Skip to content
Udibo
Join the waitlist

API reference

184 operations across 23 resources, generated from the Management API's OpenAPI document. The document itself is served at /api/openapi.

Choose an operation to inspect its servers, authentication requirements, parameters, request media types, and responses.

All operations

Approve a waitlist entry

POST /api/identity/{tenantId}/waitlist/{id}/invite

Operation ID: inviteWaitlistEntry

Mints the entry a single-use invitation (14-day expiry) and emails it a link to the tenant's own `/create-account`. Accepts a pending or denied entry — approving a denied one clears the denial. The raw invite token travels only in that email: the response is the entry's read shape, which carries neither the token nor its stored hash. Approve and re-invite share a per-entry budget of five mints an hour.

Servers

  • https://www.udibo.com

    Production

Authentication

Use every scheme in this requirement.

    • oauth2

      OAuth 2.0 authentication required

      Required scopes:

      • identity:waitlist:write

Check the description and required headers; this does not establish public access.

Parameters

ParameterRequirementDescription
tenantId
Required
path

The tenant this operation acts on. The caller must hold admin authority over it; every refusal — no authority, unknown, malformed — is the same 404

string (uuid)
id
Required
path

The waitlist entry's id

string (uuid)

Request body

No request body is declared.

Responses

StatusDescriptionMedia types
200

The entry, now invited

  • application/json
401

The request carried no credential (`error: access_denied`), or an expired or invalid one (`error: invalid_token`)

  • application/problem+json
403

The credential does not confer this operation: the token lacks the required scope (`error: insufficient_scope` with `requiredScope`), or an app-level rule refused (optionally with `reason`). A dashboard-session call without the `x-csrf` header is refused before the operation runs, as plain JSON

  • application/problem+json
  • application/json
404

No such waitlist entry — the same refusal whether the id is unknown, malformed, another tenant's, or one this caller may not read

  • application/problem+json
409

The entry is already invited (use re-invite to rotate it) or already accepted

  • application/problem+json
429

This entry's hourly invitation budget is spent; nothing was minted or emailed

  • application/problem+json

Full object schemas and examples are in the OpenAPI document.

Tenants

The tenants the caller administers

MethodPathSummary
GET/api/identity/tenants/{id}Get a tenant
PATCH/api/identity/tenants/{id}Update a tenant
GET/api/identity/tenantsList tenants
POST/api/identity/tenantsCreate a tenant
POST/api/identity/tenants/{id}/transfer-ownershipTransfer a tenant's ownership to an organization
GET/api/identity/{tenantId}/captchaGet the tenant's bot protection
PUT/api/identity/{tenantId}/captchaChoose the tenant's bot protection
DELETE/api/identity/{tenantId}/captcha/keysRemove the tenant's stored Turnstile keys
GET/api/identity/{tenantId}/email-senderGet the tenant's email sender
PUT/api/identity/{tenantId}/email-senderConfigure the tenant's email sender
DELETE/api/identity/{tenantId}/email-senderClear the tenant's email sender
POST/api/identity/{tenantId}/email-sender/verifyRefresh the email sender's domain verification

Users

A tenant's end users

MethodPathSummary
GET/api/identity/{tenantId}/users/exportExport the tenant's user directory
GET/api/identity/{tenantId}/usersList users
POST/api/identity/{tenantId}/usersCreate a user
GET/api/identity/{tenantId}/users/{id}Get a user
DELETE/api/identity/{tenantId}/users/{id}Delete a user
PATCH/api/identity/{tenantId}/users/{id}Update a user
POST/api/identity/{tenantId}/users/{id}/verify-emailMark a user's email address verified
POST/api/identity/{tenantId}/users/{id}/send-verificationSend a user an email-verification message
POST/api/identity/{tenantId}/users/{id}/send-resetSend a user a password-reset message
POST/api/identity/{tenantId}/users/{id}/passwordSet a user's password
POST/api/identity/{tenantId}/users/{id}/disableDisable a user's account
POST/api/identity/{tenantId}/users/{id}/enableRe-enable a disabled user's account
POST/api/identity/{tenantId}/users/{id}/impersonateStart a support impersonation of a user
POST/api/identity/{tenantId}/users/{id}/sessions/revokeRevoke all of a user's sessions
POST/api/identity/{tenantId}/users/{id}/sessions/{sessionId}/revokeRevoke one of a user's sessions
POST/api/identity/{tenantId}/users/{id}/unsuspendRestore a suspended (soft-deleted) user
GET/api/identity/{tenantId}/users/{id}/rolesList the roles a user holds
POST/api/identity/{tenantId}/users/{id}/rolesAssign a role to a user
DELETE/api/identity/{tenantId}/users/{id}/roles/{roleId}Revoke a role from a user
POST/api/identity/{tenantId}/users/{id}/reset-mfaReset a user's MFA enrollment

Applications

A tenant's OAuth2 applications and their secrets

MethodPathSummary
GET/api/identity/{tenantId}/applicationsList applications
POST/api/identity/{tenantId}/applicationsCreate a application
GET/api/identity/{tenantId}/applications/{id}Get a application
DELETE/api/identity/{tenantId}/applications/{id}Delete a application
PATCH/api/identity/{tenantId}/applications/{id}Update a application
GET/api/identity/{tenantId}/applications/{id}/machine-permissionsRead a machine application's management permissions
PUT/api/identity/{tenantId}/applications/{id}/machine-permissionsSet a machine application's management permissions
POST/api/identity/{tenantId}/applications/{id}/redirect-urisAdd redirect URIs to an application
POST/api/identity/{tenantId}/applications/{id}/redirect-uris/removeRemove redirect URIs from an application
GET/api/identity/{tenantId}/applications/{id}/secretsList an application's secrets
POST/api/identity/{tenantId}/applications/{id}/secretsCreate an application secret
POST/api/identity/{tenantId}/applications/{id}/secrets/{secretId}/revokeRevoke an application secret
PATCH/api/identity/{tenantId}/applications/{id}/secrets/{secretId}Update an application secret's expiry

Webhooks

A tenant's webhook endpoints and delivery log

MethodPathSummary
GET/api/identity/{tenantId}/webhooks/event-typesList the subscribable webhook event types
GET/api/identity/{tenantId}/webhooksList webhook endpoints
POST/api/identity/{tenantId}/webhooksCreate a webhook endpoint
GET/api/identity/{tenantId}/webhooks/{id}Get a webhook endpoint
DELETE/api/identity/{tenantId}/webhooks/{id}Delete a webhook endpoint
PATCH/api/identity/{tenantId}/webhooks/{id}Update a webhook endpoint
GET/api/identity/{tenantId}/webhooks/{id}/deliveriesList a webhook endpoint's deliveries
GET/api/identity/{tenantId}/webhooks/{id}/deliveries/{deliveryId}Get one webhook delivery
POST/api/identity/{tenantId}/webhooks/{id}/deliveries/{deliveryId}/replayReplay a webhook delivery
POST/api/identity/{tenantId}/webhooks/{id}/deliveries/{deliveryId}/redriveRedrive an exhausted webhook delivery
POST/api/identity/{tenantId}/webhooks/{id}/testSend a test event to a webhook endpoint
GET/api/identity/{tenantId}/webhooks/{id}/secretReveal a webhook endpoint's signing secret
POST/api/identity/{tenantId}/webhooks/{id}/secret/rotateRotate a webhook endpoint's signing secret

Organizations

A tenant's organizations, memberships, and invitations, managed with tenant authority

MethodPathSummary
GET/api/identity/{tenantId}/organizationsList organizations
POST/api/identity/{tenantId}/organizationsCreate an organization
GET/api/identity/{tenantId}/organizations/{organizationId}Get an organization
DELETE/api/identity/{tenantId}/organizations/{organizationId}Delete an organization
PATCH/api/identity/{tenantId}/organizations/{organizationId}Update an organization
GET/api/identity/{tenantId}/organizations/{organizationId}/membersList an organization's members
GET/api/identity/{tenantId}/organizations/{organizationId}/member-countCount an organization's memberships
DELETE/api/identity/{tenantId}/organizations/{organizationId}/members/{userId}/{role}Revoke an organization membership grant
GET/api/identity/{tenantId}/organizations/{organizationId}/invitationsList an organization's invitations
POST/api/identity/{tenantId}/organizations/{organizationId}/invitationsInvite an email address to an organization
DELETE/api/identity/{tenantId}/organizations/{organizationId}/invitations/{invitationId}Withdraw an organization invitation

Self-serve organizations

The caller's own organizations — gated by their own membership, never tenant authority

MethodPathSummary
GET/api/identity/organizationsList your organizations
POST/api/identity/organizationsCreate an organization
GET/api/identity/organizations/offersList the offers waiting for you
POST/api/identity/organizations/offers/{offerId}/acceptAccept an offer made to you
GET/api/identity/organizations/{organizationId}Get an organization you belong to
DELETE/api/identity/organizations/{organizationId}Delete an organization you own
PATCH/api/identity/organizations/{organizationId}Update an organization you manage
GET/api/identity/organizations/{organizationId}/membersList an organization's members
GET/api/identity/organizations/{organizationId}/member-rolesList the roles an invitation may offer
DELETE/api/identity/organizations/{organizationId}/members/{userId}/{role}Revoke a member's role
GET/api/identity/organizations/{organizationId}/members/{userId}/rolesList the application roles a member holds here
POST/api/identity/organizations/{organizationId}/members/{userId}/rolesGrant a member an application role here
DELETE/api/identity/organizations/{organizationId}/members/{userId}/roles/{roleId}Revoke an application role a member holds here
GET/api/identity/organizations/{organizationId}/invitationsList the organization's invitations
POST/api/identity/organizations/{organizationId}/invitationsInvite someone to the organization
DELETE/api/identity/organizations/{organizationId}/invitations/{invitationId}Withdraw an invitation
GET/api/identity/organizations/{organizationId}/rolesList the organization's own roles
POST/api/identity/organizations/{organizationId}/rolesDefine one of the organization's own roles
GET/api/identity/organizations/{organizationId}/roles/{roleId}Get one of the organization's own roles
DELETE/api/identity/organizations/{organizationId}/roles/{roleId}Retire one of the organization's own roles
PATCH/api/identity/organizations/{organizationId}/roles/{roleId}Edit one of the organization's own roles

Roles

The tenant's organization-role vocabulary

MethodPathSummary
GET/api/identity/{tenantId}/organization-rolesList organization roles
POST/api/identity/{tenantId}/organization-rolesCreate an organization role
GET/api/identity/{tenantId}/organization-roles/{roleId}Get an organization role
DELETE/api/identity/{tenantId}/organization-roles/{roleId}Delete an organization role
PATCH/api/identity/{tenantId}/organization-roles/{roleId}Update an organization role

Permissions

The tenant's customer permission registry — capability strings their own app interprets

MethodPathSummary
GET/api/identity/{tenantId}/permissionsList permissions
POST/api/identity/{tenantId}/permissionsRegister a permission
GET/api/identity/{tenantId}/permissions/{permissionId}Get a permission
DELETE/api/identity/{tenantId}/permissions/{permissionId}Delete a permission
PATCH/api/identity/{tenantId}/permissions/{permissionId}Update a permission's description

Administrators

Dashboard administrator seats and organization-held grants

MethodPathSummary
GET/api/identity/administratorsList dashboard administrator seats
POST/api/identity/administratorsInvite an administrator
POST/api/identity/administrators/{userId}/grantsGrant an administrator further access
DELETE/api/identity/administrators/{userId}Revoke an administrator seat
GET/api/identity/{tenantId}/administratorsList a tenant's administrators
POST/api/identity/{tenantId}/administratorsInvite an administrator to a tenant
POST/api/identity/{tenantId}/administrators/{userId}/grantsGrant a tenant administrator further access
DELETE/api/identity/{tenantId}/administrators/{userId}Revoke a tenant administrator's seat
DELETE/api/identity/{tenantId}/administrators/organizations/{organizationId}Revoke an organization's grant over the tenant

Identity providers

A tenant's social and OpenID Connect sign-in connectors — configuration only; a client secret is never returned

MethodPathSummary
GET/api/identity/{tenantId}/identity-providersList identity providers
POST/api/identity/{tenantId}/identity-providersConfigure an identity provider
GET/api/identity/{tenantId}/identity-providers/{id}Get an identity provider
DELETE/api/identity/{tenantId}/identity-providers/{id}Delete an identity provider
PATCH/api/identity/{tenantId}/identity-providers/{id}Update an identity provider

Waitlist

A waitlisted tenant's sign-up queue — entries captured before they become users

MethodPathSummary
GET/api/identity/{tenantId}/waitlist/summarySummarize the waitlist queue
GET/api/identity/{tenantId}/waitlist/{id}Get a waitlist entry
DELETE/api/identity/{tenantId}/waitlist/{id}Remove a waitlist entry
GET/api/identity/{tenantId}/waitlistList waitlist entries
POST/api/identity/{tenantId}/waitlist/notify-openEmail the waitlist that sign-up is open
POST/api/identity/{tenantId}/waitlist/invite-allInvite every pending waitlist entry
POST/api/identity/{tenantId}/waitlist/{id}/inviteApprove a waitlist entry
POST/api/identity/{tenantId}/waitlist/{id}/reinviteRe-invite a waitlist entry
POST/api/identity/{tenantId}/waitlist/{id}/denyDeny a waitlist entry
GET/api/signupRead the tenant's sign-up posture
POST/api/waitlistJoin the tenant's waitlist
POST/api/waitlist/removal-requestsAsk for a waitlist removal link
POST/api/waitlist/removalsRemove an address with its emailed token

Account

The caller's own record

MethodPathSummary
GET/api/accountRead your own user metadata
PATCH/api/accountUpdate your own user metadata
GET/api/account/linked-accountsList your linked sign-in accounts
DELETE/api/account/linked-accounts/{identityId}Disconnect one of your linked sign-in accounts
GET/api/account/sessionsList your active tenant login sessions
DELETE/api/account/sessions/{sessionId}Sign out one of your other devices
POST/api/account/sessions/revoke-othersSign out your other devices
PATCH/api/identity/metadataUpdate your own user metadata

Audit log

A tenant's append-only audit log

MethodPathSummary
GET/api/identity/{tenantId}/audit-events/exportExport the tenant's audit log
GET/api/identity/{tenantId}/audit-eventsList audit events

Export

Own-your-data exports: the directory tier and the step-up-gated credential tier

MethodPathSummary
GET/api/identity/{tenantId}/export/directoryExport the tenant's directory data
GET/api/identity/{tenantId}/export/credentialsList the tenant's credential-export requests
POST/api/identity/{tenantId}/export/credentialsOpen a credential export
POST/api/identity/{tenantId}/export/credentials/{id}/cancelCancel a credential export during its hold
GET/api/identity/{tenantId}/export/credentials/{id}/downloadDownload a credential-export artifact

Metrics

Dashboard overview aggregates

MethodPathSummary
GET/api/identity/{tenantId}/metricsGet the tenant's dashboard overview metrics

Organizations in your application

The same caller-relative organizations, on the tenant's own origin, for a customer's application to call with its signed-in user's token — authority is that user's own membership, and no identity scope is required or accepted

MethodPathSummary
GET/api/organizationsList your organizations
POST/api/organizationsCreate an organization
GET/api/organizations/offersList the offers waiting for you
POST/api/organizations/offers/{offerId}/acceptAccept an offer made to you
GET/api/organizations/{organizationId}Get an organization you belong to
DELETE/api/organizations/{organizationId}Delete an organization you own
PATCH/api/organizations/{organizationId}Update an organization you manage
GET/api/organizations/{organizationId}/membersList an organization's members
GET/api/organizations/{organizationId}/member-rolesList the roles an invitation may offer
DELETE/api/organizations/{organizationId}/members/{userId}/{role}Revoke a member's role
GET/api/organizations/{organizationId}/members/{userId}/rolesList the application roles a member holds here
POST/api/organizations/{organizationId}/members/{userId}/rolesGrant a member an application role here
DELETE/api/organizations/{organizationId}/members/{userId}/roles/{roleId}Revoke an application role a member holds here
GET/api/organizations/{organizationId}/invitationsList the organization's invitations
POST/api/organizations/{organizationId}/invitationsInvite someone to the organization
DELETE/api/organizations/{organizationId}/invitations/{invitationId}Withdraw an invitation
GET/api/organizations/{organizationId}/rolesList the organization's own roles
POST/api/organizations/{organizationId}/rolesDefine one of the organization's own roles
GET/api/organizations/{organizationId}/roles/{roleId}Get one of the organization's own roles
DELETE/api/organizations/{organizationId}/roles/{roleId}Retire one of the organization's own roles
PATCH/api/organizations/{organizationId}/roles/{roleId}Edit one of the organization's own roles

Resource grants in your application

Who holds which of a tenant's roles on one of its resources, read and written by that tenant's own application with its own machine credential — the application is the authority and an end user's token is refused

MethodPathSummary
GET/api/resource-grantsList the grants on one of your resources
POST/api/resource-grantsGrant one of your roles on one of your resources
POST/api/resource-grants/revokeRevoke a role on one of your resources

Authorization

Authorization checks a tenant's own application makes for its signed-in user, on the tenant's own origin

MethodPathSummary
POST/api/checkCheck the caller's own permissions
POST/api/check/batchCheck the caller's own permissions across many resources
GET/api/membershipsList the caller's own organization memberships

Billing

MethodPathSummary
GET/api/identity/{tenantId}/billingGet the tenant's plan and the month so far
GET/api/identity/{tenantId}/billing/invoicesList the tenant's invoices

Resource grants

MethodPathSummary
GET/api/identity/{tenantId}/resource-grantsList the grants on a resource
POST/api/identity/{tenantId}/resource-grantsGrant a role on a resource
POST/api/identity/{tenantId}/resource-grants/revokeRevoke a role on a resource

Resource types

MethodPathSummary
GET/api/identity/{tenantId}/resource-typesList resource types
POST/api/identity/{tenantId}/resource-typesRegister a resource type
GET/api/identity/{tenantId}/resource-types/{resourceTypeId}Get a resource type
DELETE/api/identity/{tenantId}/resource-types/{resourceTypeId}Delete a resource type
PATCH/api/identity/{tenantId}/resource-types/{resourceTypeId}Update a resource type's description

Usage limits

MethodPathSummary
GET/api/identity/{tenantId}/usage-limitsGet the tenant's usage limits
PUT/api/identity/{tenantId}/usage-limitsReplace the tenant's usage limits
POST/api/identity/{tenantId}/usage-limits/confirmationsSend a nominated alert recipient its confirmation again

system

MethodPathSummary
GET/api/healthService health