maximum": 86400,
"description": "Longest accepted exp minus iat (default 3600)."
},
"require_jti": {
"type": "boolean",
"description": "Refuse assertions without jti (default true for github_actions). A jti, when present, is single-use per trust."
},
"state": {
"type": "string",
"enum": [
"active",
"disabled"
]
}
},
"required": [
"name",
"audience",
"subject"
]
}WorkloadTrust
{
"type": "object",
"properties": {
"id": {
"type": "string"
},
"client_id": {
"type": "string",
"description": "The client's internal reference."
},
"name": {
"type": "string"
},
"profile": {
"type": "string"
},
"issuer": {
"type": "string"
},
"jwks_uri": {
"type": "string"
},
"jwks": {
"type": "object"
},
"audience": {
"type": "string"
},
"subject": {
"type": "string"
},
"claim_constraints": {
"type": "object",
"additionalProperties": {
"type": "array",
"items": {
"type": "string"
}
}
},
"algorithms": {
"type": "array",
"items": {
"type": "string"
}
},
"max_assertion_lifetime_seconds": {
"type": "integer"
},
"require_jti": {
"type": "boolean"
},
"state": {
"type": "string"
},
"version": {
"type": "integer"
},
"created_by_id": {
"type": "string"
},
"created_at": {
"type": "string",
"format": "date-time"
},
"updated_at": {
"type": "string",
"format": "date-time"
},
"last_used_at": {
"type": "string",
"format": "date-time"
}
}
}RegistrationToken
{
"type": "object",
"properties": {
"id": {
"type": "string"
},
"kind": {
"type": "string",
"enum": [
"initial",
"registration"
]
},
"description": {
"type": "string"
},
"allowed_scopes": {
"type": "array",
"items": {
"type": "object",
"properties": {
"resource_id": {
"type": "string"
},
"scopes": {
"type": "array",
"items": {
"type": "string"
}
}
}
}
},
"project_id": {
"type": "string"
},
"max_uses": {
"type": "integer"
},
"uses": {
"type": "integer"
},
"expires_at": {
"type": "string",
"format": "date-time"
},
"state": {
"type": "string",
"enum": [
"active",
"expired",
"revoked",
"exhausted"
],
"description": "expired: an initial access token past its expires_at (refused at registration; it can still be revoked)."
},
"created_by_id": {
"type": "string"
},
"created_at": {
"type": "string",
"format": "date-time"
},
"last_used_at": {
"type": "string",
"format": "date-time"
}
}
}ResourceType
{
"type": "object",
"properties": {
"id": {
"type": "string"
},
"resource_id": {
"type": "string"
},
"name": {
"type": "string"
},
"relations": {
"type": "array",
"items": {
"type": "object",
"properties": {
"name": {
"type": "string"
},
"subject_types": {
"type": "array",
"items": {
"type": "string"
}
},
"implied_by": {
"type": "array",
"items": {
"type": "string"
}
}
}
}
},
"permissions": {
"type": "object",
"additionalProperties": {
"type": "array",
"items": {
"type": "string"
}
}
},
"shareable_relations": {
"type": "array",
"items": {
"type": "string"
}
},
"share_permission": {
"type": "string"
},
"version": {
"type": "integer"
},
"created_by_id": {
"type": "string"
},
"created_at": {
"type": "string",
"format": "date-time"
},
"updated_at": {
"type": "string",
"format": "date-time"
}
}
}ElevationEligibility
{
"type": "object",
"properties": {
"id": {
"type": "string"
},
"user_id": {
"type": "string"
},
"role_id": {
"type": "string"
},
"role_name": {
"type": "string"
},
"scope": {
"type": "object",
"properties": {
"type": {
"type": "string"
},
"id": {
"type": "string"
}
}
},
"max_duration_seconds": {
"type": "integer"
},
"requires_approval": {
"type": "boolean"
},
"state": {
"type": "string",
"enum": [
"active",
"revoked"
]
},
"created_by_id": {
"type": "string"
},
"created_at": {
"type": "string",
"format": "date-time"
}
}
}Elevation
{
"type": "object",
"properties": {
"id": {
"type": "string"
},
"eligibility_id": {
"type": "string"
},
"user_id": {
"type": "string"
},
"role_id": {
"type": "string"
},
"role_name": {
"type": "string"
},
"scope": {
"type": "object",
"properties": {
"type": {
"type": "string"
},
"id": {
"type": "string"
}
}
},
"reason": {
"type": "string"
},
"duration_seconds": {
"type": "integer"
},
"state": {
"type": "string",
"enum": [
"pending",
"active",
"rejected",
"ended",
"expired",
"cancelled"
]
},
"requested_at": {
"type": "string",
"format": "date-time"
},
"decided_by_id": {
"type": "string"
},
"decided_at": {
"type": "string",
"format": "date-time"
},
"starts_at": {
"type": "string",
"format": "date-time"
},
"ends_at": {
"type": "string",
"format": "date-time"
},
"assignment_id": {
"type": "string"
}
}
}AccessReview
{
"type": "object",
"properties": {
"id": {
"type": "string"
},
"organization_id": {
"type": "string"
},
"name": {
"type": "string"
},
"description": {
"type": "string"
},
"state": {
"type": "string",
"enum": [
"open",
"closed",
"cancelled"
]
},
"reviewer_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"role_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"privileged_only": {
"type": "boolean"
},
"on_no_decision": {
"type": "string",
"enum": [
"keep",
"revoke"
]
},
"due_at": {
"type": "string",
"format": "date-time"
},
"overdue": {
"type": "boolean"
},
"items_total": {
"type": "integer"
},
"items_decided": {
"type": "integer"
},
"summary": {
"type": "object",
"additionalProperties": {
"type": "integer"
}
},
"created_by_id": {
"type": "string"
},
"created_at": {
"type": "string",
"format": "date-time"
},
"closed_by_id": {
"type": "string"
},
"closed_at": {
"type": "string",
"format": "date-time"
}
}
}AccessReviewItem
{
"type": "object",
"properties": {
"id": {
"type": "string"
},
"assignment_id": {
"type": "string"
},
"role_id": {
"type": "string"
},
"role_name": {
"type": "string"
},
"subject": {
"type": "object",
"properties": {
"type": {
"type": "string"
},
"id": {
"type": "string"
}
}
},
"scope": {
"type": "object",
"properties": {
"type": {
"type": "string"
},
"id": {
"type": "string"
}
}
},
"source": {
"type": "string"
},
"granted_by_id": {
"type": "string"
},
"granted_at": {
"type": "string",
"format": "date-time"
},
"privileged": {
"type": "boolean"
},
"decision": {
"type": "string",
"enum": [
"keep",
"revoke"
]
},
"decided_by_id": {
"type": "string"
},
"decided_at": {
"type": "string",
"format": "date-time"
},
"comment": {
"type": "string"
},
"outcome": {
"type": "string",
"enum": [
"kept",
"revoked",
"already_removed",
"revoke_failed"
]
},
"applied_at": {
"type": "string",
"format": "date-time"
}
}
}CertificateTrustAnchor
{
"type": "object",
"properties": {
"id": {
"type": "string"
},
"purpose": {
"type": "string",
"enum": [
"client",
"user"
]
},
"name": {
"type": "string"
},
"certificate_pem": {
"type": "string"
},
"subject": {
"type": "string"
},
"fingerprint": {
"type": "string",
"description": "base64url SHA-256 of the authority certificate."
},
"not_after": {
"type": "string",
"format": "date-time"
},
"revocation": {
"type": "string",
"enum": [
"none",
"crl"
]
},
"crl_next_update": {
"type": "string",
"format": "date-time"
},
"map_san_email": {
"type": "boolean"
},
"multi_factor": {
"type": "boolean"
},
"state": {
"type": "string"
},
"created_by_id": {
"type": "string"
},
"created_at": {
"type": "string",
"format": "date-time"
}
}
}CertificateBinding
{
"type": "object",
"properties": {
"id": {
"type": "string"
},
"user_id": {
"type": "string"
},
"anchor_id": {
"type": "string"
},
"issuer_dn": {
"type": "string"
},
"subject_dn": {
"type": "string"
},
"state": {
"type": "string"
},
"created_by_id": {
"type": "string"
},
"created_at": {
"type": "string",
"format": "date-time"
},
"last_used_at": {
"type": "string",
"format": "date-time"
}
}
}AuthFlowDefinition
{
"type": "object",
"description": "The realm policy authentication_flow member (AUT-012).",
"additionalProperties": true,
"properties": {
"rules": {
"type": "array",
"maxItems": 50,
"items": {
"type": "object",
"additionalProperties": true
}
},
"challenge_provider": {
"type": "string"
},
"email_code_alternative": {
"type": "boolean"
}
}
}AuthFlowFinding
{
"type": "object",
"required": [
"severity",
"code",
"rule",
"index",
"message"
],
"properties": {
"severity": {
"type": "string",
"enum": [
"error",
"warning"
]
},
"code": {
"type": "string",
"enum": [
"bypass",
"unreachable",
"partial_bypass",
"skip_on_missing",
"deny_all"
]
},
"rule": {
"type": "string"
},
"index": {
"type": "integer"
},
"by": {
"type": "string"
},
"message": {
"type": "string"
}
}
}AuthFlowAnalysis
{
"type": "object",
"required": [
"errors",
"warnings",
"unreachable_rules"
],
"properties": {
"errors": {
"type": "array",
"items": {
"$ref": "#/components/schemas/AuthFlowFinding"
}
},
"warnings": {
"type": "array",
"items": {
"$ref": "#/components/schemas/AuthFlowFinding"
}
},
"unreachable_rules": {
"type": "array",
"items": {
"type": "string"
}
}
}
}AuthFlowResult
{
"type": "object",
"required": [
"outcome"
],
"properties": {
"outcome": {
"type": "string",
"enum": [
"allow",
"review",
"challenge",
"require_mfa",
"require_phishing_resistant",
"deny"
]
},
"rule": {
"type": "string"
},
"missing_signals": {
"type": "array",
"items": {
"type": "string"
}
}
}
}AuthFlowCase
{
"type": "object",
"additionalProperties": false,
"properties": {
"name": {
"type": "string"
},
"client_id": {
"type": "string"
},
"organization_id": {
"type": "string"
},
"method": {
"type": "string"
},
"resources": {
"type": "array",
"items": {
"type": "string"
}
},
"ip": {
"type": "string"
},
"known_device": {
"type": "boolean"
},
"failed_attempts": {
"type": "integer"
},
"risk": {
"type": "string",
"enum": [
"low",
"medium",
"high"
]
},
"risk_partial": {
"type": "boolean"
},
"privileged": {
"type": "boolean"
},
"assurance": {
"type": "string"
}
}
}AuthFlowRevision
{
"type": "object",
"required": [
"revision",
"state",
"definition",
"definition_hash",
"base_hash",
"analysis",
"created_by",
"created_at"
],
"properties": {
"revision": {
"type": "integer"
},
"state": {
"type": "string",
"enum": [
"draft",
"published",
"superseded",
"discarded"
]
},
"definition": {
"$ref": "#/components/schemas/AuthFlowDefinition"
},
"definition_hash": {
"type": "string"
},
"base_hash": {
"type": "string"
},
"note": {
"type": "string"
},
"analysis": {
"$ref": "#/components/schemas/AuthFlowAnalysis"
},
"rollback_of": {
"type": "integer"
},
"policy_revision": {
"type": "integer"
},
"created_by": {
"type": "object"
},
"created_at": {
"type": "string",
"format": "date-time"
},
"published_by": {
"type": "object"
},
"published_at": {
"type": "string",
"format": "date-time"
}
}
}SSFConfiguration
{
"type": "object",
"properties": {
"spec_version": {
"type": "string"
},
"issuer": {
"type": "string"
},
"jwks_uri": {
"type": "string"
},
"delivery_methods_supported": {
"type": "array",
"items": {
"type": "string"
}
},
"configuration_endpoint": {
"type": "string"
},
"status_endpoint": {
"type": "string"
},
"add_subject_endpoint": {
"type": "string"
},
"remove_subject_endpoint": {
"type": "string"
},
"verification_endpoint": {
"type": "string"
},
"authorization_schemes": {
"type": "array",
"items": {
"type": "object"
}
},
"default_subjects": {
"type": "string"
},
"events_supported": {
"type": "array",
"items": {
"type": "string"
}
}
}
}SSFDelivery
{
"type": "object",
"additionalProperties": false,
"required": [
"method"
],
"properties": {
"method": {
"type": "string",
"enum": [
"urn:ietf:rfc:8935",
"urn:ietf:rfc:8936"
]
},
"endpoint_url": {
"type": "string",
"description": "Push target (receiver-supplied); for poll, assigned by the transmitter."
},
"authorization_header": {
"type": "string",
"x-secret": true,
"description": "Write-only. Sent as the Authorization header of each push; stored encrypted and never returned."
}
}
}SSFStreamInput
{
"type": "object",
"additionalProperties": false,
"properties": {
"stream_id": {
"type": "string"
},
"delivery": {
"$ref": "#/components/schemas/SSFDelivery"
},
"events_requested": {
"type": "array",
"maxItems": 50,
"items": {
"type": "string"
}
},
"description": {
"type": "string",
"maxLength": 500
},
"subject_scope": {
"type": "string",
"enum": [
"client_users",
"listed"
]
},
"iss": {},
"aud": {},
"events_supported": {},
"events_delivered": {},
"min_verification_interval": {},
"status": {},
"reason": {},
"client_id": {},
"created_at": {},
"updated_at": {}
}
}SSFStream
{
"type": "object",
"required": [
"stream_id",
"iss",
"aud",
"delivery",
"events_supported",
"events_requested",
"events_delivered",
"min_verification_interval",
"subject_scope",
"status"
],
"properties": {
"stream_id": {
"type": "string"
},
"iss": {
"type": "string"
},
"aud": {
"type": "string"
},
"delivery": {
"$ref": "#/components/schemas/SSFDelivery"
},
"events_supported": {
"type": "array",
"items": {
"type": "string"
}
},
"events_requested": {
"type": "array",
"items": {
"type": "string"
}
},
"events_delivered": {
"type": "array",
"items": {
"type": "string"
}
},
"description": {
"type": "string"
},
"min_verification_interval": {
"type": "integer"
},
"subject_scope": {
"type": "string",
"enum": [
"client_users",
"listed",
"all"
]
},
"status": {
"type": "string",
"enum": [
"enabled",
"paused",
"disabled"
]
},
"reason": {
"type": "string"
},
"client_id": {
"type": "string"
},
"created_at": {
"type": "string",
"format": "date-time"
},
"updated_at": {
"type": "string",
"format": "date-time"
}
}
}SAMLEndpoint
{
"type": "object",
"additionalProperties": false,
"properties": {
"binding": {
"type": "string",
"enum": [
"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect",
"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
],
"description": "Assertion consumer services: HTTP-POST only (default). Logout endpoints: HTTP-Redirect or HTTP-POST."
},
"url": {
"type": "string",
"format": "uri"
},
"response_url": {
"type": "string",
"format": "uri",
"description": "Logout endpoints: where LogoutResponses go (default url)."
},
"index": {
"type": "integer",
"description": "Assertion consumer service index (assigned in order when all are 0)."
},
"is_default": {
"type": "boolean",
"description": "The default assertion consumer service (the first when none is marked)."
}
},
"required": [
"url"
]
}SAMLCertificate
{
"type": "object",
"additionalProperties": false,
"properties": {
"pem": {
"type": "string",
"description": "PEM certificate."
},
"sha256_fingerprint": {
"type": "string"
},
"subject": {
"type": "string"
},
"not_before": {
"type": "string",
"format": "date-time"
},
"not_after": {
"type": "string",
"format": "date-time"
}
},
"required": [
"pem",
"sha256_fingerprint",
"not_before",
"not_after"
]
}SAMLAttributeMapping
{
"type": "object",
"additionalProperties": false,
"properties": {
"name": {
"type": "string",
"maxLength": 256
},
"name_format": {
"type": "string",
"enum": [
"urn:oasis:names:tc:SAML:2.0:attrname-format:basic",
"urn:oasis:names:tc:SAML:2.0:attrname-format:uri",
"urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"
],
"description": "Default: uri when the name contains a colon, basic otherwise."
},
"friendly_name": {
"type": "string",
"maxLength": 128
},
"source": {
"type": "string",
"enum": [
"email",
"email_verified",
"name",
"given_name",
"family_name",
"preferred_username",
"locale",
"zoneinfo",
"phone_number",
"user_id",
"subject",
"organization_id",
"static"
],
"description": "email and phone_number release verified identifiers only; subject is the NameID value; an empty value is not released."
},
"value": {
"type": "string",
"maxLength": 512,
"description": "Static attributes only; never under a protected identity name (SAML-006)."
}
},
"required": [
"name",
"source"
]
}SAMLIdentityProviderEndpoints
{
"type": "object",
"additionalProperties": false,
"properties": {
"entity_id": {
"type": "string",
"description": "The realm issuer."
},
"metadata_url": {
"type": "string"
},
"sso_url": {
"type": "string"
},
"slo_url": {
"type": "string"
}
},
"required": [
"entity_id",
"metadata_url",
"sso_url",
"slo_url"
]
}SAMLApplication
{
"type": "object",
"additionalProperties": false,
"properties": {
"id": {
"type": "string"
},
"entity_id": {
"type": "string"
},
"client_ref": {
"type": "string",
"description": "Backing client (protocol saml)."
},
"client_id": {
"type": "string"
},
"state": {
"type": "string",
"enum": [
"active",
"suspended",
"decommissioned"
]
},
"name": {
"type": "string",
"maxLength": 200
},
"description": {
"type": "string"
},
"organization_id": {
"type": "string",
"description": "Only that organization's active members receive assertions; its policies apply to the sign-in."
},
"project_id": {
"type": "string"
},
"environment": {
"type": "string",
"enum": [
"production",
"staging",
"development"
]
},
"first_party": {
"type": "boolean"
},
"consent_mode": {
"type": "string",
"enum": [
"required",
"preauthorized"
],
"description": "Default: preauthorized for first-party, required otherwise."
},
"consent_terms_version": {
"type": "string"
},
"require_mfa": {
"type": "boolean"
},
"max_session_age_seconds": {
"type": "integer"
},
"allow_remember_me": {
"type": "boolean"
},
"login_ui_url": {
"type": "string",
"description": "Login interface for this application (default: the realm's)."
},
"assertion_consumer_services": {
"type": "array",
"items": {
"$ref": "#/components/schemas/SAMLEndpoint"
}
},
"single_logout_services": {
"type": "array",
"items": {
"$ref": "#/components/schemas/SAMLEndpoint"
}
},
"require_signed_requests": {
"type": "boolean",
"description": "AuthnRequests must be signed with a registered certificate (default: true when certificates are registered)."
},
"name_id_format": {
"type": "string",
"enum": [
"urn:oasis:names:tc:SAML:2.0:nameid-format:persistent",
"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified",
"urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
],
"description": "persistent (default): opaque, stable and different per application; emailAddress: the verified email only; unspecified: the account ID; transient: new per assertion."
},
"attributes": {
"type": "array",
"items": {
"$ref": "#/components/schemas/SAMLAttributeMapping"
}
},
"sign_response": {
"type": "boolean",
"description": "Sign the Response (default true)."
},
"sign_assertion": {
"type": "boolean",
"description": "Sign the Assertion (default true)."
},
"signature_algorithm": {
"type": "string",
"enum": [
"http://www.w3.org/2001/04/xmldsig-more#rsa-sha256",
"http://www.w3.org/2001/04/xmldsig-more#rsa-sha384",
"http://www.w3.org/2001/04/xmldsig-more#rsa-sha512"
]
},
"allow_idp_initiated": {
"type": "boolean",
"description": "Allow unsolicited (IdP-initiated) responses (SAML-007); default false."
},
"idp_initiated_relay_state": {
"type": "string",
"maxLength": 1024
},
"clock_skew_seconds": {
"type": "integer",
"description": "Default 120; at most saml.max_clock_skew."
},
"assertion_lifetime_seconds": {
"type": "integer",
"description": "Default 300; 60..1800."
},
"additional_audiences": {
"type": "array",
"items": {
"type": "string"
},
"description": "Further Audience values (at most 5)."
},
"encrypt_assertions": {
"type": "boolean",
"description": "Encrypt assertions (sign, then encrypt) to the encryption certificate."
},
"data_encryption_algorithm": {
"type": "string",
"enum": [
"http://www.w3.org/2009/xmlenc11#aes256-gcm",
"http://www.w3.org/2009/xmlenc11#aes128-gcm"
],
"description": "Default aes256-gcm. AES-CBC is not offered (SAML-009)."
},
"key_transport_algorithm": {
"type": "string",
"enum": [
"http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p",
"http://www.w3.org/2009/xmlenc11#rsa-oaep"
],
"description": "Default rsa-oaep-mgf1p; xmlenc11 rsa-oaep uses SHA-256 and MGF1-SHA-256. RSA PKCS#1 v1.5 is not offered."
},
"authn_context_map": {
"type": "object",
"additionalProperties": {
"type": "string"
},
"description": "AuthnContextClassRef -> local ACR (urn:proudauth:acr:...), extending the built-in mapping (PasswordProtectedTransport, Password, unspecified = single factor; MobileTwoFactorContract, TimeSyncToken, multipleauthn, REFEDS MFA = mfa)."
},
"signing_certificates": {
"type": "array",
"items": {
"$ref": "#/components/schemas/SAMLCertificate"
}
},
"encryption_certificate": {
"$ref": "#/components/schemas/SAMLCertificate"
},
"identity_provider": {
"$ref": "#/components/schemas/SAMLIdentityProviderEndpoints"
},
"version": {
"type": "integer",
"format": "int64"
},
"created_at": {
"type": "string",
"format": "date-time"
},
"updated_at": {
"type": "string",
"format": "date-time"
}
},
"required": [
"id",
"entity_id",
"client_ref",
"client_id",
"state",
"assertion_consumer_services",
"name_id_format",
"attributes",
"signing_certificates",
"identity_provider",
"version"
]
}SAMLApplicationInput
{
"type": "object",
"additionalProperties": false,
"properties": {
"entity_id": {
"type": "string",
"description": "Required unless metadata_xml supplies it."
},
"metadata_xml": {
"type": "string",
"description": "Uploaded SP metadata (EntityDescriptor with an SPSSODescriptor)."
},
"name": {
"type": "string",
"maxLength": 200
},
"description": {
"type": "string"
},
"organization_id": {
"type": "string",
"description": "Only that organization's active members receive assertions; its policies apply to the sign-in."
},
"project_id": {
"type": "string"
},
"environment": {
"type": "string",
"enum": [
"production",
"staging",
"development"
]
},
"first_party": {
"type": "boolean"
},
"consent_mode": {
"type": "string",
"enum": [
"required",
"preauthorized"
],
"description": "Default: preauthorized for first-party, required otherwise."
},
"consent_terms_version": {
"type": "string"
},
"require_mfa": {
"type": "boolean"
},
"max_session_age_seconds": {
"type": "integer"
},
"allow_remember_me": {
"type": "boolean"
},
"login_ui_url": {
"type": "string",
"description": "Login interface for this application (default: the realm's)."
},
"assertion_consumer_services": {
"type": "array",
"items": {
"$ref": "#/components/schemas/SAMLEndpoint"
}
},
"single_logout_services": {
"type": "array",
"items": {
"$ref": "#/components/schemas/SAMLEndpoint"
}
},
"require_signed_requests": {
"type": "boolean",
"description": "AuthnRequests must be signed with a registered certificate (default: true when certificates are registered)."
},
"name_id_format": {
"type": "string",
"enum": [
"urn:oasis:names:tc:SAML:2.0:nameid-format:persistent",
"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified",
"urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
],
"description": "persistent (default): opaque, stable and different per application; emailAddress: the verified email only; unspecified: the account ID; transient: new per assertion."
},
"attributes": {
"type": "array",
"items": {
"$ref": "#/components/schemas/SAMLAttributeMapping"
}
},
"sign_response": {
"type": "boolean",
"description": "Sign the Response (default true)."
},
"sign_assertion": {
"type": "boolean",
"description": "Sign the Assertion (default true)."
},
"signature_algorithm": {
"type": "string",
"enum": [
"http://www.w3.org/2001/04/xmldsig-more#rsa-sha256",
"http://www.w3.org/2001/04/xmldsig-more#rsa-sha384",
"http://www.w3.org/2001/04/xmldsig-more#rsa-sha512"
]
},
"allow_idp_initiated": {
"type": "boolean",
"description": "Allow unsolicited (IdP-initiated) responses (SAML-007); default false."
},
"idp_initiated_relay_state": {
"type": "string",
"maxLength": 1024
},
"clock_skew_seconds": {
"type": "integer",
"description": "Default 120; at most saml.max_clock_skew."
},
"assertion_lifetime_seconds": {
"type": "integer",
"description": "Default 300; 60..1800."
},
"additional_audiences": {
"type": "array",
"items": {
"type": "string"
},
"description": "Further Audience values (at most 5)."
},
"encrypt_assertions": {
"type": "boolean",
"description": "Encrypt assertions (sign, then encrypt) to the encryption certificate."
},
"data_encryption_algorithm": {
"type": "string",
"enum": [
"http://www.w3.org/2009/xmlenc11#aes256-gcm",
"http://www.w3.org/2009/xmlenc11#aes128-gcm"
],
"description": "Default aes256-gcm. AES-CBC is not offered (SAML-009)."
},
"key_transport_algorithm": {
"type": "string",
"enum": [
"http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p",
"http://www.w3.org/2009/xmlenc11#rsa-oaep"
],
"description": "Default rsa-oaep-mgf1p; xmlenc11 rsa-oaep uses SHA-256 and MGF1-SHA-256. RSA PKCS#1 v1.5 is not offered."
},
"authn_context_map": {
"type": "object",
"additionalProperties": {
"type": "string"
},
"description": "AuthnContextClassRef -> local ACR (urn:proudauth:acr:...), extending the built-in mapping (PasswordProtectedTransport, Password, unspecified = single factor; MobileTwoFactorContract, TimeSyncToken, multipleauthn, REFEDS MFA = mfa)."
},
"signing_certificates": {
"type": "array",
"items": {
"type": "string"
},
"description": "PEM or base64 DER certificates for request and logout signatures."
},
"encryption_certificate": {
"type": "string",
"description": "PEM or base64 DER RSA certificate for encrypted assertions (requires encrypt_assertions)."
}
},
"required": [
"name"
]
}SAMLConnectionSettings
{
"type": "object",
"additionalProperties": false,
"properties": {
"idp_entity_id": {
"type": "string"
},
"sso_url": {
"type": "string",
"description": "HTTP-Redirect single sign-on endpoint."
},
"sp_entity_id": {
"type": "string",
"description": "Overrides the default service provider entity ID."
},
"sign_authn_requests": {
"type": "boolean",
"description": "Sign AuthnRequests with the realm SAML key (default true)."
},
"require_signed_assertions": {
"type": "boolean",
"description": "Refuse assertions covered only by the response signature."
},
"name_id_format": {
"type": "string",
"enum": [
"urn:oasis:names:tc:SAML:2.0:nameid-format:persistent",
"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified",
"urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
]
},
"subject_attribute": {
"type": "string",
"description": "Take the stable subject from this attribute instead of the NameID (required for transient NameIDs)."
},
"email_attribute": {
"type": "string",
"description": "Email attribute (default: the NameID when its format is emailAddress)."
},
"trust_email_verified": {
"type": "boolean",
"description": "Treat the asserted email as verified (SAML has no verification flag)."
},
"trusted_authn_contexts": {
"type": "array",
"items": {
"type": "string"
},
"description": "AuthnContextClassRef values that mean MFA, used with trust_upstream_mfa (FED-009)."
},
"requested_authn_contexts": {
"type": "array",
"items": {
"type": "string"
},
"description": "Sent as RequestedAuthnContext Comparison=minimum."
},
"force_authn": {
"type": "boolean"
},
"clock_skew_seconds": {
"type": "integer",
"description": "Default 120; at most saml.max_clock_skew."
},
"signing_certificates": {
"type": "array",
"items": {
"$ref": "#/components/schemas/SAMLCertificate"
}
}
}
}SAMLServiceProvider
{
"description": "This realm's service provider side of the connection, to register with the identity provider.",
"type": "object",
"additionalProperties": false,
"properties": {
"entity_id": {
"type": "string"
},
"acs_url": {
"type": "string"
},
"metadata_url": {
"type": "string"
}
},
"required": [
"entity_id",
"acs_url",
"metadata_url"
]
}SAMLConnection
{
"type": "object",
"additionalProperties": false,
"properties": {
"id": {
"type": "string"
},
"organization_id": {
"type": "string"
},
"alias": {
"type": "string"
},
"display_name": {
"type": "string",
"maxLength": 100
},
"state": {
"type": "string",
"enum": [
"active",
"disabled"
]
},
"linking_policy": {
"type": "string",
"enum": [
"verify_existing",
"trusted_verified_email",
"create_only"
]
},
"jit_provisioning": {
"type": "boolean"
},
"jit_default_role_id": {
"type": "string"
},
"trust_upstream_mfa": {
"type": "boolean"
},
"allowed_email_domains": {
"type": "array",
"items": {
"type": "string"
}
},
"claim_mapping": {
"$ref": "#/components/schemas/ClaimMapping",
"description": "Maps SAML attribute names to profile fields (default displayName, givenName, sn)."
},
"saml": {
"$ref": "#/components/schemas/SAMLConnectionSettings"
},
"service_provider": {
"$ref": "#/components/schemas/SAMLServiceProvider"
},
"version": {
"type": "integer",
"format": "int64"
},
"created_at": {
"type": "string",
"format": "date-time"
},
"updated_at": {
"type": "string",
"format": "date-time"
}
},
"required": [
"id",
"alias",
"display_name",
"state",
"linking_policy",
"saml",
"service_provider",
"version"
]
}SAMLConnectionInput
{
"type": "object",
"additionalProperties": false,
"properties": {
"organization_id": {
"type": "string"
},
"alias": {
"type": "string"
},
"display_name": {
"type": "string",
"maxLength": 100
},
"state": {
"type": "string",
"enum": [
"active",
"disabled"
]
},
"linking_policy": {
"type": "string",
"enum": [
"verify_existing",
"trusted_verified_email",
"create_only"
]
},
"jit_provisioning": {
"type": "boolean"
},
"jit_default_role_id": {
"type": "string"
},
"trust_upstream_mfa": {
"type": "boolean"
},
"allowed_email_domains": {
"type": "array",
"items": {
"type": "string"
}
},
"claim_mapping": {
"$ref": "#/components/schemas/ClaimMapping",
"description": "Maps SAML attribute names to profile fields (default displayName, givenName, sn)."
},
"metadata_xml": {
"type": "string",
"description": "Uploaded IdP metadata (EntityDescriptor with an IDPSSODescriptor)."
},
"idp_entity_id": {
"type": "string"
},
"sso_url": {
"type": "string",
"description": "HTTP-Redirect single sign-on endpoint."
},
"sp_entity_id": {
"type": "string",
"description": "Overrides the default service provider entity ID."
},
"sign_authn_requests": {
"type": "boolean",
"description": "Sign AuthnRequests with the realm SAML key (default true)."
},
"require_signed_assertions": {
"type": "boolean",
"description": "Refuse assertions covered only by the response signature."
},
"name_id_format": {
"type": "string",
"enum": [
"urn:oasis:names:tc:SAML:2.0:nameid-format:persistent",
"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified",
"urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
]
},
"subject_attribute": {
"type": "string",
"description": "Take the stable subject from this attribute instead of the NameID (required for transient NameIDs)."
},
"email_attribute": {
"type": "string",
"description": "Email attribute (default: the NameID when its format is emailAddress)."
},
"trust_email_verified": {
"type": "boolean",
"description": "Treat the asserted email as verified (SAML has no verification flag)."
},
"trusted_authn_contexts": {
"type": "array",
"items": {
"type": "string"
},
"description": "AuthnContextClassRef values that mean MFA, used with trust_upstream_mfa (FED-009)."
},
"requested_authn_contexts": {
"type": "array",
"items": {
"type": "string"
},
"description": "Sent as RequestedAuthnContext Comparison=minimum."
},
"force_authn": {
"type": "boolean"
},
"clock_skew_seconds": {
"type": "integer",
"description": "Default 120; at most saml.max_clock_skew."
},
"signing_certificates": {
"type": "array",
"items": {
"type": "string"
},
"description": "Trusted PEM or base64 DER certificates (at most 4; list two to overlap a rollover)."
}
},
"required": [
"alias",
"display_name"
]
}SAMLSigningKey
{
"type": "object",
"additionalProperties": false,
"properties": {
"id": {
"type": "string"
},
"state": {
"type": "string",
"enum": [
"pending",
"active",
"retiring",
"retired"
]
},
"published": {
"type": "boolean",
"description": "Listed in metadata now."
},
"certificate": {
"$ref": "#/components/schemas/SAMLCertificate"
},
"created_at": {
"type": "string",
"format": "date-time"
},
"activated_at": {
"type": "string",
"format": "date-time"
},
"retiring_at": {
"type": "string",
"format": "date-time"
},
"publish_until": {
"type": "string",
"format": "date-time"
}
},
"required": [
"id",
"state",
"published",
"certificate",
"created_at"
]
}LDAPConnectorConfig
{
"type": "object",
"additionalProperties": false,
"description": "LDAP/Active Directory connector configuration (PROV-011). Defaults follow the dialect. Never contains the bind password.",
"properties": {
"endpoints": {
"type": "array",
"minItems": 1,
"maxItems": 8,
"items": {
"type": "string"
},
"description": "ldaps://host[:port] or ldap://host[:port] URLs, tried in order; the next one is used only after a transport failure (connect, TLS, timeout, server busy/unavailable), never after an answer such as invalid credentials. Referrals are never followed (PROV-014)."
},
"start_tls": {
"type": "boolean",
"default": true,
"description": "Upgrade ldap:// endpoints with StartTLS before any credential is sent; false only in development mode."
},
"ca_certificates_pem": {
"type": "string",
"maxLength": 65536,
"description": "Additional trusted roots for this connector (PEM). Server certificates are always verified, including the host name."
},
"connect_timeout_seconds": {
"type": "integer",
"minimum": 0,
"maximum": 60,
"description": "0: directory.connect_timeout."
},
"operation_timeout_seconds": {
"type": "integer",
"minimum": 0,
"maximum": 120,
"description": "0: directory.operation_timeout."
},
"bind_dn": {
"type": "string",
"description": "Service account DN."
},
"dialect": {
"type": "string",
"enum": [
"openldap",
"active_directory"
],
"default": "openldap"
},
"user_base_dn": {
"type": "string"
},
"user_scope": {
"type": "string",
"enum": [
"sub",
"one"
],
"default": "sub"
},
"user_filter": {
"type": "string",
"description": "RFC 4515 filter; default (objectClass=inetOrgPerson) or, for Active Directory, (&(objectCategory=person)(objectClass=user))."
},
"id_attribute": {
"type": "string",
"description": "Immutable entry identifier: entryUUID (default) or objectGUID (Active Directory)."
},
"login_attributes": {
"type": "array",
"maxItems": 4,
"items": {
"type": "string"
},
"description": "Attributes a sign-in identifier is matched against for first sign-in provisioning; the identifier is escaped (RFC 4515)."
},
"attribute_mapping": {
"type": "object",
"additionalProperties": {
"type": "string"
},
"description": "Local attribute (username, email, display_name, given_name, family_name, locale, zoneinfo, profile.<name>) to directory attribute."
},
"mode": {
"type": "string",
"enum": [
"read_only",
"import_only",
"write_back"
],
"default": "read_only",
"description": "read_only: the directory owns the mapped attributes (local edits refused); import_only: attributes are imported at creation and locally owned afterwards (differences reported as divergence); write_back: write_back_attributes are editable and written to the directory first. The directory always owns the password and the account lifecycle (PROV-013)."
},
"attribute_authority": {
"type": "object",
"additionalProperties": {
"type": "string",
"enum": [
"directory",
"local"
]
},
"description": "Per-attribute override of the mode's authority."
},
"write_back_attributes": {
"type": "array",
"items": {
"type": "string"
},
"description": "write_back mode only; never username, email or the password."
},
"disabled_attribute": {
"type": "string",
"description": "Marks disabled entries outside Active Directory (whose userAccountControl is always honored)."
},
"disabled_values": {
"type": "array",
"items": {
"type": "string"
}
},
"change_tracking": {
"type": "string",
"enum": [
"usn",
"modify_timestamp",
"none"
],
"description": "Incremental cursor: Active Directory uSNChanged (bound to the domain controller; another controller forces a full run), modifyTimestamp (re-reads a 5-minute overlap), or none."
},
"page_size": {
"type": "integer",
"minimum": 1,
"maximum": 5000,
"default": 500,
"description": "Simple paged results (RFC 2696) page size."
},
"max_entries": {
"type": "integer",
"minimum": 0,
"maximum": 1000000,
"description": "0: directory.max_entries_per_run."
},
"group_base_dn": {
"type": "string"
},
"group_filter": {
"type": "string"
},
"group_name_attribute": {
"type": "string"
},
"group_member_attribute": {
"type": "string",
"enum": [
"member",
"uniqueMember",
"memberUid"
]
},
"jit_provisioning": {
"type": "boolean",
"default": false,
"description": "Import an account at its first successful sign-in (FED-015)."
},
"incremental_interval_seconds": {
"type": "integer",
"description": "0 or 60..604800: scheduled incremental runs."
},
"full_interval_seconds": {
"type": "integer",
"description": "0 or 300..2592000: scheduled full runs (deletion detection)."
},
"deletion_threshold_percent": {
"type": "integer",
"minimum": 1,
"maximum": 100,
"default": 20,
"description": "A full run refuses to deprovision more than this share of linked accounts without allow_mass_deprovision."
},
"deletion_threshold_count": {
"type": "integer",
"minimum": 0,
"description": "Optional absolute cap on deprovisioning per run (0: none)."
},
"deprovision_action": {
"type": "string",
"enum": [
"suspend_account",
"remove_membership",
"suspend_membership",
"report_only"
],
"description": "Realm connectors: suspend_account (default) or report_only — accounts are never deleted. Organization connectors: remove_membership (default), suspend_membership or report_only — only the organization's access changes (PROV-005)."
}
},
"required": [
"endpoints",
"bind_dn",
"user_base_dn"
]
}OutboundConnectorConfig
{
"type": "object",
"additionalProperties": false,
"description": "Outbound SCIM 2.0 connector configuration (PROV-010). Never contains the bearer token.",
"properties": {
"base_url": {
"type": "string",
"description": "SCIM base URL (https outside development); checked against the egress policy at configuration and on every connection."
},
"allow_private_network": {
"type": "boolean",
"default": false,
"description": "Allow a private destination where the operator policy (delivery.allow_private_webhooks or delivery.egress_allowlist) permits it."
},
"timeout_seconds": {
"type": "integer",
"minimum": 1,
"maximum": 60,
"default": 10
},
"max_attempts": {
"type": "integer",
"minimum": 1,
"maximum": 20,
"default": 8,
"description": "Attempts before a delivery is dead-lettered; retries back off exponentially with jitter and honor Retry-After."
},
"eligible_organization_ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Realm connectors: push accounts with an active membership in one of these organizations (every non-guest account when empty)."
},
"eligible_group_ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Organization connectors: push only members of one of these groups."
},
"exclude_created_via": {
"type": "array",
"items": {
"type": "string"
},
"description": "Skip accounts by provenance (for example scim:<connector> for accounts an inbound connector created from the same system), preventing loops (PROV-017)."
},
"attribute_mapping": {
"type": "object",
"additionalProperties": {
"type": "string"
},
"description": "SCIM attribute (userName, displayName, name.givenName, name.familyName, emails, locale, timezone, title) to local source (username, email, display_name, given_name, family_name, locale, zoneinfo, user_id, profile.<name>). externalId is always the local account ID. Only verified emails are pushed."
},
"deprovision_action": {
"type": "string",
"enum": [
"deactivate",
"delete"
],
"default": "deactivate"
},
"push_group_ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Organization groups pushed with the downstream IDs of their members."
},
"reconcile_interval_seconds": {
"type": "integer",
"description": "0 or 300..2592000: scheduled reconciliation runs."
}
},
"required": [
"base_url"
]
}DirectoryConnectorInput
{
"type": "object",
"additionalProperties": false,
"properties": {
"name": {
"type": "string",
"minLength": 1,
"maxLength": 100
},
"kind": {
"type": "string",
"enum": [
"ldap",
"scim_outbound"
]
},
"organization_id": {
"type": "string",
"description": "Realm API only: bind the connector to an organization."
},
"config": {
"oneOf": [
{
"$ref": "#/components/schemas/LDAPConnectorConfig"
},
{
"$ref": "#/components/schemas/OutboundConnectorConfig"
}
],
"description": "Kind-specific configuration."
},
"role_ceiling_ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Organization connectors: roles the connector may ever grant, within the creator's own ceiling."
},
"group_role_mappings": {
"type": "object",
"additionalProperties": {
"type": "array",
"items": {
"type": "string"
}
},
"description": "Approved mappings from directory group names or DNs to role IDs within the ceiling."
},
"default_role_id": {
"type": "string"
},
"credential": {
"type": "string",
"maxLength": 4096,
"x-secret": true,
"description": "Write-only: bind password (ldap) or downstream bearer token (scim_outbound). Stored encrypted; never returned."
}
},
"required": [
"name",
"kind",
"config",
"credential"
]
}DirectoryConnectorUpdate
{
"type": "object",
"additionalProperties": false,
"properties": {
"name": {
"type": "string",
"minLength": 1,
"maxLength": 100
},
"kind": {
"type": "string",
"description": "Fixed after creation; must match when sent."
},
"organization_id": {
"type": "string",
"description": "Fixed after creation; must match when sent."
},
"config": {
"oneOf": [
{
"$ref": "#/components/schemas/LDAPConnectorConfig"
},
{
"$ref": "#/components/schemas/OutboundConnectorConfig"
}
]
},
"role_ceiling_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"group_role_mappings": {
"type": "object",
"additionalProperties": {
"type": "array",
"items": {
"type": "string"
}
}
},
"default_role_id": {
"type": "string"
},
"credential": {
"type": "string",
"description": "Not accepted here; use PUT .../credential."
},
"state": {
"type": "string",
"enum": [
"active",
"disabled"
]
}
},
"required": [
"name",
"config"
]
}DirectoryConnector
{
"type": "object",
"properties": {
"id": {
"type": "string"
},
"organization_id": {
"type": "string",
"description": "Absent for realm-wide (workforce) connectors."
},
"name": {
"type": "string"
},
"kind": {
"type": "string",
"enum": [
"ldap",
"scim_outbound"
]
},
"state": {
"type": "string",
"enum": [
"active",
"disabled"
]
},
"config": {
"oneOf": [
{
"$ref": "#/components/schemas/LDAPConnectorConfig"
},
{
"$ref": "#/components/schemas/OutboundConnectorConfig"
}
]
},
"role_ceiling_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"group_role_mappings": {
"type": "object",
"additionalProperties": {
"type": "array",
"items": {
"type": "string"
}
}
},
"default_role_id": {
"type": "string"
},
"credential_set": {
"type": "boolean"
},
"credential_set_at": {
"type": "string",
"format": "date-time"
},
"last_sync_at": {
"type": "string",
"format": "date-time"
},
"last_success_at": {
"type": "string",
"format": "date-time"
},
"last_error": {
"type": "string"
},
"consecutive_failures": {
"type": "integer"
},
"version": {
"type": "integer"
},
"created_at": {
"type": "string",
"format": "date-time"
},
"updated_at": {
"type": "string",
"format": "date-time"
}
},
"required": [
"id",
"name",
"kind",
"state",
"config",
"credential_set",
"version"
]
}DirectoryRunRequest
{
"type": "object",
"additionalProperties": false,
"properties": {
"mode": {
"type": "string",
"enum": [
"full",
"incremental",
"reconcile"
],
"description": "Directories: incremental (default; promoted to full without a usable cursor) or full (also detects deletions). Outbound connectors: reconcile."
},
"dry_run": {
"type": "boolean",
"default": false
},
"allow_mass_deprovision": {
"type": "boolean",
"default": false
},
"reason": {
"type": "string",
"maxLength": 500,
"description": "Required (10+ characters) with allow_mass_deprovision."
}
}
}DirectoryRun
{
"type": "object",
"properties": {
"id": {
"type": "string"
},
"connector_id": {
"type": "string"
},
"organization_id": {
"type": "string"
},
"job_id": {
"type": "string"
},
"mode": {
"type": "string",
"enum": [
"full",
"incremental",
"reconcile"
]
},
"dry_run": {
"type": "boolean"
},
"trigger": {
"type": "string",
"enum": [
"manual",
"schedule",
"login"
]
},
"state": {
"type": "string",
"enum": [
"queued",
"running",
"succeeded",
"failed",
"refused",
"cancelled"
],
"description": "refused: the deletion threshold stopped deprovisioning; other changes of the run were applied."
},
"allow_mass_deprovision": {
"type": "boolean"
},
"requested_by_type": {
"type": "string"
},
"requested_by_id": {
"type": "string"
},
"reason": {
"type": "string"
},
"cursor_before": {
"type": "string"
},
"cursor_after": {
"type": "string"
},
"endpoint": {
"type": "string",
"description": "Host of the endpoint that served the run."
},
"counts": {
"type": "object",
"additionalProperties": {
"type": "integer"
},
"description": "Totals per finding kind plus entries_seen, linked_accounts, deprovision_refused, incremental_promoted_to_full, findings_truncated, candidates."
},
"error": {
"type": "string"
},
"created_at": {
"type": "string",
"format": "date-time"
},
"started_at": {
"type": "string",
"format": "date-time"
},
"finished_at": {
"type": "string",
"format": "date-time"
}
},
"required": [
"id",
"connector_id",
"mode",
"dry_run",
"state",
"counts"
]
}DirectoryFinding
{
"type": "object",
"properties": {
"seq": {
"type": "integer"
},
"kind": {
"type": "string"
},
"reason": {
"type": "string"
},
"external_id": {
"type": "string"
},
"source_dn": {
"type": "string"
},
"local_id": {
"type": "string"
},
"attributes": {
"type": "array",
"items": {
"type": "string"
},
"description": "Attribute names only, never values."
},
"applied": {
"type": "boolean"
},
"detail": {
"type": "object",
"additionalProperties": true
}
},
"required": [
"seq",
"kind",
"attributes",
"applied"
]
}DirectoryEndpointHealth
{
"type": "object",
"properties": {
"last_ok_at": {
"type": "string",
"format": "date-time"
},
"last_failure_at": {
"type": "string",
"format": "date-time"
},
"last_failure_category": {
"type": "string",
"description": "connect, dns, tls, timeout, network, server_unavailable, egress_denied or service_bind_failed."
},
"consecutive_failures": {
"type": "integer"
}
}
}DirectoryHealth
{
"type": "object",
"properties": {
"connector_id": {
"type": "string"
},
"kind": {
"type": "string"
},
"state": {
"type": "string"
},
"status": {
"type": "string",
"enum": [
"healthy",
"degraded",
"disabled",
"needs_configuration",
"needs_credential"
]
},
"configuration_error": {
"type": "string",
"description": "Why an outbound connector cannot deliver (status needs_configuration), for example a legacy scim_outbound row without base_url."
},
"credential_set_at": {
"type": "string",
"format": "date-time"
},
"last_sync_at": {
"type": "string",
"format": "date-time"
},
"last_success_at": {
"type": "string",
"format": "date-time"
},
"lag_seconds": {
"type": "integer"
},
"consecutive_failures": {
"type": "integer"
},
"last_error": {
"type": "string"
},
"endpoints": {
"type": "object",
"additionalProperties": {
"$ref": "#/components/schemas/DirectoryEndpointHealth"
},
"description": "Keyed by host:port."
},
"last_run": {
"$ref": "#/components/schemas/DirectoryRun"
},
"managed_accounts": {
"type": "object",
"additionalProperties": {
"type": "integer"
},
"description": "Linked accounts by source state (active, disabled, missing, deleted for erased accounts; deactivated for outbound)."
},
"managed_groups": {
"type": "integer"
},
"deliveries": {
"type": "object",
"additionalProperties": {
"type": "integer"
},
"description": "Outbound deliveries by state."
},
"oldest_due_seconds": {
"type": "integer"
},
"last_delivered_at": {
"type": "string",
"format": "date-time"
},
"operator_actions": {
"type": "array",
"items": {
"type": "object",
"properties": {
"action": {
"type": "string"
},
"actor_type": {
"type": "string"
},
"actor_id": {
"type": "string"
},
"at": {
"type": "string",
"format": "date-time"
}
}
},
"description": "The latest 20 operator actions."
}
},
"required": [
"connector_id",
"status",
"operator_actions"
]
}DirectoryTestResult
{
"type": "object",
"properties": {
"ok": {
"type": "boolean"
},
"endpoint": {
"type": "string"
},
"error": {
"type": "string"
},
"details": {
"type": "object",
"additionalProperties": true
},
"checked_at": {
"type": "string",
"format": "date-time"
}
},
"required": [
"ok",
"checked_at"
]
}OutboundDelivery
{
"type": "object",
"properties": {
"id": {
"type": "string"
},
"resource_type": {
"type": "string",
"enum": [
"User",
"Group"
]
},
"local_id": {
"type": "string"
},
"trigger": {
"type": "string"
},
"state": {
"type": "string",
"enum": [
"pending",
"retrying",
"delivered",
"dead_letter",
"replayed"
]
},
"attempts": {
"type": "integer"
},
"operation": {
"type": "string",
"enum": [
"create",
"update",
"deactivate",
"delete",
"noop",
"read"
]
},
"last_status_code": {
"type": "integer"
},
"last_error_category": {
"type": "string",
"description": "network_error, egress_denied, server_error, throttled, unauthorized, rejected, conflict, invalid_response, credential_unavailable or local_error."
},
"next_attempt_at": {
"type": "string",
"format": "date-time"
},
"delivered_at": {
"type": "string",
"format": "date-time"
},
"created_at": {
"type": "string",
"format": "date-time"
},
"updated_at": {
"type": "string",
"format": "date-time"
}
},
"required": [
"id",
"resource_type",
"local_id",
"state",
"attempts"
]
}AttributeAuthority
{
"type": "object",
"properties": {
"source": {
"oneOf": [
{
"type": "null"
},
{
"type": "object",
"properties": {
"type": {
"type": "string",
"enum": [
"directory"
]
},
"connector_id": {
"type": "string"
},
"name": {
"type": "string"
},
"organization_id": {
"type": "string"
},
"mode": {
"type": "string"
},
"state": {
"type": "string",
"description": "The linked entry's state: active, disabled or missing."
}
}
}
]
},
"attributes": {
"type": "object",
"additionalProperties": {
"type": "string",
"enum": [
"local",
"externally_managed",
"write_back"
]
}
},
"operations": {
"type": "object",
"additionalProperties": {
"type": "string",
"enum": [
"local",
"externally_managed",
"write_back"
]
},
"description": "password_change, password_reset and reactivation."
}
},
"required": [
"source",
"attributes",
"operations"
]
}TrustedAuthenticator
{
"type": "object",
"required": [
"id",
"aaguid",
"description",
"root_certificates",
"created_at"
],
"properties": {
"id": {
"type": "string"
},
"aaguid": {
"type": "string"
},
"description": {
"type": "string"
},
"root_certificates": {
"type": "array",
"items": {
"type": "string"
}
},
"created_at": {
"type": "string",
"format": "date-time"
}
}
}FederationTransfer
{
"type": "object",
"required": [
"id",
"source_provider_id",
"target_provider_id",
"mode",
"state",
"reason",
"summary",
"created_by_id",
"created_at",
"version"
],
"properties": {
"id": {
"type": "string"
},
"source_provider_id": {
"type": "string"
},
"target_provider_id": {
"type": "string"
},
"mode": {
"type": "string",
"enum": [
"map",
"same_subject"
]
},
"target_tenant": {
"type": "string"
},
"state": {
"type": "string",
"enum": [
"draft",
"approved",
"applied",
"cancelled"
]
},
"reason": {
"type": "string"
},
"summary": {
"type": "object",
"description": "Entry count by outcome, plus total.",
"additionalProperties": {
"type": "integer"
}
},
"created_by_id": {
"type": "string"
},
"approved_by_id": {
"type": "string"
},
"applied_by_id": {
"type": "string"
},
"created_at": {
"type": "string",
"format": "date-time"
},
"approved_at": {
"type": "string",
"format": "date-time"
},
"applied_at": {
"type": "string",
"format": "date-time"
},
"version": {
"type": "integer"
}
}
}FederationTransferEntry
{
"type": "object",
"required": [
"seq",
"source_subject",
"target_subject",
"outcome"
],
"properties": {
"seq": {
"type": "integer"
},
"source_subject": {
"type": "string"
},
"source_issuer": {
"type": "string"
},
"target_subject": {
"type": "string"
},
"target_tenant": {
"type": "string"
},
"user_id": {
"type": "string"
},
"outcome": {
"type": "string",
"enum": [
"pending",
"ready",
"already_linked",
"missing_source",
"ambiguous_source",
"duplicate_source",
"duplicate_target",
"collision_target",
"collision_user",
"target_tenant_required",
"applied"
]
},
"detail": {
"type": "string"
}
}
}MigrationAdapter
{
"additionalProperties": false,
"properties": {
"source": {
"type": "string",
"enum": [
"keycloak",
"zitadel",
"supertokens"
]
},
"product": {
"type": "string"
},
"supported_versions": {
"type": "string",
"examples": [
"26.x"
]
},
"tested_versions": {
"type": "array",
"items": {
"type": "string"
}
},
"export_format": {
"type": "string"
},
"export_command": {
"type": "string"
},
"converts": {
"type": "array",
"items": {
"type": "string"
}
},
"converts_with_loss": {
"type": "array",
"items": {
"type": "string"
}
},
"unsupported": {
"type": "array",
"items": {
"type": "string"
}
}
},
"required": [
"source",
"product",
"supported_versions",
"tested_versions",
"export_format",
"export_command",
"converts",
"converts_with_loss",
"unsupported"
],
"type": "object"
}MigrationMapping
{
"description": "proudauth.migration-mapping.v1: the reviewed translation (MIG-005). organizations maps a source organization key (Keycloak org:<alias> or group:<path>, ZITADEL org:<id>, SuperTokens tenant:<id>) to the organization it becomes, or null to exclude it. roles maps a source role key (Keycloak realm-role:<name>, client-role:<client>:<role>, group:<path>; ZITADEL org-member:<ROLE>, project-member:<project id>:<ROLE>, project-role:<project id>:<key>; SuperTokens role:<name>) to realm-wide organization roles; an unlisted key is reported unsupported and grants nothing.",
"additionalProperties": false,
"properties": {
"format": {
"type": "string",
"enum": [
"proudauth.migration-mapping.v1"
]
},
"organizations": {
"type": "object",
"additionalProperties": {
"type": [
"object",
"null"
],
"additionalProperties": false,
"properties": {
"slug": {
"type": "string",
"pattern": "^[a-z0-9][a-z0-9-]{0,61}[a-z0-9]$"
},
"display_name": {
"type": "string"
},
"note": {
"type": "string"
}
},
"required": [
"slug"
]
}
},
"membership_roles": {
"type": "array",
"items": {
"type": "string"
}
},
"roles": {
"type": "object",
"additionalProperties": {
"type": [
"object",
"null"
],
"additionalProperties": false,
"properties": {
"organization": {
"type": "string",
"description": "Target organization slug; without it the roles apply in the source grant's own scope."
},
"roles": {
"type": "array",
"items": {
"type": "string"
}
},
"note": {
"type": "string"
}
},
"required": [
"roles"
]
}
}
},
"type": "object"
}MigrationEntityReport
{
"additionalProperties": false,
"properties": {
"total": {
"type": "integer"
},
"converted": {
"type": "integer"
},
"converted_with_loss": {
"type": "integer"
},
"unsupported": {
"type": "integer"
},
"ignored": {
"type": "integer"
},
"reasons": {
"type": "array",
"items": {
"type": "object",
"additionalProperties": false,
"properties": {
"outcome": {
"type": "string",
"enum": [
"converted_with_loss",
"unsupported",
"ignored"
]
},
"reason": {
"type": "string"
},
"count": {
"type": "integer"
}
},
"required": [
"outcome",
"reason",
"count"
]
}
}
},
"required": [
"total",
"converted",
"converted_with_loss",
"unsupported",
"ignored"
],
"type": "object"
}MigrationReport
{
"description": "proudauth.migration-report.v1, the capability report of one conversion (MIG-018). Records are named by source ID only.",
"additionalProperties": false,
"properties": {
"format": {
"type": "string",
"enum": [
"proudauth.migration-report.v1"
]
},
"generated_at": {
"type": "string",
"format": "date-time"
},
"source": {
"type": "object",
"additionalProperties": false,
"properties": {
"product": {
"type": "string"
},
"source": {
"type": "string"
},
"version": {
"type": "string"
},
"tested_versions": {
"type": "array",
"items": {
"type": "string"
}
},
"realm": {
"type": "string"
}
},
"required": [
"product",
"source",
"version",
"tested_versions"
]
},
"source_system": {
"type": "string"
},
"options": {
"type": "object",
"additionalProperties": false,
"properties": {
"import_totp": {
"type": "boolean"
},
"keep_attributes": {
"type": "boolean"
},
"mapping_given": {
"type": "boolean"
}
},
"required": [
"import_totp",
"keep_attributes",
"mapping_given"
]
},
"summary": {
"type": "object",
"additionalProperties": false,
"properties": {
"users": {
"type": "integer"
},
"users_to_import": {
"type": "integer"
},
"passwords_migrated": {
"type": "integer"
},
"password_resets_required": {
"type": "integer"
},
"totp_migrated": {
"type": "integer"
},
"mfa_reenrollments_required": {
"type": "integer"
},
"suspended_accounts": {
"type": "integer"
},
"organizations": {
"type": "integer"
},
"memberships": {
"type": "integer"
},
"role_assignments": {
"type": "integer"
},
"untranslated_role_grants": {
"type": "integer"
}
},
"required": [
"users",
"users_to_import",
"passwords_migrated",
"password_resets_required",
"totp_migrated",
"mfa_reenrollments_required",
"suspended_accounts",
"organizations",
"memberships",
"role_assignments",
"untranslated_role_grants"
]
},
"entities": {
"type": "object",
"description": "Per entity type (users, service_accounts, organizations, groups, tenants, memberships, role_assignments, role_definitions, password_credentials, totp_factors, webauthn_credentials, recovery_codes, other_credentials, federated_identities, phone_numbers, attributes, required_actions, clients, identity_providers, authentication_flows, realm_policies, user_federation, client_scopes, projects, project_grants, actions, keys, other_configuration, sessions).",
"additionalProperties": {
"$ref": "#/components/schemas/MigrationEntityReport"
}
},
"mapping": {
"type": "object",
"additionalProperties": false,
"properties": {
"organizations": {
"type": "array",
"items": {
"type": "object",
"additionalProperties": false,
"properties": {
"key": {
"type": "string"
},
"name": {
"type": "string"
},
"status": {
"type": "string",
"enum": [
"auto",
"mapped",
"excluded",
"not_an_organization"
]
},
"slug": {
"type": "string"
},
"members": {
"type": "integer"
}
},
"required": [
"key",
"name",
"status",
"members"
]
}
},
"roles": {
"type": "array",
"items": {
"type": "object",
"additionalProperties": false,
"properties": {
"key": {
"type": "string"
},
"note": {
"type": "string"
},
"grants": {
"type": "integer"
},
"status": {
"type": "string",
"enum": [
"mapped",
"no_roles",
"untranslated",
"ignored"
]
},
"organization": {
"type": "string"
},
"roles": {
"type": "array",
"items": {
"type": "string"
}
}
},
"required": [
"key",
"grants",
"status"
]
}
},
"unknown_keys": {
"type": "array",
"items": {
"type": "string"
}
}
},
"required": [
"organizations",
"roles"
]
},
"items": {
"type": "array",
"description": "Every source item that was not simply converted, with its reasons.",
"items": {
"type": "object",
"additionalProperties": false,
"properties": {
"entity": {
"type": "string"
},
"source_id": {
"type": "string"
},
"outcome": {
"type": "string",
"enum": [
"converted_with_loss",
"unsupported",
"ignored"
]
},
"reasons": {
"type": "array",
"items": {
"type": "string"
}
}
},
"required": [
"entity",
"source_id",
"outcome",
"reasons"
]
}
},
"notes": {
"type": "array",
"items": {
"type": "string"
}
},
"import": {
"type": "object",
"description": "Filled by identity-cli migrate-from after a dry run or an import.",
"additionalProperties": false,
"properties": {
"dry_run": {
"type": "boolean"
},
"jobs": {
"type": "array",
"items": {
"type": "string"
}
},
"counts": {
"type": "object",
"additionalProperties": {
"type": "integer"
}
},
"totals": {
"type": "object",
"additionalProperties": {
"type": "integer"
}
},
"organizations": {
"type": "array",
"items": {
"type": "object",
"additionalProperties": false,
"properties": {
"slug": {
"type": "string"
},
"id": {
"type": "string"
},
"status": {
"type": "string",
"enum": [
"exists",
"created",
"will_create",
"conflict"
]
},
"detail": {
"type": "string"
}
},
"required": [
"slug",
"status"
]
}
},
"records": {
"type": "array",
"items": {
"type": "object",
"additionalProperties": false,
"properties": {
"source_id": {
"type": "string"
},
"status": {
"type": "string"
},
"user_id": {
"type": "string"
},
"error": {
"type": "string"
}
},
"required": [
"source_id",
"status"
]
}
},
"reconciliation": {
"type": "object",
"additionalProperties": true
}
},
"required": [
"dry_run",
"jobs",
"counts",
"totals",
"organizations"
]
}
},
"required": [
"format",
"generated_at",
"source",
"source_system",
"options",
"summary",
"entities",
"mapping",
"items"
],
"type": "object"
}OrganizationRelationship
{
"type": "object",
"required": [
"id",
"kind",
"source_organization_id",
"target_organization_id",
"state",
"created_by",
"created_at"
],
"properties": {
"id": {
"type": "string"
},
"kind": {
"type": "string",
"enum": [
"parent_child",
"partner"
]
},
"source_organization_id": {
"type": "string",
"description": "The parent, or the proposing partner."
},
"target_organization_id": {
"type": "string"
},
"state": {
"type": "string",
"enum": [
"proposed",
"active",
"declined",
"ended"
]
},
"note": {
"type": "string"
},
"created_by": {
"type": "object"
},
"decided_by_id": {
"type": "string"
},
"created_at": {
"type": "string",
"format": "date-time"
},
"decided_at": {
"type": "string",
"format": "date-time"
},
"ended_at": {
"type": "string",
"format": "date-time"
}
}
}ProjectRoleAssignment
{
"type": "object",
"required": [
"id",
"project_id",
"role_id",
"user_id",
"created_at"
],
"properties": {
"id": {
"type": "string"
},
"project_id": {
"type": "string"
},
"role_id": {
"type": "string"
},
"user_id": {
"type": "string"
},
"project_grant_id": {
"type": "string"
},
"expires_at": {
"type": "string",
"format": "date-time"
},
"created_at": {
"type": "string",
"format": "date-time"
}
}
}WorkflowDefinition
{
"type": "object",
"description": "Lifecycle workflow definition, schema_version 1. The authoritative schema is api/workflows/definition.v1.json (bounded step vocabulary: wait, approval, assign_role, add_to_group, remove_access, notify, call_webhook, suspend_user, end).",
"required": [
"schema_version",
"triggers",
"steps"
],
"properties": {
"schema_version": {
"type": "integer",
"enum": [
1
]
},
"triggers": {
"type": "array",
"minItems": 1,
"maxItems": 5,
"items": {
"type": "object"
}
},
"steps": {
"type": "array",
"minItems": 1,
"maxItems": 20,
"items": {
"type": "object"
}
},
"retry": {
"type": "object",
"properties": {
"max_attempts": {
"type": "integer",
"minimum": 1,
"maximum": 10
},
"backoff": {
"type": "string"
}
}
}
}
}WorkflowCreate
{
"type": "object",
"additionalProperties": false,
"required": [
"name",
"definition"
],
"properties": {
"name": {
"type": "string",
"maxLength": 100
},
"description": {
"type": "string",
"maxLength": 500
},
"definition": {
"$ref": "#/components/schemas/WorkflowDefinition"
},
"note": {
"type": "string",
"maxLength": 500
},
"requires_approval": {
"type": "boolean",
"description": "Require a second administrator's approval of each revision; forced on by the realm policy extensions.workflow_publish_approval."
},
"owner_user_id": {
"type": "string",
"description": "Accountable owner (DOM-009); defaults to the creating user."
}
}
}Workflow
{
"type": "object",
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
},
"description": {
"type": "string"
},
"state": {
"type": "string",
"enum": [
"draft",
"active",
"disabled"
]
},
"active_revision": {
"type": "integer"
},
"published_by_id": {
"type": "string",
"description": "Publisher of the active revision: accountable actor of every run."
},
"requires_approval": {
"type": "boolean"
},
"owner_user_id": {
"type": "string"
},
"plugin_id": {
"type": "string",
"description": "Set when a plugin manages the workflow."
},
"event_types": {
"type": "array",
"items": {
"type": "string"
}
},
"next_fire_at": {
"type": "string",
"format": "date-time"
},
"version": {
"type": "integer"
},
"created_at": {
"type": "string",
"format": "date-time"
},
"updated_at": {
"type": "string",
"format": "date-time"
}
},
"required": [
"id",
"name",
"state",
"requires_approval",
"event_types",
"version",
"created_at",
"updated_at"
]
}WorkflowRevision
{
"type": "object",
"properties": {
"id": {
"type": "string"
},
"workflow_id": {
"type": "string"
},
"number": {
"type": "integer"
},
"schema_version": {
"type": "integer"
},
"definition": {
"$ref": "#/components/schemas/WorkflowDefinition"
},
"definition_hash": {
"type": "string"
},
"status": {
"type": "string",
"enum": [
"draft",
"approved",
"published",
"superseded",
"rejected"
]
},
"author_id": {
"type": "string"
},
"approved_by_id": {
"type": "string"
},
"approved_at": {
"type": "string",
"format": "date-time"
},
"published_by_id": {
"type": "string"
},
"published_at": {
"type": "string",
"format": "date-time"
},
"note": {
"type": "string"
},
"created_at": {
"type": "string",
"format": "date-time"
}
},
"required": [
"id",
"workflow_id",
"number",
"schema_version",
"definition",
"definition_hash",
"status",
"author_id",
"created_at"
]
}WorkflowRunStart
{
"type": "object",
"additionalProperties": false,
"required": [
"subject_id"
],
"properties": {
"subject_id": {
"type": "string"
},
"organization_id": {
"type": "string",
"description": "Organization for organization-scoped steps."
}
}
}WorkflowStepAttempt
{
"type": "object",
"description": "One attempt of one step (EXT-016).",
"properties": {
"id": {
"type": "string"
},
"step_index": {
"type": "integer"
},
"step_id": {
"type": "string"
},
"step_type": {
"type": "string"
},
"attempt": {
"type": "integer"
},
"idempotency_key": {
"type": "string",
"description": "Stable for every attempt of the step; sent to endpoints as Idempotency-Key."
},
"state": {
"type": "string",
"enum": [
"started",
"succeeded",
"failed"
]
},
"input": {
"type": "object"
},
"input_version": {
"type": "string",
"description": "Revision, definition hash and trigger contract version the attempt ran with."
},
"result": {
"type": "object"
},
"error_category": {
"type": "string"
},
"error": {
"type": "string"
},
"max_attempts": {
"type": "integer"
},
"backoff_ms": {
"type": "integer"
},
"compensation": {
"type": "string",
"enum": [
"none",
"undo",
"notify_endpoint",
"impossible"
]
},
"compensation_state": {
"type": "string",
"enum": [
"pending",
"done",
"not_needed",
"impossible",
"failed"
]
},
"compensation_attempts": {
"type": "integer"
},
"compensation_result": {
"type": "object"
},
"started_at": {
"type": "string",
"format": "date-time"
},
"finished_at": {
"type": "string",
"format": "date-time"
},
"compensated_at": {
"type": "string",
"format": "date-time"
}
},
"required": [
"id",
"step_index",
"step_id",
"step_type",
"attempt",
"idempotency_key",
"state",
"input_version",
"max_attempts",
"backoff_ms",
"compensation",
"started_at"
]
}WorkflowApproval
{
"type": "object",
"properties": {
"id": {
"type": "string"
},
"run_id": {
"type": "string"
},
"workflow_id": {
"type": "string"
},
"step_index": {
"type": "integer"
},
"subject_id": {
"type": "string"
},
"approver_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"state": {
"type": "string",
"enum": [
"pending",
"approved",
"rejected",
"expired",
"cancelled"
]
},
"decided_by_id": {
"type": "string"
},
"decided_at": {
"type": "string",
"format": "date-time"
},
"comment": {
"type": "string"
},
"expires_at": {
"type": "string",
"format": "date-time"
},
"created_at": {
"type": "string",
"format": "date-time"
}
},
"required": [
"id",
"run_id",
"workflow_id",
"step_index",
"subject_id",
"approver_ids",
"state",
"expires_at",
"created_at"
]
}WorkflowRun
{
"type": "object",
"properties": {
"id": {
"type": "string"
},
"workflow_id": {
"type": "string"
},
"organization_id": {
"type": "string"
},
"revision": {
"type": "integer"
},
"definition_hash": {
"type": "string"
},
"schema_version": {
"type": "integer"
},
"trigger_type": {
"type": "string",
"enum": [
"event",
"schedule",
"manual"
]
},
"trigger_event_type": {
"type": "string"
},
"subject_type": {
"type": "string"
},
"subject_id": {
"type": "string"
},
"input": {
"type": "object",
"description": "Identifiers-only snapshot of the trigger."
},
"input_version": {
"type": "integer"
},
"accountable_id": {
"type": "string",
"description": "Publisher of the revision; the audit actor of every effect."
},
"started_by_id": {
"type": "string"
},
"depth": {
"type": "integer"
},
"state": {
"type": "string",
"enum": [
"pending",
"running",
"waiting",
"awaiting_approval",
"compensating",
"succeeded",
"failed",
"compensated",
"compensation_failed",
"cancelled"
]
},
"step_index": {
"type": "integer"
},
"context": {
"type": "object"
},
"next_run_at": {
"type": "string",
"format": "date-time"
},
"cancel_requested": {
"type": "boolean"
},
"error_category": {
"type": "string"
},
"last_error": {
"type": "string"
},
"created_at": {
"type": "string",
"format": "date-time"
},
"updated_at": {
"type": "string",
"format": "date-time"
},
"finished_at": {
"type": "string",
"format": "date-time"
},
"attempts": {
"type": "array",
"items": {
"$ref": "#/components/schemas/WorkflowStepAttempt"
}
},
"approvals": {
"type": "array",
"items": {
"$ref": "#/components/schemas/WorkflowApproval"
}
}
},
"required": [
"id",
"workflow_id",
"revision",
"trigger_type",
"subject_id",
"state",
"accountable_id",
"created_at"
]
}WorkflowDiagnostics
{
"type": "object",
"properties": {
"health": {
"type": "string",
"enum": [
"unknown",
"healthy",
"degraded",
"attention_required"
]
},
"runs_by_state": {
"type": "object",
"additionalProperties": {
"type": "integer"
}
},
"step_failures_by_category": {
"type": "object",
"additionalProperties": {
"type": "integer"
}
},
"recent_attempts": {
"type": "integer"
},
"recent_failed_attempts": {
"type": "integer"
},
"run_duration_p50_ms": {
"type": "integer"
},
"run_duration_p95_ms": {
"type": "integer"
},
"pending_approvals": {
"type": "integer"
},
"oldest_due_seconds": {
"type": "integer"
},
"compensation_failures": {
"type": "integer"
}
}
}PluginPackage
{
"type": "object",
"additionalProperties": false,
"required": [
"manifest",
"payload",
"signature"
],
"description": "See api/plugins/package.v1.json and manifest.v1.json.",
"properties": {
"manifest": {
"type": "string",
"description": "base64 of the exact manifest bytes (at most 16 KiB)."
},
"payload": {
"type": "string",
"description": "base64 of the exact payload bytes (at most 160 KiB): {hooks: [HookInput], webhooks: [WebhookInput], workflows: [{name, description, definition}]}."
},
"signature": {
"type": "object",
"additionalProperties": false,
"required": [
"key_id",
"algorithm",
"value"
],
"properties": {
"key_id": {
"type": "string"
},
"algorithm": {
"type": "string",
"enum": [
"Ed25519"
]
},
"value": {
"type": "string",
"description": "base64 Ed25519 signature over \"proudauth-plugin-v1\\n\" + manifest bytes."
}
}
}
}
}PluginPartRef
{
"type": "object",
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
},
"state": {
"type": "string"
}
},
"required": [
"id",
"name",
"state"
]
}Plugin
{
"type": "object",
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
},
"publisher": {
"type": "string"
},
"state": {
"type": "string",
"enum": [
"inactive",
"enabled",
"disabled"
]
},
"installed_version": {
"type": "string"
},
"previous_version": {
"type": "string",
"description": "Target of POST /plugins/{id}/rollback."
},
"installed_by_id": {
"type": "string"
},
"installed_at": {
"type": "string",
"format": "date-time"
},
"version": {
"type": "integer"
},
"created_at": {
"type": "string",
"format": "date-time"
},
"updated_at": {
"type": "string",
"format": "date-time"
},
"parts": {
"type": "object",
"properties": {
"hooks": {
"type": "array",
"items": {
"$ref": "#/components/schemas/PluginPartRef"
}
},
"webhooks": {
"type": "array",
"items": {
"$ref": "#/components/schemas/PluginPartRef"
}
},
"workflows": {
"type": "array",
"items": {
"$ref": "#/components/schemas/PluginPartRef"
}
}
}
}
},
"required": [
"id",
"name",
"publisher",
"state",
"version",
"created_at",
"updated_at"
]
}PluginVersion
{
"type": "object",
"properties": {
"id": {
"type": "string"
},
"plugin_id": {
"type": "string"
},
"version": {
"type": "string"
},
"manifest_version": {
"type": "integer"
},
"manifest": {
"type": "object",
"description": "The signed manifest (api/plugins/manifest.v1.json)."
},
"payload": {
"type": "object",
"description": "Returned by GET .../versions/{version} only, for review."
},
"package_digest": {
"type": "string"
},
"signing_key_id": {
"type": "string"
},
"permissions": {
"type": "array",
"items": {
"type": "string"
}
},
"status": {
"type": "string",
"enum": [
"pending_review",
"approved",
"rejected",
"installed",
"superseded"
]
},
"uploaded_by_id": {
"type": "string"
},
"reviewed_by_id": {
"type": "string"
},
"reviewed_at": {
"type": "string",
"format": "date-time"
},
"review_note": {
"type": "string"
},
"installed_at": {
"type": "string",
"format": "date-time"
},
"created_at": {
"type": "string",
"format": "date-time"
}
},
"required": [
"id",
"plugin_id",
"version",
"manifest_version",
"manifest",
"package_digest",
"signing_key_id",
"permissions",
"status",
"uploaded_by_id",
"created_at"
]
}PluginInstallResult
{
"type": "object",
"properties": {
"plugin": {
"$ref": "#/components/schemas/Plugin"
},
"signing_secrets": {
"type": "array",
"description": "Signing secrets of parts this installation created, shown once.",
"items": {
"type": "object",
"properties": {
"kind": {
"type": "string",
"enum": [
"hook",
"webhook"
]
},
"part_id": {
"type": "string"
},
"name": {
"type": "string"
},
"secret": {
"type": "string",
"x-secret": true
}
}
}
}
},
"required": [
"plugin",
"signing_secrets"
]
}ExtensionContract
{
"type": "object",
"properties": {
"name": {
"type": "string",
"enum": [
"webhook_events",
"hook_contract",
"plugin_manifest",
"workflow_definition",
"management_api"
]
},
"description": {
"type": "string"
},
"versions": {
"type": "array",
"items": {
"type": "object",
"properties": {
"version": {
"type": "integer"
},
"status": {
"type": "string",
"enum": [
"current",
"supported",
"deprecated"
]
},
"sunset": {
"type": "string",
"description": "Earliest removal date (YYYY-MM-DD)."
},
"default": {
"type": "boolean"
}
},
"required": [
"version",
"status"
]
}
}
},
"required": [
"name",
"versions"
]
}RegistryRule
{
"type": "object",
"additionalProperties": false,
"required": [
"repository"
],
"properties": {
"repository": {
"type": "string",
"description": "Repository name or path.Match pattern (acme/* matches acme/app, not acme/team/app)."
},
"organization_id": {
"type": "string",
"description": "Evaluate permissions in this organization; credentials bound to another organization get nothing."
},
"pull": {
"type": "string",
"description": "Permission required to pull."
},
"push": {
"type": "string"
},
"delete": {
"type": "string"
},
"anonymous_pull": {
"type": "boolean"
}
}
}RegistryServiceInput
{
"type": "object",
"additionalProperties": false,
"required": [
"rules"
],
"properties": {
"service": {
"type": "string"
},
"audience": {
"type": "string"
},
"token_ttl_seconds": {
"type": "integer",
"minimum": 60,
"maximum": 3600
},
"rules": {
"type": "array",
"minItems": 1,
"maxItems": 200,
"items": {
"$ref": "#/components/schemas/RegistryRule"
}
},
"state": {
"type": "string",
"enum": [
"active",
"disabled"
]
}
}
}RegistryService
{
"type": "object",
"required": [
"id",
"service",
"resource_id",
"token_ttl_seconds",
"rules",
"state",
"version"
],
"properties": {
"id": {
"type": "string"
},
"service": {
"type": "string"
},
"resource_id": {
"type": "string"
},
"token_ttl_seconds": {
"type": "integer"
},
"rules": {
"type": "array",
"items": {
"$ref": "#/components/schemas/RegistryRule"
}
},
"state": {
"type": "string"
},
"version": {
"type": "integer"
},
"created_at": {
"type": "string",
"format": "date-time"
},
"updated_at": {
"type": "string",
"format": "date-time"
}
}
}EntitlementHistory
{
"type": "object",
"required": [
"subject",
"at",
"account_state",
"memberships",
"groups",
"assignments",
"permissions",
"oauth_grants",
"policies_in_force",
"realm_policy_revision",
"completeness"
],
"properties": {
"subject": {
"type": "object"
},
"at": {
"type": "string",
"format": "date-time"
},
"account_state": {
"type": "string",
"description": "active, suspended, locked, recovery_restricted, deleted, not_created or unknown."
},
"memberships": {
"type": "array",
"items": {
"type": "object"
}
},
"groups": {
"type": "array",
"items": {
"type": "object"
}
},
"assignments": {
"type": "array",
"items": {
"type": "object",
"properties": {
"assignment_id": {
"type": "string"
},
"role_id": {
"type": "string"
},
"role_name": {
"type": "string"
},
"scope_type": {
"type": "string"
},
"scope_id": {
"type": "string"
},
"source": {
"type": "string"
},
"via": {
"type": "string"
},
"since": {
"type": "string",
"format": "date-time"
},
"expires_at": {
"type": "string",
"format": "date-time"
},
"permissions": {
"type": "array",
"items": {
"type": "string"
}
},
"denied_permissions": {
"type": "array",
"items": {
"type": "string"
}
},
"permissions_evidence": {
"type": "string",
"enum": [
"reconstructed",
"current_definition",
"unknown"
]
},
"evidence": {
"type": "array",
"items": {
"type": "string"
},
"description": "Audit event IDs."
}
}
}
},
"permissions": {
"type": "array",
"items": {
"type": "string"
}
},
"oauth_grants": {
"type": "array",
"items": {
"type": "object"
}
},
"policies_in_force": {
"type": "array",
"items": {
"type": "object"
}
},
"realm_policy_revision": {
"type": "integer"
},
"completeness": {
"type": "object",
"properties": {
"evidence_from": {
"type": "string",
"format": "date-time"
},
"complete": {
"type": "boolean"
},
"caveats": {
"type": "array",
"items": {
"type": "string"
}
}
}
}
}
}SSFTransmitterInput
{
"type": "object",
"additionalProperties": false,
"required": [
"name",
"issuer"
],
"properties": {
"name": {
"type": "string",
"maxLength": 100
},
"issuer": {
"type": "string"
},
"jwks_uri": {
"type": "string"
},
"jwks": {
"type": "object",
"description": "Public JSON Web Key Set (instead of jwks_uri)."
},
"provider_id": {
"type": "string",
"description": "Federation connection whose links map iss_sub subjects."
},
"allow_email_subjects": {
"type": "boolean"
},
"actions": {
"type": "object",
"description": "Event type URI -> action. session-revoked: record_only | revoke_sessions | revoke_all; credential-change and assurance-level-change: record_only | revoke_sessions; credential-compromise: record_only | revoke_all | mark_password_compromised; account-disabled and account-purged: record_only | revoke_all | suspend_user; account-enabled and identifier-changed: record_only.",
"additionalProperties": {
"type": "string",
"enum": [
"record_only",
"revoke_sessions",
"revoke_all",
"mark_password_compromised",
"suspend_user"
]
}
},
"max_event_age_seconds": {
"type": "integer",
"minimum": 60,
"maximum": 604800
},
"state": {
"type": "string",
"enum": [
"active",
"disabled"
]
}
}
}SSFTransmitter
{
"type": "object",
"required": [
"id",
"name",
"issuer",
"actions",
"state",
"push_endpoint",
"audience",
"version"
],
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
},
"issuer": {
"type": "string"
},
"jwks_uri": {
"type": "string"
},
"jwks": {
"type": "object"
},
"provider_id": {
"type": "string"
},
"allow_email_subjects": {
"type": "boolean"
},
"actions": {
"type": "object",
"additionalProperties": {
"type": "string"
}
},
"max_event_age_seconds": {
"type": "integer"
},
"state": {
"type": "string"
},
"push_endpoint": {
"type": "string"
},
"audience": {
"type": "string"
},
"version": {
"type": "integer"
},
"created_at": {
"type": "string",
"format": "date-time"
},
"updated_at": {
"type": "string",
"format": "date-time"
}
}
}SSFPushError
{
"type": "object",
"required": [
"err",
"description"
],
"properties": {
"err": {
"type": "string"
},
"description": {
"type": "string"
}
}
}Problem
{
"type": "object",
"description": "RFC 9457 problem details (application/problem+json) used by every custom API. Additional extension members (for example obligations or original_status) may be present.",
"properties": {
"type": {
"type": "string",
"format": "uri",
"description": "https://auth.proudbase.com/problems/{code}"
},
"title": {
"type": "string"
},
"status": {
"type": "integer"
},
"code": {
"type": "string",
"enum": [
"invalid_request",
"validation_failed",
"unauthenticated",
"forbidden",
"not_found",
"conflict",
"precondition_failed",
"precondition_required",
"rate_limited",
"unavailable",
"internal_error",
"payload_too_large",
"unsupported_media_type",
"step_up_required",
"recent_authentication_required",
"mfa_required",
"recovery_restricted",
"transaction_invalid",
"transaction_expired",
"invalid_credentials",
"invalid_proof",
"unexpected_step",
"password_policy",
"last_owner",
"grant_ceiling_exceeded",
"impersonation_denied",
"impersonation_restricted",
"feature_disabled",
"invitation_invalid",
"last_sign_in_method",
"idempotency_key_reused",
"account_unavailable",
"sso_required",
"upstream_unavailable"
],
"description": "Stable machine-readable error code."
},
"detail": {
"type": "string",
"description": "Client-safe detail; never contains secrets."
},
"errors": {
"type": "object",
"additionalProperties": {
"type": "string"
},
"description": "Field name -> validation message."
},
"request_id": {
"type": "string",
"description": "Correlation identifier, equal to the X-Request-Id response header."
},
"obligations": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Obligation"
},
"description": "Present on step-up / recent-authentication / MFA problems."
},
"original_status": {
"type": "integer",
"description": "Present when an idempotent replay is refused because the original response carried a one-time secret."
}
},
"required": [
"type",
"title",
"status",
"code"
],
"additionalProperties": true
}ProfilePatch
{
"additionalProperties": false,
"properties": {
"display_name": {
"type": [
"string",
"null"
]
},
"family_name": {
"type": [
"string",
"null"
]
},
"given_name": {
"type": [
"string",
"null"
]
},
"locale": {
"type": [
"string",
"null"
]
},
"profile": {
"additionalProperties": {},
"type": [
"object",
"null"
]
},
"zoneinfo": {
"type": [
"string",
"null"
]
}
},
"type": "object"
}Project
{
"additionalProperties": false,
"properties": {
"created_at": {
"format": "date-time",
"type": "string"
},
"description": {
"type": "string"
},
"environment": {
"type": "string"
},
"id": {
"type": "string"
},
"name": {
"type": "string"
},
"owner_organization_id": {
"type": "string"
},
"owner_user_id": {
"type": "string"
},
"realm_id": {
"type": "string"
},
"state": {
"type": "string",
"enum": [
"active",
"suspended",
"archived"
]
},
"version": {
"format": "int64",
"type": "integer"
}
},
"type": "object"
}PushedAuthorizationResponse
{
"additionalProperties": false,
"properties": {
"expires_in": {
"type": "integer"
},
"request_uri": {
"type": "string"
}
},
"required": [
"expires_in",
"request_uri"
],
"type": "object"
}RealmImpersonationPolicy
{
"additionalProperties": false,
"properties": {
"allow_customer_opt_out": {
"type": "boolean"
},
"approval": {
"type": "string",
"enum": [
"none",
"second_operator",
"organization_owner",
"customer"
]
},
"enabled": {
"type": "boolean"
},
"max_ttl_seconds": {
"type": "integer",
"minimum": 0,
"maximum": 300
},
"notify_customer": {
"type": "boolean"
},
"require_ticket": {
"type": "boolean"
}
},
"type": "object"
}RealmInteractionPolicy
{
"additionalProperties": false,
"properties": {
"login_ui_url": {
"type": "string"
}
},
"type": "object"
}RealmLifecyclePolicy
{
"additionalProperties": false,
"properties": {
"dormant_days": {
"type": "integer",
"minimum": 0,
"maximum": 3650,
"description": "Accounts without a sign-in for this many days are dormant (0 disables the rule)."
},
"dormant_action": {
"type": "string",
"enum": [
"report",
"suspend"
],
"description": "report (default): flag once and audit user.dormant_detected; suspend: suspend the account."
},
"guest_ttl_days": {
"type": "integer",
"minimum": 0,
"maximum": 3650,
"description": "Guest accounts unused for this many days are deleted (default 30)."
},
"unverified_account_ttl_hours": {
"type": "integer"
}
},
"type": "object"
}RealmLoginPolicy
{
"additionalProperties": false,
"properties": {
"email_otp": {
"type": "boolean"
},
"identifiers": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"magic_link": {
"type": "boolean"
},
"passkeys": {
"type": "boolean"
},
"password": {
"type": "boolean"
},
"remember_devices": {
"type": "boolean"
},
"sms_otp": {
"type": "boolean"
},
"certificates": {
"type": "boolean",
"description": "PROV-016: offer X.509 sign-in (action certificate) with certificates chaining to a user trust anchor and bound to the account."
}
},
"type": "object"
}RealmMFAPolicy
{
"additionalProperties": false,
"properties": {
"admin_phishing_resistant": {
"type": "boolean"
},
"allowed_factors": {
"items": {
"type": "string",
"enum": [
"totp",
"hotp",
"webauthn",
"recovery_code",
"email_otp",
"sms_otp"
]
},
"type": [
"array",
"null"
]
},
"org_admin_mfa_optional": {
"type": "boolean"
},
"hotp": {
"type": "object",
"additionalProperties": false,
"description": "Counter-based codes (MFA-013), offered only when hotp is listed in allowed_factors.",
"properties": {
"look_ahead": {
"type": "integer",
"minimum": 0,
"maximum": 50
},
"resync_window": {
"type": "integer",
"minimum": 0,
"maximum": 1000
}
}
},
"requirement": {
"type": "string",
"enum": [
"optional",
"required"
]
}
},
"type": "object"
}RealmNotificationPolicy
{
"additionalProperties": false,
"properties": {
"new_login_alerts": {
"type": "boolean"
}
},
"type": "object"
}RealmPasswordPolicy
{
"additionalProperties": false,
"properties": {
"history_count": {
"type": "integer"
},
"min_length": {
"type": "integer",
"description": "0 keeps the operator default; otherwise at least 8."
},
"revoke_sessions_on_change": {
"type": "boolean"
}
},
"type": "object"
}RealmPolicy
{
"additionalProperties": false,
"properties": {
"audit": {
"type": "object",
"additionalProperties": false,
"description": "Audit retention scoped to the realm (AUD-009).",
"properties": {
"retention_days": {
"type": "integer",
"minimum": 30,
"maximum": 3650,
"description": "Keeps the realm's evidence at least this many days; never shorter than the deployment's privacy.audit_retention."
}
}
},
"recovery": {
"type": "object",
"additionalProperties": false,
"description": "Assisted recovery controls (MFA-009): with a cooling-off period or required approval, recovery requests are scheduled, announced to the owner at once and can be cancelled by the owner.",
"properties": {
"cooling_off_hours": {
"type": "integer",
"minimum": 0,
"maximum": 168
},
"require_approval": {
"type": "boolean"
}
}
},
"data_access": {
"type": "object",
"additionalProperties": false,
"description": "Evidence of identity data reads (USR-018, AUD-015): when log_identity_reads is on, every administrative or support read of an account record (user.read) and every account search (user.search) is audited in the data_access category with the actor, the account and whether the view was masked; the data itself is never logged. The audit record is written before the data is returned.",
"properties": {
"log_identity_reads": {
"type": "boolean"
},
"sample_allowed_decisions_percent": {
"type": "integer",
"minimum": 0,
"maximum": 100,
"description": "Share of ordinary allowed authorization decisions audited, marked sampled (AZ-020). Denials, privileged and support decisions are always audited."
}
}
},
"impersonation": {
"$ref": "#/components/schemas/RealmImpersonationPolicy"
},
"interaction": {
"$ref": "#/components/schemas/RealmInteractionPolicy"
},
"lifecycle": {
"$ref": "#/components/schemas/RealmLifecyclePolicy"
},
"login": {
"$ref": "#/components/schemas/RealmLoginPolicy"
},
"mfa": {
"$ref": "#/components/schemas/RealmMFAPolicy"
},
"notifications": {
"$ref": "#/components/schemas/RealmNotificationPolicy"
},
"password": {
"$ref": "#/components/schemas/RealmPasswordPolicy"
},
"profile": {
"$ref": "#/components/schemas/RealmProfilePolicy"
},
"registration": {
"$ref": "#/components/schemas/RealmRegistrationPolicy"
},
"sessions": {
"$ref": "#/components/schemas/RealmSessionPolicy"
},
"webauthn": {
"$ref": "#/components/schemas/RealmWebAuthnPolicy"
},
"domains": {
"type": "object",
"additionalProperties": false,
"description": "Periodic re-verification of organization domains (TEN-009): the accepted DNS proof is re-checked every recheck_days (default 30); after lapse_after_failures consecutive daily failures (default 3) the verification lapses.",
"properties": {
"recheck_days": {
"type": "integer",
"minimum": 1,
"maximum": 365
},
"lapse_after_failures": {
"type": "integer",
"minimum": 1,
"maximum": 30
}
}
},
"policy_engine": {
"type": "object",
"additionalProperties": false,
"description": "External policy engine (AZ-026) named from the operator's security.policy_engines; restrict (default) lets it only deny, decide makes its answer final (published policies and hooks still restrict it); on_error deny (default) or local.",
"properties": {
"name": {
"type": "string"
},
"mode": {
"type": "string",
"enum": [
"restrict",
"decide"
]
},
"on_error": {
"type": "string",
"enum": [
"deny",
"local"
]
}
}
},
"client_registration": {
"type": "object",
"additionalProperties": false,
"description": "Dynamic client registration (APP-016, ADV-003), off by default: registrations need an initial access token unless open is set; registrations without a token are always held for approval.",
"properties": {
"enabled": {
"type": "boolean"
},
"open": {
"type": "boolean"
},
"require_approval": {
"type": "boolean"
},
"open_scopes": {
"type": "array",
"items": {
"type": "string",
"enum": [
"openid",
"profile",
"email",
"phone",
"address"
]
}
}
}
},
"authentication_flow": {
"type": "object",
"additionalProperties": false,
"description": "Authentication policy (AUT-012, AUT-014, SEC-014): an ordered list of at most 50 rules evaluated once the account is known. The first rule whose conditions all hold decides; with no match the sign-in continues under the other policies. A rule whose condition needs an unavailable signal (no or a failing authentication.risk hook, no client address) applies a restrictive outcome unless on_missing_signal is skip, and an allow rule never matches on a missing signal. Each decision is audited as authentication.flow.evaluated with the rule, policy revision, signals and missing signals; review outcomes raise the authentication_review security signal.",
"properties": {
"challenge_provider": {
"type": "string",
"description": "Name of an operator-configured challenge provider (security.challenge_providers) offered for challenge outcomes."
},
"email_code_alternative": {
"type": "boolean",
"default": true,
"description": "Offer a code sent to the verified email as the accessible alternative to the provider challenge."
},
"rules": {
"type": "array",
"maxItems": 50,
"items": {
"type": "object",
"additionalProperties": false,
"required": [
"name",
"outcome"
],
"properties": {
"name": {
"type": "string",
"minLength": 1,
"maxLength": 100
},
"outcome": {
"type": "string",
"enum": [
"allow",
"require_mfa",
"require_phishing_resistant",
"challenge",
"review",
"deny"
]
},
"on_missing_signal": {
"type": "string",
"enum": [
"apply",
"skip"
],
"default": "apply"
},
"when": {
"type": "object",
"additionalProperties": false,
"description": "Conditions that must all hold; omitted members are not checked.",
"properties": {
"clients": {
"type": "array",
"maxItems": 50,
"items": {
"type": "string"
},
"description": "OAuth client_id values."
},
"organizations": {
"type": "array",
"maxItems": 50,
"items": {
"type": "string"
},
"description": "Organization IDs of the sign-in context."
},
"methods": {
"type": "array",
"maxItems": 50,
"items": {
"type": "string",
"enum": [
"password",
"passkey",
"email_otp",
"magic_link",
"sms_otp",
"sso",
"certificate"
]
},
"description": "Primary method used (realm.FlowMethods; certificate is X.509 sign-in, PROV-016)."
},
"resources": {
"type": "array",
"maxItems": 50,
"items": {
"type": "string"
},
"description": "Requested resource audiences (any)."
},
"networks": {
"type": "array",
"maxItems": 50,
"items": {
"type": "string"
},
"description": "CIDR prefixes containing the client address."
},
"outside_networks": {
"type": "array",
"maxItems": 50,
"items": {
"type": "string"
},
"description": "CIDR prefixes the client address must be outside of."
},
"new_device": {
"type": "boolean",
"description": "True matches a device not remembered for the account."
},
"failed_attempts_at_least": {
"type": "integer",
"minimum": 0,
"maximum": 1000,
"description": "Failed sign-in attempts on the account in the last hour."
},
"risk_at_least": {
"type": "string",
"enum": [
"low",
"medium",
"high"
],
"description": "Highest level reported by authentication.risk hooks."
},
"privileged": {
"type": "boolean",
"description": "Protected account or holder of a privileged realm role."
},
"assurance_below": {
"type": "string",
"enum": [
"urn:proudauth:acr:mfa",
"urn:proudauth:acr:phishing_resistant"
],
"description": "The factors completed so far give a lower assurance."
}
}
}
}
}
}
}
},
"machine": {
"type": "object",
"additionalProperties": false,
"description": "Service principals whose accountable owner is suspended, locked or deleted (MCH-007): flag (default) reports the departure once and lists it in the credential inventory; disable disables the principal and revokes its credentials after owner_departure_grace_days.",
"properties": {
"owner_departure": {
"type": "string",
"enum": [
"flag",
"disable"
]
},
"owner_departure_grace_days": {
"type": "integer",
"minimum": 0,
"maximum": 90
}
}
},
"tokens": {
"type": "object",
"additionalProperties": false,
"description": "Realm limits on access-token lifetimes (TOK-018). Resources and clients set lifetimes; each limit here only shortens them: for every access token, for service principals, for user sessions below MFA, and for support (impersonation) tokens. The operator maximum always applies.",
"properties": {
"access_token_ttl_seconds": {
"type": "integer",
"minimum": 30,
"maximum": 86400
},
"service_access_token_ttl_seconds": {
"type": "integer",
"minimum": 30,
"maximum": 86400
},
"single_factor_access_token_ttl_seconds": {
"type": "integer",
"minimum": 30,
"maximum": 86400
},
"impersonation_access_token_ttl_seconds": {
"type": "integer",
"minimum": 30,
"maximum": 86400
}
}
}
},
"type": "object"
}RealmProfilePolicy
{
"additionalProperties": false,
"description": "Custom profile attribute schema (USR-007). Self-service and complete_profile may write only user-editable, locally sourced attributes defined here; undefined attributes are rejected.",
"properties": {
"attributes": {
"type": "array",
"maxItems": 50,
"items": {
"type": "object",
"additionalProperties": false,
"properties": {
"name": {
"type": "string",
"pattern": "^[a-z][a-z0-9_]{0,63}$"
},
"type": {
"type": "string",
"enum": [
"string",
"number",
"boolean",
"enum"
]
},
"max_length": {
"type": "integer",
"minimum": 0,
"maximum": 4096
},
"enum": {
"type": "array",
"maxItems": 100,
"items": {
"type": "string"
}
},
"pattern": {
"type": "string",
"maxLength": 200
},
"required": {
"type": "boolean"
},
"user_editable": {
"type": "boolean"
},
"visibility": {
"type": "string",
"enum": [
"self",
"admin",
"internal"
]
},
"source": {
"type": "string",
"enum": [
"local",
"federation",
"directory"
]
},
"claimable": {
"type": "boolean"
}
},
"required": [
"name"
]
}
}
},
"type": "object"
}RealmRegistrationPolicy
{
"additionalProperties": false,
"properties": {
"require_approval": {
"type": "boolean",
"description": "Queue self-registrations for review (REG-008); invited registrations are not queued."
},
"allow_guests": {
"type": "boolean"
},
"allow_organization_creation": {
"type": "boolean"
},
"allowed_domains": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"mode": {
"type": "string",
"enum": [
"public",
"closed",
"invitation_only",
"domain_restricted"
]
},
"require_email_verification": {
"type": "boolean"
},
"required_profile_fields": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"terms_version": {
"type": "string"
}
},
"type": "object"
}RealmSessionPolicy
{
"additionalProperties": false,
"properties": {
"absolute_seconds": {
"type": "integer"
},
"idle_seconds": {
"type": "integer"
},
"max_concurrent": {
"type": "integer"
}
},
"type": "object"
}RealmSettings
{
"type": "object",
"properties": {
"realm": {
"type": "string"
},
"issuer": {
"type": "string",
"format": "uri"
},
"state": {
"type": "string"
},
"policy": {
"$ref": "#/components/schemas/RealmPolicy"
},
"policy_revision": {
"type": "integer",
"format": "int64"
},
"version": {
"type": "integer",
"format": "int64"
}
},
"required": [
"realm",
"issuer",
"state",
"policy",
"policy_revision",
"version"
]
}RealmWebAuthnPolicy
{
"additionalProperties": false,
"properties": {
"allow_synced": {
"type": "boolean"
},
"origins": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"rp_id": {
"type": "string"
},
"rp_name": {
"type": "string"
},
"user_verification": {
"type": "string"
}
},
"type": "object"
}RegistrationInput
{
"additionalProperties": false,
"properties": {
"display_name": {
"type": "string"
},
"email": {
"type": "string"
},
"family_name": {
"type": "string"
},
"given_name": {
"type": "string"
},
"invitation": {
"type": "string",
"x-secret": true,
"description": "Invitation secret to accept during registration."
},
"locale": {
"type": "string"
},
"organization": {
"oneOf": [
{
"$ref": "#/components/schemas/OrganizationInput"
},
{
"type": "null"
}
]
},
"password": {
"type": "string",
"format": "password"
},
"profile": {
"additionalProperties": {},
"type": [
"object",
"null"
]
},
"terms_version": {
"type": "string"
},
"username": {
"type": "string"
}
},
"type": "object"
}Resource
{
"additionalProperties": false,
"properties": {
"access_token_ttl_seconds": {
"type": "integer"
},
"audience": {
"type": "string"
},
"created_at": {
"format": "date-time",
"type": "string"
},
"description": {
"type": "string"
},
"id": {
"type": "string"
},
"impersonation_enabled": {
"type": "boolean"
},
"impersonation_policy": {
"$ref": "#/components/schemas/ApplicationImpersonationPolicy"
},
"kind": {
"type": "string"
},
"name": {
"type": "string"
},
"project_id": {
"type": "string"
},
"realm_id": {
"type": "string"
},
"requires_organization": {
"type": "boolean"
},
"scopes": {
"items": {
"$ref": "#/components/schemas/ApplicationScope"
},
"type": [
"array",
"null"
]
},
"signing_algorithm": {
"type": "string"
},
"state": {
"type": "string"
},
"token_format": {
"type": "string"
},
"verification_mode": {
"type": "string"
},
"version": {
"format": "int64",
"type": "integer"
}
},
"required": [
"access_token_ttl_seconds",
"audience",
"created_at",
"id",
"impersonation_enabled",
"impersonation_policy",
"kind",
"name",
"realm_id",
"requires_organization",
"signing_algorithm",
"state",
"token_format",
"verification_mode",
"version"
],
"type": "object"
}ResourceGrant
{
"additionalProperties": false,
"properties": {
"allowed_scopes": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"client_ref": {
"type": "string"
},
"exchange_policy": {
"$ref": "#/components/schemas/ExchangePolicy"
},
"id": {
"type": "string"
},
"resource_id": {
"type": "string"
},
"subject_types": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
}
},
"required": [
"allowed_scopes",
"client_ref",
"exchange_policy",
"id",
"resource_id",
"subject_types"
],
"type": "object"
}ResourceInput
{
"additionalProperties": false,
"properties": {
"signing_algorithm": {
"type": "string",
"description": "Pins the access-token JWS algorithm (TOK-005). Must be in security.allowed_algorithms; symmetric algorithms and none are rejected. Issuance fails closed if the realm's active key uses another algorithm, and key rotation to another algorithm is refused while resources pin this one. Defaults to keys.signing_algorithm."
},
"access_token_ttl_seconds": {
"type": "integer"
},
"audience": {
"type": "string"
},
"description": {
"type": "string"
},
"impersonation_enabled": {
"type": "boolean"
},
"impersonation_policy": {
"$ref": "#/components/schemas/ApplicationImpersonationPolicy"
},
"name": {
"type": "string"
},
"project_id": {
"type": "string"
},
"requires_organization": {
"type": [
"boolean",
"null"
]
},
"scopes": {
"items": {
"$ref": "#/components/schemas/ScopeInput"
},
"type": [
"array",
"null"
]
},
"token_format": {
"type": "string",
"enum": [
"jwt",
"opaque"
]
},
"verification_mode": {
"type": "string",
"enum": [
"offline",
"bounded_online",
"strict_online"
]
}
},
"type": "object",
"required": [
"audience",
"name"
]
}RevokedSessions
{
"type": "object",
"properties": {
"revoked_sessions": {
"type": "integer"
}
},
"required": [
"revoked_sessions"
]
}Role
{
"additionalProperties": false,
"properties": {
"boundary_type": {
"type": "string"
},
"built_in": {
"type": "boolean"
},
"composite_role_ids": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"created_at": {
"format": "date-time",
"type": "string"
},
"denied_permissions": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"description": {
"type": "string"
},
"id": {
"type": "string"
},
"incompatible_role_ids": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"is_owner_role": {
"type": "boolean"
},
"name": {
"type": "string"
},
"organization_id": {
"type": "string"
},
"permissions": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"project_id": {
"type": "string"
},
"protected": {
"type": "boolean"
},
"realm_id": {
"type": "string"
},
"requires_approval": {
"type": "boolean"
},
"version": {
"format": "int64",
"type": "integer"
}
},
"required": [
"boundary_type",
"built_in",
"composite_role_ids",
"created_at",
"id",
"incompatible_role_ids",
"is_owner_role",
"name",
"permissions",
"protected",
"realm_id",
"requires_approval",
"version"
],
"type": "object"
}RoleAssignment
{
"additionalProperties": false,
"properties": {
"approved_by": {
"type": "string"
},
"conditions": {
"additionalProperties": {},
"type": [
"object",
"null"
]
},
"created_at": {
"format": "date-time",
"type": "string"
},
"expires_at": {
"format": "date-time",
"type": [
"string",
"null"
]
},
"granted_by": {
"type": "string"
},
"id": {
"type": "string"
},
"membership_id": {
"type": "string"
},
"reason": {
"type": "string"
},
"role_id": {
"type": "string"
},
"role_name": {
"type": "string"
},
"scope": {
"$ref": "#/components/schemas/AuthzScope"
},
"source": {
"type": "string"
},
"subject": {
"$ref": "#/components/schemas/AuthzSubject"
},
"valid_from": {
"format": "date-time",
"type": [
"string",
"null"
]
}
},
"required": [
"created_at",
"id",
"role_id",
"scope",
"source",
"subject"
],
"type": "object"
}RoleInput
{
"additionalProperties": false,
"properties": {
"boundary_type": {
"type": "string",
"enum": [
"realm",
"organization",
"project"
]
},
"composite_role_ids": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"denied_permissions": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"description": {
"type": "string"
},
"incompatible_role_ids": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"name": {
"type": "string"
},
"organization_id": {
"type": "string"
},
"permissions": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"project_id": {
"type": "string"
},
"requires_approval": {
"type": "boolean"
}
},
"type": "object",
"required": [
"name"
]
}ScopeInput
{
"additionalProperties": false,
"properties": {
"required_permissions": {
"type": "array",
"maxItems": 10,
"items": {
"type": "string"
},
"description": "Subject policy (TOK-008); the scope is issued only to subjects holding all of these permissions in the token's organization or realm context, re-checked on refresh."
},
"consent_text": {
"type": "string"
},
"description": {
"type": "string"
},
"is_default": {
"type": "boolean",
"description": "Default grant (APP-007): a token or authorization request that names this scope's resource but none of its scopes is requested with the resource's default scopes, as far as the client's resource grant lists them. They then pass the checks of a requested scope (consent, step-up, the organization's scope ceiling, required_permissions), so a default scope is never issued where a requested one would not be. A request naming any scope of the resource gets no defaults, and a refresh never adds defaults declared after the authorization."
},
"name": {
"type": "string"
},
"sensitivity": {
"type": "string",
"description": "Defaults to normal. privileged scopes require MFA (step-up) even without step_up_acr."
},
"step_up_acr": {
"type": "string",
"enum": [
"urn:proudauth:acr:mfa",
"urn:proudauth:acr:phishing_resistant"
],
"description": "Step-up policy (AUT-010): a request for the scope makes this assurance a requirement of the transaction; an SSO session below it is stepped up, never downgraded."
},
"max_auth_age_seconds": {
"type": "integer",
"minimum": 60,
"maximum": 86400,
"description": "The session's authentication must be at most this old when the scope is requested; refresh drops the scope once the grant's authentication is older."
}
},
"type": "object",
"required": [
"name"
]
}SecurityEvent
{
"type": "object",
"properties": {
"id": {
"type": "string"
},
"type": {
"type": "string"
},
"occurred_at": {
"type": "string",
"format": "date-time"
},
"outcome": {
"type": "string"
},
"network": {
"type": "string"
},
"actor_type": {
"type": "string",
"description": "Present when another party (support or an administrator) acted on the account."
},
"support_grant_id": {
"type": "string"
}
},
"required": [
"id",
"type",
"occurred_at",
"outcome",
"network"
]
}SelfCredential
{
"description": "Safe authenticator metadata. Verifiers, seeds and public keys are never returned.",
"oneOf": [
{
"type": "object",
"title": "Credential",
"properties": {
"id": {
"type": "string"
},
"type": {
"type": "string"
},
"name": {
"type": "string"
},
"state": {
"type": "string",
"enum": [
"active",
"compromised"
]
},
"created_at": {
"type": "string",
"format": "date-time"
},
"last_used_at": {
"type": [
"string",
"null"
],
"format": "date-time"
}
},
"required": [
"id",
"type",
"name",
"state",
"created_at",
"last_used_at"
]
},
{
"type": "object",
"title": "Passkey",
"properties": {
"id": {
"type": "string"
},
"type": {
"type": "string",
"const": "webauthn"
},
"name": {
"type": "string"
},
"synced": {
"type": "boolean"
},
"backup_eligible": {
"type": "boolean"
},
"user_verifying": {
"type": "boolean"
},
"created_at": {
"type": "string",
"format": "date-time"
},
"last_used_at": {
"type": [
"string",
"null"
],
"format": "date-time"
}
},
"required": [
"id",
"type",
"name",
"synced",
"backup_eligible",
"user_verifying",
"created_at",
"last_used_at"
]
}
]
}SelfSession
{
"type": "object",
"properties": {
"id": {
"type": "string"
},
"current": {
"type": "boolean"
},
"created_at": {
"type": "string",
"format": "date-time"
},
"last_activity_at": {
"type": "string",
"format": "date-time"
},
"expires_at": {
"type": "string",
"format": "date-time"
},
"amr": {
"type": [
"array",
"null"
],
"items": {
"type": "string"
}
},
"acr": {
"type": "string"
},
"user_agent": {
"type": "string"
},
"remember_me": {
"type": "boolean"
},
"recovery_restricted": {
"type": "boolean"
},
"device": {
"type": "string",
"description": "Display hint derived from the user agent (SES-013); never a security signal."
},
"network": {
"type": "string",
"description": "Privacy-reduced network (/24 or /48) the session started from."
}
},
"required": [
"id",
"current",
"created_at",
"last_activity_at",
"expires_at",
"amr",
"acr",
"user_agent",
"remember_me",
"recovery_restricted"
]
}SelfUser
{
"type": "object",
"description": "Self-service view of the calling user.",
"properties": {
"id": {
"type": "string"
},
"state": {
"type": "string",
"enum": [
"pending_verification",
"active",
"suspended",
"locked",
"recovery_restricted",
"pending_deletion",
"deleted"
]
},
"display_name": {
"type": "string"
},
"given_name": {
"type": "string"
},
"family_name": {
"type": "string"
},
"locale": {
"type": "string"
},
"zoneinfo": {
"type": "string"
},
"profile": {
"type": [
"object",
"null"
],
"additionalProperties": true
},
"identifiers": {
"type": "array",
"items": {
"$ref": "#/components/schemas/UserIdentifier"
}
},
"required_actions": {
"type": [
"array",
"null"
],
"items": {
"type": "string",
"enum": [
"update_password",
"verify_email",
"configure_totp",
"accept_terms",
"complete_profile",
"verify_contact"
]
}
},
"created_at": {
"type": "string",
"format": "date-time"
},
"updated_at": {
"type": "string",
"format": "date-time"
},
"version": {
"type": "integer",
"format": "int64"
},
"deletion_scheduled_at": {
"type": [
"string",
"null"
],
"format": "date-time"
}
},
"required": [
"id",
"state",
"display_name",
"given_name",
"family_name",
"locale",
"zoneinfo",
"profile",
"identifiers",
"required_actions",
"created_at",
"updated_at",
"version",
"deletion_scheduled_at"
]
}ServicePrincipal
{
"additionalProperties": false,
"properties": {
"allowed_organization_ids": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"created_at": {
"format": "date-time",
"type": "string"
},
"description": {
"type": "string"
},
"id": {
"type": "string"
},
"is_agent": {
"type": "boolean",
"description": "An autonomous agent (MCH-017): needs an accountable human owner (owner_user_id; 422 otherwise), privileged roles reach it only through two-party approval, and its tokens carry agent=true (and act.agent=true when it acts for a person). Agents pass through ordinary authorization like any service."
},
"name": {
"type": "string"
},
"owner_organization_id": {
"type": "string"
},
"owner_user_id": {
"type": "string"
},
"permission_revision": {
"format": "int64",
"type": "integer"
},
"state": {
"type": "string",
"enum": [
"active",
"disabled",
"deleted"
]
},
"version": {
"format": "int64",
"type": "integer"
}
},
"required": [
"allowed_organization_ids",
"created_at",
"id",
"is_agent",
"name",
"permission_revision",
"state",
"version"
],
"type": "object"
}ServicePrincipalInput
{
"additionalProperties": false,
"properties": {
"allowed_organization_ids": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"description": {
"type": "string"
},
"is_agent": {
"type": "boolean",
"description": "An autonomous agent (MCH-017): needs an accountable human owner (owner_user_id; 422 otherwise), privileged roles reach it only through two-party approval, and its tokens carry agent=true (and act.agent=true when it acts for a person). Agents pass through ordinary authorization like any service."
},
"name": {
"type": "string",
"maxLength": 200
},
"owner_organization_id": {
"type": "string"
},
"owner_user_id": {
"type": "string"
}
},
"type": "object",
"required": [
"name"
]
}Session
{
"additionalProperties": false,
"properties": {
"absolute_expires_at": {
"format": "date-time",
"type": "string"
},
"acr": {
"type": "string"
},
"amr": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"auth_time": {
"format": "date-time",
"type": "string"
},
"created_at": {
"format": "date-time",
"type": "string"
},
"device_label": {
"type": "string"
},
"id": {
"type": "string"
},
"idle_expires_at": {
"format": "date-time",
"type": "string"
},
"last_activity_at": {
"format": "date-time",
"type": "string"
},
"mfa_time": {
"format": "date-time",
"type": [
"string",
"null"
]
},
"network": {
"type": "string"
},
"realm_id": {
"type": "string"
},
"recovery_restricted": {
"type": "boolean"
},
"remember_me": {
"type": "boolean"
},
"revoke_reason": {
"type": "string"
},
"revoked_at": {
"format": "date-time",
"type": [
"string",
"null"
]
},
"state": {
"type": "string"
},
"transient": {
"type": "boolean"
},
"user_agent": {
"type": "string"
},
"user_id": {
"type": "string"
}
},
"required": [
"absolute_expires_at",
"acr",
"amr",
"auth_time",
"created_at",
"id",
"idle_expires_at",
"last_activity_at",
"realm_id",
"recovery_restricted",
"remember_me",
"state",
"transient",
"user_id"
],
"type": "object"
}SigningKeyMetadata
{
"additionalProperties": false,
"properties": {
"activated_at": {
"format": "date-time",
"type": [
"string",
"null"
]
},
"algorithm": {
"type": "string"
},
"compromised_at": {
"format": "date-time",
"type": [
"string",
"null"
]
},
"created_at": {
"format": "date-time",
"type": "string"
},
"kid": {
"type": "string"
},
"publish_until": {
"format": "date-time",
"type": [
"string",
"null"
]
},
"retiring_at": {
"format": "date-time",
"type": [
"string",
"null"
]
},
"state": {
"type": "string"
}
},
"required": [
"algorithm",
"created_at",
"kid",
"state"
],
"type": "object"
}StateResponse
{
"type": "object",
"properties": {
"state": {
"type": "string"
}
},
"required": [
"state"
]
}TOTPEnrollment
{
"additionalProperties": false,
"properties": {
"credential_id": {
"type": "string"
},
"expires_at": {
"format": "date-time",
"type": "string"
},
"otpauth_uri": {
"type": "string",
"x-secret": true,
"description": "otpauth:// provisioning URI containing the seed. Returned once."
},
"secret": {
"type": "string",
"x-secret": true,
"description": "Base32 TOTP seed. Returned once during enrollment."
}
},
"required": [
"credential_id",
"expires_at",
"otpauth_uri",
"secret"
],
"type": "object"
}HOTPEnrollment
{
"additionalProperties": false,
"properties": {
"credential_id": {
"type": "string"
},
"expires_at": {
"format": "date-time",
"type": "string"
},
"counter": {
"type": "integer",
"description": "The counter the token starts at (0)."
},
"otpauth_uri": {
"type": "string",
"x-secret": true,
"description": "otpauth://hotp provisioning URI containing the seed and counter. Returned once."
},
"secret": {
"type": "string",
"x-secret": true,
"description": "Base32 HOTP seed. Returned once during enrollment."
}
},
"required": [
"counter",
"credential_id",
"expires_at",
"otpauth_uri",
"secret"
],
"type": "object"
}TokenResponse
{
"additionalProperties": false,
"properties": {
"access_token": {
"type": "string",
"x-secret": true
},
"expires_in": {
"type": "integer"
},
"id_token": {
"type": "string",
"x-secret": true
},
"issued_token_type": {
"type": "string"
},
"refresh_token": {
"type": "string",
"x-secret": true
},
"scope": {
"type": "string"
},
"token_type": {
"type": "string",
"enum": [
"Bearer",
"DPoP"
],
"description": "DPoP for an access token bound to a DPoP key (cnf.jkt, RFC 9449); Bearer for every other token, certificate-bound tokens (cnf.x5t#S256, RFC 8705) included. The same for every grant, token exchange included."
}
},
"required": [
"access_token",
"expires_in",
"token_type"
],
"type": "object"
}TransactionAction
{
"additionalProperties": false,
"properties": {
"fields": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"options": {
"additionalProperties": {},
"type": [
"object",
"null"
]
},
"required": {
"type": "boolean"
},
"type": {
"type": "string"
}
},
"required": [
"required",
"type"
],
"type": "object"
}TransactionStarted
{
"type": "object",
"properties": {
"transaction_id": {
"type": "string"
},
"continuation_token": {
"type": "string",
"x-secret": true,
"description": "Continuation authority for headless clients; send it in X-Transaction-Token on every later step. Returned exactly once; it is never stored in plaintext, never shown again and never replayed from the idempotency store."
},
"device_request": {
"type": "object",
"description": "Present only when the transaction was started from a device user code.",
"properties": {
"client_name": {
"type": "string"
},
"client_id": {
"type": "string"
},
"scopes": {
"type": [
"array",
"null"
],
"items": {
"type": "string"
}
},
"expires_at": {
"type": "string",
"format": "date-time"
}
}
},
"state": {
"$ref": "#/components/schemas/TransactionState"
}
},
"required": [
"transaction_id",
"continuation_token",
"state"
]
}TransactionState
{
"additionalProperties": false,
"properties": {
"client": {
"additionalProperties": {},
"type": [
"object",
"null"
]
},
"completed_factors": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"csrf_token": {
"type": "string",
"description": "Returned only to browser (cookie-bound) callers from an allowed origin; send it back in X-CSRF-Token."
},
"error": {
"type": "string"
},
"expires_at": {
"format": "date-time",
"type": "string"
},
"external_redirect": {
"type": "string",
"description": "Upstream authorization URL the browser must visit (federated sign-in)."
},
"id": {
"type": "string"
},
"intent": {
"type": "string"
},
"locale": {
"type": "string"
},
"next_actions": {
"items": {
"$ref": "#/components/schemas/TransactionAction"
},
"type": [
"array",
"null"
]
},
"notice": {
"type": "string",
"description": "Non-terminal condition to show, e.g. upstream_unavailable."
},
"one_time": {
"additionalProperties": {},
"type": [
"object",
"null"
],
"x-secret": true,
"description": "Secrets displayed exactly once (for example newly generated recovery codes). Never shown again."
},
"redirect_to": {
"type": "string"
},
"status": {
"type": "string",
"enum": [
"pending",
"completed",
"cancelled",
"expired",
"failed"
]
},
"user": {
"additionalProperties": {},
"type": [
"object",
"null"
]
},
"webauthn": {
"description": "WebAuthn ceremony options for the client (PublicKeyCredentialRequestOptions or CreationOptions JSON) when a passkey step is pending. Not secret."
}
},
"required": [
"client",
"completed_factors",
"expires_at",
"id",
"intent",
"next_actions",
"status"
],
"type": "object"
}UserIdentifier
{
"type": "object",
"properties": {
"id": {
"type": "string"
},
"type": {
"type": "string",
"enum": [
"email",
"phone",
"username"
]
},
"value": {
"type": "string"
},
"verified": {
"type": "boolean"
},
"is_primary": {
"type": "boolean"
}
},
"required": [
"id",
"type",
"value",
"verified",
"is_primary"
]
}UserInfo
{
"type": "object",
"additionalProperties": true,
"properties": {
"sub": {
"type": "string"
}
},
"required": [
"sub"
],
"description": "Standard OIDC claims permitted by the granted scopes."
}WebhookDelivery
{
"additionalProperties": false,
"properties": {
"attempts": {
"type": "integer"
},
"created_at": {
"format": "date-time",
"type": "string"
},
"delivered_at": {
"format": "date-time",
"type": [
"string",
"null"
]
},
"event_id": {
"type": "string"
},
"event_type": {
"type": "string"
},
"id": {
"type": "string"
},
"last_response_category": {
"type": "string"
},
"last_status_code": {
"type": [
"integer",
"null"
]
},
"next_attempt_at": {
"format": "date-time",
"type": "string"
},
"state": {
"type": "string"
}
},
"required": [
"attempts",
"created_at",
"event_id",
"event_type",
"id",
"next_attempt_at",
"state"
],
"type": "object"
}WebhookInput
{
"additionalProperties": false,
"properties": {
"allow_private_network": {
"type": "boolean"
},
"destination_url": {
"type": "string",
"format": "uri",
"description": "HTTPS destination subject to the operator egress policy."
},
"event_types": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
],
"minItems": 1,
"description": "Event types from the catalog in api/events (also returned by GET /webhooks as event_types)."
},
"name": {
"type": "string"
},
"organization_id": {
"type": "string"
},
"payload_form": {
"type": "string",
"enum": [
"minimal",
"standard"
]
},
"event_version": {
"type": "integer",
"enum": [
1,
2
],
"description": "Event schema version deliveries are rendered to (EXT-018); default 1. See api/events/README.md."
}
},
"type": "object",
"required": [
"destination_url",
"event_types",
"name"
]
}WebhookSubscription
{
"additionalProperties": false,
"properties": {
"allow_private_network": {
"type": "boolean"
},
"created_at": {
"format": "date-time",
"type": "string"
},
"destination_url": {
"type": "string"
},
"event_types": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"id": {
"type": "string"
},
"name": {
"type": "string"
},
"organization_id": {
"type": "string"
},
"owner_user_id": {
"type": "string"
},
"payload_form": {
"type": "string"
},
"state": {
"type": "string",
"enum": [
"active",
"paused",
"disabled"
]
},
"version": {
"format": "int64",
"type": "integer"
},
"event_version": {
"type": "integer",
"description": "Event schema version of deliveries (EXT-018)."
},
"plugin_id": {
"type": "string",
"description": "Set when a plugin manages the subscription; PATCH and DELETE then return 409 (EXT-014)."
}
},
"required": [
"allow_private_network",
"created_at",
"destination_url",
"event_types",
"id",
"name",
"payload_form",
"state",
"version",
"event_version"
]
}