Skip to content
Udibo
Join the waitlist

API reference

184 operations across 23 resources, generated from the Management API's OpenAPI document. The document itself is served at /api/openapi.

Choose an operation to inspect its servers, authentication requirements, parameters, request media types, and responses.

All operations

Define one of the organization's own roles

POST /api/organizations/{organizationId}/roles

Operation ID: createOwnOrganizationRoleOnTenantHost

The definition scope is forced from the path — a body-chosen `organizationId` is overwritten, so this surface can neither write the tenant-wide vocabulary nor another organization's roles. Requires the caller's own accepted `owner` or `admin` membership. A permission key the tenant's own registry does not define is refused 400. In Udibo's own tenant, carried permissions are further bounded by what the caller holds over every tenant the organization owns (the empty set when it owns nothing), so a held-by-nobody addition is refused 403; a customer tenant's registry is that customer's own vocabulary and carries no such bound, so there the registry is the whole bound.

Servers

  • https://{tenantId}.udibo.com

Authentication

Use every scheme in this requirement.

    • oauth2

      OAuth 2.0 authentication required

      No named scope is required by this scheme.

Check the description and required headers; this does not establish public access.

Parameters

ParameterRequirementDescription
organizationId
Required
path

The organization's id

string (uuid)

Request body

Required

  • application/json

Responses

StatusDescriptionMedia types
201

The defined role

  • application/json
400

The organization role content was refused; `fieldErrors` maps each offending field's dotted path to its message when fields could be named

  • application/problem+json
401

The request carried no credential (`error: access_denied`), or an expired or invalid one (`error: invalid_token`)

  • application/problem+json
403

The credential does not confer this operation: the token lacks the required scope (`error: insufficient_scope` with `requiredScope`), or an app-level rule refused (optionally with `reason`)

  • application/problem+json
404

No such organization — the same refusal whether the id is unknown, malformed, another tenant's, or one this caller may not read

  • application/problem+json
409

A role with this slug is already defined for this organization; `constraint` names the unique index

  • application/problem+json
413

The request body was over this operation's limit of 64 KiB (65536 bytes), counted as the bytes arrive whatever `Content-Length` declares. It is refused before the credential or the content is checked

  • application/problem+json

Full object schemas and examples are in the OpenAPI document.

Tenants

The tenants the caller administers

MethodPathSummary
GET/api/identity/tenants/{id}Get a tenant
PATCH/api/identity/tenants/{id}Update a tenant
GET/api/identity/tenantsList tenants
POST/api/identity/tenantsCreate a tenant
POST/api/identity/tenants/{id}/transfer-ownershipTransfer a tenant's ownership to an organization
GET/api/identity/{tenantId}/captchaGet the tenant's bot protection
PUT/api/identity/{tenantId}/captchaChoose the tenant's bot protection
DELETE/api/identity/{tenantId}/captcha/keysRemove the tenant's stored Turnstile keys
GET/api/identity/{tenantId}/email-senderGet the tenant's email sender
PUT/api/identity/{tenantId}/email-senderConfigure the tenant's email sender
DELETE/api/identity/{tenantId}/email-senderClear the tenant's email sender
POST/api/identity/{tenantId}/email-sender/verifyRefresh the email sender's domain verification

Users

A tenant's end users

MethodPathSummary
GET/api/identity/{tenantId}/users/exportExport the tenant's user directory
GET/api/identity/{tenantId}/usersList users
POST/api/identity/{tenantId}/usersCreate a user
GET/api/identity/{tenantId}/users/{id}Get a user
DELETE/api/identity/{tenantId}/users/{id}Delete a user
PATCH/api/identity/{tenantId}/users/{id}Update a user
POST/api/identity/{tenantId}/users/{id}/verify-emailMark a user's email address verified
POST/api/identity/{tenantId}/users/{id}/send-verificationSend a user an email-verification message
POST/api/identity/{tenantId}/users/{id}/send-resetSend a user a password-reset message
POST/api/identity/{tenantId}/users/{id}/passwordSet a user's password
POST/api/identity/{tenantId}/users/{id}/disableDisable a user's account
POST/api/identity/{tenantId}/users/{id}/enableRe-enable a disabled user's account
POST/api/identity/{tenantId}/users/{id}/impersonateStart a support impersonation of a user
POST/api/identity/{tenantId}/users/{id}/sessions/revokeRevoke all of a user's sessions
POST/api/identity/{tenantId}/users/{id}/sessions/{sessionId}/revokeRevoke one of a user's sessions
POST/api/identity/{tenantId}/users/{id}/unsuspendRestore a suspended (soft-deleted) user
GET/api/identity/{tenantId}/users/{id}/rolesList the roles a user holds
POST/api/identity/{tenantId}/users/{id}/rolesAssign a role to a user
DELETE/api/identity/{tenantId}/users/{id}/roles/{roleId}Revoke a role from a user
POST/api/identity/{tenantId}/users/{id}/reset-mfaReset a user's MFA enrollment

Applications

A tenant's OAuth2 applications and their secrets

MethodPathSummary
GET/api/identity/{tenantId}/applicationsList applications
POST/api/identity/{tenantId}/applicationsCreate a application
GET/api/identity/{tenantId}/applications/{id}Get a application
DELETE/api/identity/{tenantId}/applications/{id}Delete a application
PATCH/api/identity/{tenantId}/applications/{id}Update a application
GET/api/identity/{tenantId}/applications/{id}/machine-permissionsRead a machine application's management permissions
PUT/api/identity/{tenantId}/applications/{id}/machine-permissionsSet a machine application's management permissions
POST/api/identity/{tenantId}/applications/{id}/redirect-urisAdd redirect URIs to an application
POST/api/identity/{tenantId}/applications/{id}/redirect-uris/removeRemove redirect URIs from an application
GET/api/identity/{tenantId}/applications/{id}/secretsList an application's secrets
POST/api/identity/{tenantId}/applications/{id}/secretsCreate an application secret
POST/api/identity/{tenantId}/applications/{id}/secrets/{secretId}/revokeRevoke an application secret
PATCH/api/identity/{tenantId}/applications/{id}/secrets/{secretId}Update an application secret's expiry

Webhooks

A tenant's webhook endpoints and delivery log

MethodPathSummary
GET/api/identity/{tenantId}/webhooks/event-typesList the subscribable webhook event types
GET/api/identity/{tenantId}/webhooksList webhook endpoints
POST/api/identity/{tenantId}/webhooksCreate a webhook endpoint
GET/api/identity/{tenantId}/webhooks/{id}Get a webhook endpoint
DELETE/api/identity/{tenantId}/webhooks/{id}Delete a webhook endpoint
PATCH/api/identity/{tenantId}/webhooks/{id}Update a webhook endpoint
GET/api/identity/{tenantId}/webhooks/{id}/deliveriesList a webhook endpoint's deliveries
GET/api/identity/{tenantId}/webhooks/{id}/deliveries/{deliveryId}Get one webhook delivery
POST/api/identity/{tenantId}/webhooks/{id}/deliveries/{deliveryId}/replayReplay a webhook delivery
POST/api/identity/{tenantId}/webhooks/{id}/deliveries/{deliveryId}/redriveRedrive an exhausted webhook delivery
POST/api/identity/{tenantId}/webhooks/{id}/testSend a test event to a webhook endpoint
GET/api/identity/{tenantId}/webhooks/{id}/secretReveal a webhook endpoint's signing secret
POST/api/identity/{tenantId}/webhooks/{id}/secret/rotateRotate a webhook endpoint's signing secret

Organizations

A tenant's organizations, memberships, and invitations, managed with tenant authority

MethodPathSummary
GET/api/identity/{tenantId}/organizationsList organizations
POST/api/identity/{tenantId}/organizationsCreate an organization
GET/api/identity/{tenantId}/organizations/{organizationId}Get an organization
DELETE/api/identity/{tenantId}/organizations/{organizationId}Delete an organization
PATCH/api/identity/{tenantId}/organizations/{organizationId}Update an organization
GET/api/identity/{tenantId}/organizations/{organizationId}/membersList an organization's members
GET/api/identity/{tenantId}/organizations/{organizationId}/member-countCount an organization's memberships
DELETE/api/identity/{tenantId}/organizations/{organizationId}/members/{userId}/{role}Revoke an organization membership grant
GET/api/identity/{tenantId}/organizations/{organizationId}/invitationsList an organization's invitations
POST/api/identity/{tenantId}/organizations/{organizationId}/invitationsInvite an email address to an organization
DELETE/api/identity/{tenantId}/organizations/{organizationId}/invitations/{invitationId}Withdraw an organization invitation

Self-serve organizations

The caller's own organizations — gated by their own membership, never tenant authority

MethodPathSummary
GET/api/identity/organizationsList your organizations
POST/api/identity/organizationsCreate an organization
GET/api/identity/organizations/offersList the offers waiting for you
POST/api/identity/organizations/offers/{offerId}/acceptAccept an offer made to you
GET/api/identity/organizations/{organizationId}Get an organization you belong to
DELETE/api/identity/organizations/{organizationId}Delete an organization you own
PATCH/api/identity/organizations/{organizationId}Update an organization you manage
GET/api/identity/organizations/{organizationId}/membersList an organization's members
GET/api/identity/organizations/{organizationId}/member-rolesList the roles an invitation may offer
DELETE/api/identity/organizations/{organizationId}/members/{userId}/{role}Revoke a member's role
GET/api/identity/organizations/{organizationId}/members/{userId}/rolesList the application roles a member holds here
POST/api/identity/organizations/{organizationId}/members/{userId}/rolesGrant a member an application role here
DELETE/api/identity/organizations/{organizationId}/members/{userId}/roles/{roleId}Revoke an application role a member holds here
GET/api/identity/organizations/{organizationId}/invitationsList the organization's invitations
POST/api/identity/organizations/{organizationId}/invitationsInvite someone to the organization
DELETE/api/identity/organizations/{organizationId}/invitations/{invitationId}Withdraw an invitation
GET/api/identity/organizations/{organizationId}/rolesList the organization's own roles
POST/api/identity/organizations/{organizationId}/rolesDefine one of the organization's own roles
GET/api/identity/organizations/{organizationId}/roles/{roleId}Get one of the organization's own roles
DELETE/api/identity/organizations/{organizationId}/roles/{roleId}Retire one of the organization's own roles
PATCH/api/identity/organizations/{organizationId}/roles/{roleId}Edit one of the organization's own roles

Roles

The tenant's organization-role vocabulary

MethodPathSummary
GET/api/identity/{tenantId}/organization-rolesList organization roles
POST/api/identity/{tenantId}/organization-rolesCreate an organization role
GET/api/identity/{tenantId}/organization-roles/{roleId}Get an organization role
DELETE/api/identity/{tenantId}/organization-roles/{roleId}Delete an organization role
PATCH/api/identity/{tenantId}/organization-roles/{roleId}Update an organization role

Permissions

The tenant's customer permission registry — capability strings their own app interprets

MethodPathSummary
GET/api/identity/{tenantId}/permissionsList permissions
POST/api/identity/{tenantId}/permissionsRegister a permission
GET/api/identity/{tenantId}/permissions/{permissionId}Get a permission
DELETE/api/identity/{tenantId}/permissions/{permissionId}Delete a permission
PATCH/api/identity/{tenantId}/permissions/{permissionId}Update a permission's description

Administrators

Dashboard administrator seats and organization-held grants

MethodPathSummary
GET/api/identity/administratorsList dashboard administrator seats
POST/api/identity/administratorsInvite an administrator
POST/api/identity/administrators/{userId}/grantsGrant an administrator further access
DELETE/api/identity/administrators/{userId}Revoke an administrator seat
GET/api/identity/{tenantId}/administratorsList a tenant's administrators
POST/api/identity/{tenantId}/administratorsInvite an administrator to a tenant
POST/api/identity/{tenantId}/administrators/{userId}/grantsGrant a tenant administrator further access
DELETE/api/identity/{tenantId}/administrators/{userId}Revoke a tenant administrator's seat
DELETE/api/identity/{tenantId}/administrators/organizations/{organizationId}Revoke an organization's grant over the tenant

Identity providers

A tenant's social and OpenID Connect sign-in connectors — configuration only; a client secret is never returned

MethodPathSummary
GET/api/identity/{tenantId}/identity-providersList identity providers
POST/api/identity/{tenantId}/identity-providersConfigure an identity provider
GET/api/identity/{tenantId}/identity-providers/{id}Get an identity provider
DELETE/api/identity/{tenantId}/identity-providers/{id}Delete an identity provider
PATCH/api/identity/{tenantId}/identity-providers/{id}Update an identity provider

Waitlist

A waitlisted tenant's sign-up queue — entries captured before they become users

MethodPathSummary
GET/api/identity/{tenantId}/waitlist/summarySummarize the waitlist queue
GET/api/identity/{tenantId}/waitlist/{id}Get a waitlist entry
DELETE/api/identity/{tenantId}/waitlist/{id}Remove a waitlist entry
GET/api/identity/{tenantId}/waitlistList waitlist entries
POST/api/identity/{tenantId}/waitlist/notify-openEmail the waitlist that sign-up is open
POST/api/identity/{tenantId}/waitlist/invite-allInvite every pending waitlist entry
POST/api/identity/{tenantId}/waitlist/{id}/inviteApprove a waitlist entry
POST/api/identity/{tenantId}/waitlist/{id}/reinviteRe-invite a waitlist entry
POST/api/identity/{tenantId}/waitlist/{id}/denyDeny a waitlist entry
GET/api/signupRead the tenant's sign-up posture
POST/api/waitlistJoin the tenant's waitlist
POST/api/waitlist/removal-requestsAsk for a waitlist removal link
POST/api/waitlist/removalsRemove an address with its emailed token

Account

The caller's own record

MethodPathSummary
GET/api/accountRead your own user metadata
PATCH/api/accountUpdate your own user metadata
GET/api/account/linked-accountsList your linked sign-in accounts
DELETE/api/account/linked-accounts/{identityId}Disconnect one of your linked sign-in accounts
GET/api/account/sessionsList your active tenant login sessions
DELETE/api/account/sessions/{sessionId}Sign out one of your other devices
POST/api/account/sessions/revoke-othersSign out your other devices
PATCH/api/identity/metadataUpdate your own user metadata

Audit log

A tenant's append-only audit log

MethodPathSummary
GET/api/identity/{tenantId}/audit-events/exportExport the tenant's audit log
GET/api/identity/{tenantId}/audit-eventsList audit events

Export

Own-your-data exports: the directory tier and the step-up-gated credential tier

MethodPathSummary
GET/api/identity/{tenantId}/export/directoryExport the tenant's directory data
GET/api/identity/{tenantId}/export/credentialsList the tenant's credential-export requests
POST/api/identity/{tenantId}/export/credentialsOpen a credential export
POST/api/identity/{tenantId}/export/credentials/{id}/cancelCancel a credential export during its hold
GET/api/identity/{tenantId}/export/credentials/{id}/downloadDownload a credential-export artifact

Metrics

Dashboard overview aggregates

MethodPathSummary
GET/api/identity/{tenantId}/metricsGet the tenant's dashboard overview metrics

Organizations in your application

The same caller-relative organizations, on the tenant's own origin, for a customer's application to call with its signed-in user's token — authority is that user's own membership, and no identity scope is required or accepted

MethodPathSummary
GET/api/organizationsList your organizations
POST/api/organizationsCreate an organization
GET/api/organizations/offersList the offers waiting for you
POST/api/organizations/offers/{offerId}/acceptAccept an offer made to you
GET/api/organizations/{organizationId}Get an organization you belong to
DELETE/api/organizations/{organizationId}Delete an organization you own
PATCH/api/organizations/{organizationId}Update an organization you manage
GET/api/organizations/{organizationId}/membersList an organization's members
GET/api/organizations/{organizationId}/member-rolesList the roles an invitation may offer
DELETE/api/organizations/{organizationId}/members/{userId}/{role}Revoke a member's role
GET/api/organizations/{organizationId}/members/{userId}/rolesList the application roles a member holds here
POST/api/organizations/{organizationId}/members/{userId}/rolesGrant a member an application role here
DELETE/api/organizations/{organizationId}/members/{userId}/roles/{roleId}Revoke an application role a member holds here
GET/api/organizations/{organizationId}/invitationsList the organization's invitations
POST/api/organizations/{organizationId}/invitationsInvite someone to the organization
DELETE/api/organizations/{organizationId}/invitations/{invitationId}Withdraw an invitation
GET/api/organizations/{organizationId}/rolesList the organization's own roles
POST/api/organizations/{organizationId}/rolesDefine one of the organization's own roles
GET/api/organizations/{organizationId}/roles/{roleId}Get one of the organization's own roles
DELETE/api/organizations/{organizationId}/roles/{roleId}Retire one of the organization's own roles
PATCH/api/organizations/{organizationId}/roles/{roleId}Edit one of the organization's own roles

Resource grants in your application

Who holds which of a tenant's roles on one of its resources, read and written by that tenant's own application with its own machine credential — the application is the authority and an end user's token is refused

MethodPathSummary
GET/api/resource-grantsList the grants on one of your resources
POST/api/resource-grantsGrant one of your roles on one of your resources
POST/api/resource-grants/revokeRevoke a role on one of your resources

Authorization

Authorization checks a tenant's own application makes for its signed-in user, on the tenant's own origin

MethodPathSummary
POST/api/checkCheck the caller's own permissions
POST/api/check/batchCheck the caller's own permissions across many resources
GET/api/membershipsList the caller's own organization memberships

Billing

MethodPathSummary
GET/api/identity/{tenantId}/billingGet the tenant's plan and the month so far
GET/api/identity/{tenantId}/billing/invoicesList the tenant's invoices

Resource grants

MethodPathSummary
GET/api/identity/{tenantId}/resource-grantsList the grants on a resource
POST/api/identity/{tenantId}/resource-grantsGrant a role on a resource
POST/api/identity/{tenantId}/resource-grants/revokeRevoke a role on a resource

Resource types

MethodPathSummary
GET/api/identity/{tenantId}/resource-typesList resource types
POST/api/identity/{tenantId}/resource-typesRegister a resource type
GET/api/identity/{tenantId}/resource-types/{resourceTypeId}Get a resource type
DELETE/api/identity/{tenantId}/resource-types/{resourceTypeId}Delete a resource type
PATCH/api/identity/{tenantId}/resource-types/{resourceTypeId}Update a resource type's description

Usage limits

MethodPathSummary
GET/api/identity/{tenantId}/usage-limitsGet the tenant's usage limits
PUT/api/identity/{tenantId}/usage-limitsReplace the tenant's usage limits
POST/api/identity/{tenantId}/usage-limits/confirmationsSend a nominated alert recipient its confirmation again

system

MethodPathSummary
GET/api/healthService health