API reference
157 operations across 20 resources, generated from the Management API's OpenAPI document. The document itself is served at /api/openapi.
Tenants
The tenants the caller administers
| Method | Path | Summary |
|---|
| GET | /api/identity/tenants/{id} | Get a tenant |
| PATCH | /api/identity/tenants/{id} | Update a tenant |
| GET | /api/identity/tenants | List tenants |
| POST | /api/identity/tenants | Create a tenant |
| POST | /api/identity/tenants/{id}/transfer-ownership | Transfer a tenant's ownership to an organization |
Users
A tenant's end users
| Method | Path | Summary |
|---|
| GET | /api/identity/{tenantId}/users/export | Export the tenant's user directory |
| GET | /api/identity/{tenantId}/users | List users |
| POST | /api/identity/{tenantId}/users | Create a user |
| GET | /api/identity/{tenantId}/users/{id} | Get a user |
| DELETE | /api/identity/{tenantId}/users/{id} | Delete a user |
| PATCH | /api/identity/{tenantId}/users/{id} | Update a user |
| POST | /api/identity/{tenantId}/users/{id}/verify-email | Mark a user's email address verified |
| POST | /api/identity/{tenantId}/users/{id}/send-verification | Send a user an email-verification message |
| POST | /api/identity/{tenantId}/users/{id}/send-reset | Send a user a password-reset message |
| POST | /api/identity/{tenantId}/users/{id}/password | Set a user's password |
| POST | /api/identity/{tenantId}/users/{id}/disable | Disable a user's account |
| POST | /api/identity/{tenantId}/users/{id}/enable | Re-enable a disabled user's account |
| POST | /api/identity/{tenantId}/users/{id}/impersonate | Start a support impersonation of a user |
| POST | /api/identity/{tenantId}/users/{id}/sessions/revoke | Revoke all of a user's sessions |
| POST | /api/identity/{tenantId}/users/{id}/sessions/{sessionId}/revoke | Revoke one of a user's sessions |
| POST | /api/identity/{tenantId}/users/{id}/unsuspend | Restore a suspended (soft-deleted) user |
| GET | /api/identity/{tenantId}/users/{id}/roles | List the roles a user holds |
| POST | /api/identity/{tenantId}/users/{id}/roles | Assign a role to a user |
| DELETE | /api/identity/{tenantId}/users/{id}/roles/{roleId} | Revoke a role from a user |
| POST | /api/identity/{tenantId}/users/{id}/reset-mfa | Reset a user's MFA enrollment |
Applications
A tenant's OAuth2 applications and their secrets
| Method | Path | Summary |
|---|
| GET | /api/identity/{tenantId}/applications | List applications |
| POST | /api/identity/{tenantId}/applications | Create a application |
| GET | /api/identity/{tenantId}/applications/{id} | Get a application |
| DELETE | /api/identity/{tenantId}/applications/{id} | Delete a application |
| PATCH | /api/identity/{tenantId}/applications/{id} | Update a application |
| POST | /api/identity/{tenantId}/applications/{id}/redirect-uris | Add redirect URIs to an application |
| POST | /api/identity/{tenantId}/applications/{id}/redirect-uris/remove | Remove redirect URIs from an application |
| GET | /api/identity/{tenantId}/applications/{id}/secrets | List an application's secrets |
| POST | /api/identity/{tenantId}/applications/{id}/secrets | Create an application secret |
| POST | /api/identity/{tenantId}/applications/{id}/secrets/{secretId}/revoke | Revoke an application secret |
| PATCH | /api/identity/{tenantId}/applications/{id}/secrets/{secretId} | Update an application secret's expiry |
Webhooks
A tenant's webhook endpoints and delivery log
| Method | Path | Summary |
|---|
| GET | /api/identity/{tenantId}/webhooks/event-types | List the subscribable webhook event types |
| GET | /api/identity/{tenantId}/webhooks | List webhook endpoints |
| POST | /api/identity/{tenantId}/webhooks | Create a webhook endpoint |
| GET | /api/identity/{tenantId}/webhooks/{id} | Get a webhook endpoint |
| DELETE | /api/identity/{tenantId}/webhooks/{id} | Delete a webhook endpoint |
| PATCH | /api/identity/{tenantId}/webhooks/{id} | Update a webhook endpoint |
| GET | /api/identity/{tenantId}/webhooks/{id}/deliveries | List a webhook endpoint's deliveries |
| GET | /api/identity/{tenantId}/webhooks/{id}/deliveries/{deliveryId} | Get one webhook delivery |
| POST | /api/identity/{tenantId}/webhooks/{id}/deliveries/{deliveryId}/replay | Replay a webhook delivery |
| POST | /api/identity/{tenantId}/webhooks/{id}/deliveries/{deliveryId}/redrive | Redrive an exhausted webhook delivery |
| POST | /api/identity/{tenantId}/webhooks/{id}/test | Send a test event to a webhook endpoint |
| GET | /api/identity/{tenantId}/webhooks/{id}/secret | Reveal a webhook endpoint's signing secret |
| POST | /api/identity/{tenantId}/webhooks/{id}/secret/rotate | Rotate a webhook endpoint's signing secret |
Organizations
A tenant's organizations, memberships, and invitations, managed with tenant authority
| Method | Path | Summary |
|---|
| GET | /api/identity/{tenantId}/organizations | List organizations |
| POST | /api/identity/{tenantId}/organizations | Create an organization |
| GET | /api/identity/{tenantId}/organizations/{organizationId} | Get an organization |
| DELETE | /api/identity/{tenantId}/organizations/{organizationId} | Delete an organization |
| PATCH | /api/identity/{tenantId}/organizations/{organizationId} | Update an organization |
| GET | /api/identity/{tenantId}/organizations/{organizationId}/members | List an organization's members |
| DELETE | /api/identity/{tenantId}/organizations/{organizationId}/members/{userId}/{role} | Revoke an organization membership grant |
| GET | /api/identity/{tenantId}/organizations/{organizationId}/invitations | List an organization's invitations |
| POST | /api/identity/{tenantId}/organizations/{organizationId}/invitations | Invite an email address to an organization |
| DELETE | /api/identity/{tenantId}/organizations/{organizationId}/invitations/{invitationId} | Withdraw an organization invitation |
Self-serve organizations
The caller's own organizations — gated by their own membership, never tenant authority
| Method | Path | Summary |
|---|
| GET | /api/identity/organizations | List your organizations |
| POST | /api/identity/organizations | Create an organization |
| GET | /api/identity/organizations/offers | List the offers waiting for you |
| POST | /api/identity/organizations/offers/{offerId}/accept | Accept an offer made to you |
| GET | /api/identity/organizations/{organizationId} | Get an organization you belong to |
| DELETE | /api/identity/organizations/{organizationId} | Delete an organization you own |
| PATCH | /api/identity/organizations/{organizationId} | Update an organization you manage |
| GET | /api/identity/organizations/{organizationId}/members | List an organization's members |
| GET | /api/identity/organizations/{organizationId}/member-roles | List the roles an invitation may offer |
| DELETE | /api/identity/organizations/{organizationId}/members/{userId}/{role} | Revoke a member's role |
| POST | /api/identity/organizations/{organizationId}/members/{userId}/roles | Grant a member an application role here |
| DELETE | /api/identity/organizations/{organizationId}/members/{userId}/roles/{roleId} | Revoke an application role a member holds here |
| GET | /api/identity/organizations/{organizationId}/invitations | List the organization's invitations |
| POST | /api/identity/organizations/{organizationId}/invitations | Invite someone to the organization |
| DELETE | /api/identity/organizations/{organizationId}/invitations/{invitationId} | Withdraw an invitation |
| GET | /api/identity/organizations/{organizationId}/roles | List the organization's own roles |
| POST | /api/identity/organizations/{organizationId}/roles | Define one of the organization's own roles |
| GET | /api/identity/organizations/{organizationId}/roles/{roleId} | Get one of the organization's own roles |
| DELETE | /api/identity/organizations/{organizationId}/roles/{roleId} | Retire one of the organization's own roles |
| PATCH | /api/identity/organizations/{organizationId}/roles/{roleId} | Edit one of the organization's own roles |
Roles
The tenant's organization-role vocabulary
| Method | Path | Summary |
|---|
| GET | /api/identity/{tenantId}/organization-roles | List organization roles |
| POST | /api/identity/{tenantId}/organization-roles | Create an organization role |
| GET | /api/identity/{tenantId}/organization-roles/{roleId} | Get an organization role |
| DELETE | /api/identity/{tenantId}/organization-roles/{roleId} | Delete an organization role |
| PATCH | /api/identity/{tenantId}/organization-roles/{roleId} | Update an organization role |
Permissions
The tenant's customer permission registry — capability strings their own app interprets
| Method | Path | Summary |
|---|
| GET | /api/identity/{tenantId}/permissions | List permissions |
| POST | /api/identity/{tenantId}/permissions | Register a permission |
| GET | /api/identity/{tenantId}/permissions/{permissionId} | Get a permission |
| DELETE | /api/identity/{tenantId}/permissions/{permissionId} | Delete a permission |
| PATCH | /api/identity/{tenantId}/permissions/{permissionId} | Update a permission's description |
Administrators
Dashboard administrator seats and organization-held grants
| Method | Path | Summary |
|---|
| GET | /api/identity/administrators | List dashboard administrator seats |
| POST | /api/identity/administrators | Invite an administrator |
| POST | /api/identity/administrators/{userId}/grants | Grant an administrator further access |
| DELETE | /api/identity/administrators/{userId} | Revoke an administrator seat |
| GET | /api/identity/{tenantId}/administrators | List a tenant's administrators |
| DELETE | /api/identity/{tenantId}/administrators/organizations/{organizationId} | Revoke an organization's grant over the tenant |
Identity providers
A tenant's social and OpenID Connect sign-in connectors — configuration only; a client secret is never returned
| Method | Path | Summary |
|---|
| GET | /api/identity/{tenantId}/identity-providers | List identity providers |
| POST | /api/identity/{tenantId}/identity-providers | Configure an identity provider |
| GET | /api/identity/{tenantId}/identity-providers/{id} | Get an identity provider |
| DELETE | /api/identity/{tenantId}/identity-providers/{id} | Delete an identity provider |
| PATCH | /api/identity/{tenantId}/identity-providers/{id} | Update an identity provider |
Waitlist
A waitlisted tenant's sign-up queue — entries captured before they become users
| Method | Path | Summary |
|---|
| GET | /api/identity/{tenantId}/waitlist/{id} | Get a waitlist entry |
| DELETE | /api/identity/{tenantId}/waitlist/{id} | Remove a waitlist entry |
| GET | /api/identity/{tenantId}/waitlist | List waitlist entries |
| POST | /api/identity/{tenantId}/waitlist/notify-open | Email the waitlist that sign-up is open |
| POST | /api/identity/{tenantId}/waitlist/invite-all | Invite every pending waitlist entry |
| POST | /api/identity/{tenantId}/waitlist/{id}/invite | Approve a waitlist entry |
| POST | /api/identity/{tenantId}/waitlist/{id}/reinvite | Re-invite a waitlist entry |
| POST | /api/identity/{tenantId}/waitlist/{id}/deny | Deny a waitlist entry |
Account
The caller's own record
| Method | Path | Summary |
|---|
| GET | /api/account | Read your own user metadata |
| PATCH | /api/account | Update your own user metadata |
| GET | /api/account/sessions | List your active tenant login sessions |
| DELETE | /api/account/sessions/{sessionId} | Sign out one of your other devices |
| POST | /api/account/sessions/revoke-others | Sign out your other devices |
| GET | /api/account/linked-accounts | List your linked sign-in accounts |
| DELETE | /api/account/linked-accounts/{identityId} | Disconnect one of your linked sign-in accounts |
| PATCH | /api/identity/metadata | Update your own user metadata |
Audit log
A tenant's append-only audit log
| Method | Path | Summary |
|---|
| GET | /api/identity/{tenantId}/audit-events/export | Export the tenant's audit log |
| GET | /api/identity/{tenantId}/audit-events | List audit events |
Export
Own-your-data exports: the directory tier and the step-up-gated credential tier
| Method | Path | Summary |
|---|
| GET | /api/identity/{tenantId}/export/directory | Export the tenant's directory data |
| GET | /api/identity/{tenantId}/export/credentials | List the tenant's credential-export requests |
| POST | /api/identity/{tenantId}/export/credentials | Open a credential export |
| POST | /api/identity/{tenantId}/export/credentials/{id}/cancel | Cancel a credential export during its hold |
| GET | /api/identity/{tenantId}/export/credentials/{id}/download | Download a credential-export artifact |
Metrics
Dashboard overview aggregates
| Method | Path | Summary |
|---|
| GET | /api/identity/{tenantId}/metrics | Get the tenant's dashboard overview metrics |
Organizations in your application
The same caller-relative organizations, on the tenant's own origin, for a customer's application to call with its signed-in user's token — authority is that user's own membership, and no identity scope is required or accepted
| Method | Path | Summary |
|---|
| GET | /api/organizations | List your organizations |
| POST | /api/organizations | Create an organization |
| GET | /api/organizations/offers | List the offers waiting for you |
| POST | /api/organizations/offers/{offerId}/accept | Accept an offer made to you |
| GET | /api/organizations/{organizationId} | Get an organization you belong to |
| DELETE | /api/organizations/{organizationId} | Delete an organization you own |
| PATCH | /api/organizations/{organizationId} | Update an organization you manage |
| GET | /api/organizations/{organizationId}/members | List an organization's members |
| GET | /api/organizations/{organizationId}/member-roles | List the roles an invitation may offer |
| DELETE | /api/organizations/{organizationId}/members/{userId}/{role} | Revoke a member's role |
| POST | /api/organizations/{organizationId}/members/{userId}/roles | Grant a member an application role here |
| DELETE | /api/organizations/{organizationId}/members/{userId}/roles/{roleId} | Revoke an application role a member holds here |
| GET | /api/organizations/{organizationId}/invitations | List the organization's invitations |
| POST | /api/organizations/{organizationId}/invitations | Invite someone to the organization |
| DELETE | /api/organizations/{organizationId}/invitations/{invitationId} | Withdraw an invitation |
| GET | /api/organizations/{organizationId}/roles | List the organization's own roles |
| POST | /api/organizations/{organizationId}/roles | Define one of the organization's own roles |
| GET | /api/organizations/{organizationId}/roles/{roleId} | Get one of the organization's own roles |
| DELETE | /api/organizations/{organizationId}/roles/{roleId} | Retire one of the organization's own roles |
| PATCH | /api/organizations/{organizationId}/roles/{roleId} | Edit one of the organization's own roles |
Authorization
Authorization checks a tenant's own application makes for its signed-in user, on the tenant's own origin
| Method | Path | Summary |
|---|
| POST | /api/check | Check the caller's own permissions |
| POST | /api/check/batch | Check the caller's own permissions across many resources |
| GET | /api/memberships | List the caller's own organization memberships |
Usage limits
| Method | Path | Summary |
|---|
| GET | /api/identity/{tenantId}/usage-limits | Get the tenant's usage limits |
| PUT | /api/identity/{tenantId}/usage-limits | Replace the tenant's usage limits |
Resource types
| Method | Path | Summary |
|---|
| GET | /api/identity/{tenantId}/resource-types | List resource types |
| POST | /api/identity/{tenantId}/resource-types | Register a resource type |
| GET | /api/identity/{tenantId}/resource-types/{resourceTypeId} | Get a resource type |
| DELETE | /api/identity/{tenantId}/resource-types/{resourceTypeId} | Delete a resource type |
| PATCH | /api/identity/{tenantId}/resource-types/{resourceTypeId} | Update a resource type's description |
Resource grants
| Method | Path | Summary |
|---|
| GET | /api/identity/{tenantId}/resource-grants | List the grants on a resource |
| POST | /api/identity/{tenantId}/resource-grants | Grant a role on a resource |
| POST | /api/identity/{tenantId}/resource-grants/revoke | Revoke a role on a resource |
