API reference

184 operations across 23 resources, generated from the Management API's OpenAPI document. The document itself is served at /api/openapi.

Choose an operation to inspect its servers, authentication requirements, parameters, request media types, and responses.

All operations

List waitlist entries

GET /api/identity/{tenantId}/waitlist

Operation ID: listWaitlistEntries

One page of the tenant's waitlist queue. An entry's status is derived from its timestamps, never stored, so the filter selects on the same derivation the entries report.

Servers

https://www.udibo.com
Production

Authentication

Use every scheme in this requirement.

- oauth2
  OAuth 2.0 authentication required
  Required scopes:
  - identity:waitlist:read

Check the description and required headers; this does not establish public access.

Parameters

Parameter	Requirement	Description
`tenantId`	Required path	The tenant this operation acts on. The caller must hold admin authority over it; every refusal — no authority, unknown, malformed — is the same 404 string (uuid)
`cursor`	Optional query	Opaque pagination cursor from a previous page's `cursors.next` or `cursors.prev`; paging direction travels inside the cursor. The sort is checked against the cursor, not taken from it — repeat the `orderBy` and `orderDirection` the first page used; a cursor cut on another column or in the other direction is refused with a 400 rather than silently restarting the list or walking the rows the wrong way string
`limit`	Optional query	Items per page (default 20). A value above 100 is clamped to 100; a value that is not a whole number of at least 1 is refused with a 400 integer; minimum 1; maximum 100; default 20
`orderBy`	Optional query	Column to sort by (default `id`). Any other value is refused with a 400 naming `orderBy` rather than silently sorted by `id` string; default "id"; enum "id", "createdAt", "updatedAt", "email"
`orderDirection`	Optional query	Sort direction (default `asc`). Any other value is refused with a 400 string; default "asc"; enum "asc", "desc"
`search`	Optional query	Narrow the list to rows matching this text. Where the collection is full-text searched, every whitespace-separated word must begin a word of a searched field, in any case: `adm` finds `admin`, and `admin@exa` finds `admin@example.com`; only the first 16 words count. Users and organization members also match the start of an email's domain: `udibo` or `@udibo.com` finds `admin@udibo.com`, and a word starting with `@` matches the domain alone. Permissions, resource types, organization roles and webhook endpoints match the text anywhere in a searched field instead string
`includeDeleted`	Optional query	Include soft-deleted rows when `true` boolean
`createdAfter`	Optional query	Only rows created strictly after this instant. A bare calendar date (`2026-03-17`) names a whole UTC day instead, and the window opens at that day's first instant. string
`createdBefore`	Optional query	Only rows created strictly before this instant. A bare calendar date (`2026-03-17`) names a whole UTC day instead, and the window runs through that day's last instant. string
`updatedAfter`	Optional query	Only rows updated strictly after this instant. A bare calendar date (`2026-03-17`) names a whole UTC day instead, and the window opens at that day's first instant. string
`updatedBefore`	Optional query	Only rows updated strictly before this instant. A bare calendar date (`2026-03-17`) names a whole UTC day instead, and the window runs through that day's last instant. string
`status`	Optional query	Only entries currently in this derived state. An unrecognized value is a 400, never a silently dropped filter string; enum "pending", "invited", "expired", "accepted", "denied"

Request body

No request body is declared.

Responses

Status	Description	Media types
`200`	One page of waitlist entries	`application/json`
`400`	An unrecognized status or a malformed list option was refused	`application/problem+json`
`401`	The request carried no credential (`error: access_denied`), or an expired or invalid one (`error: invalid_token`)	`application/problem+json`
`403`	The credential does not confer this operation: the token lacks the required scope (`error: insufficient_scope` with `requiredScope`), or an app-level rule refused (optionally with `reason`). A dashboard-session call without the `x-csrf` header is refused before the operation runs, as plain JSON	`application/problem+json` `application/json`
`404`	The caller holds no authority over the tenant in the path, or it does not exist — deliberately indistinguishable, and the same refusal for a malformed tenant id	`application/problem+json`

Full object schemas and examples are in the OpenAPI document.

Tenants

The tenants the caller administers

Method	Path	Summary
GET	/api/identity/tenants/{id}	Get a tenant
PATCH	/api/identity/tenants/{id}	Update a tenant
GET	/api/identity/tenants	List tenants
POST	/api/identity/tenants	Create a tenant
POST	/api/identity/tenants/{id}/transfer-ownership	Transfer a tenant's ownership to an organization
GET	/api/identity/{tenantId}/captcha	Get the tenant's bot protection
PUT	/api/identity/{tenantId}/captcha	Choose the tenant's bot protection
DELETE	/api/identity/{tenantId}/captcha/keys	Remove the tenant's stored Turnstile keys
GET	/api/identity/{tenantId}/email-sender	Get the tenant's email sender
PUT	/api/identity/{tenantId}/email-sender	Configure the tenant's email sender
DELETE	/api/identity/{tenantId}/email-sender	Clear the tenant's email sender
POST	/api/identity/{tenantId}/email-sender/verify	Refresh the email sender's domain verification

Users

A tenant's end users

Method	Path	Summary
GET	/api/identity/{tenantId}/users/export	Export the tenant's user directory
GET	/api/identity/{tenantId}/users	List users
POST	/api/identity/{tenantId}/users	Create a user
GET	/api/identity/{tenantId}/users/{id}	Get a user
DELETE	/api/identity/{tenantId}/users/{id}	Delete a user
PATCH	/api/identity/{tenantId}/users/{id}	Update a user
POST	/api/identity/{tenantId}/users/{id}/verify-email	Mark a user's email address verified
POST	/api/identity/{tenantId}/users/{id}/send-verification	Send a user an email-verification message
POST	/api/identity/{tenantId}/users/{id}/send-reset	Send a user a password-reset message
POST	/api/identity/{tenantId}/users/{id}/password	Set a user's password
POST	/api/identity/{tenantId}/users/{id}/disable	Disable a user's account
POST	/api/identity/{tenantId}/users/{id}/enable	Re-enable a disabled user's account
POST	/api/identity/{tenantId}/users/{id}/impersonate	Start a support impersonation of a user
POST	/api/identity/{tenantId}/users/{id}/sessions/revoke	Revoke all of a user's sessions
POST	/api/identity/{tenantId}/users/{id}/sessions/{sessionId}/revoke	Revoke one of a user's sessions
POST	/api/identity/{tenantId}/users/{id}/unsuspend	Restore a suspended (soft-deleted) user
GET	/api/identity/{tenantId}/users/{id}/roles	List the roles a user holds
POST	/api/identity/{tenantId}/users/{id}/roles	Assign a role to a user
DELETE	/api/identity/{tenantId}/users/{id}/roles/{roleId}	Revoke a role from a user
POST	/api/identity/{tenantId}/users/{id}/reset-mfa	Reset a user's MFA enrollment

Applications

A tenant's OAuth2 applications and their secrets

Method	Path	Summary
GET	/api/identity/{tenantId}/applications	List applications
POST	/api/identity/{tenantId}/applications	Create a application
GET	/api/identity/{tenantId}/applications/{id}	Get a application
DELETE	/api/identity/{tenantId}/applications/{id}	Delete a application
PATCH	/api/identity/{tenantId}/applications/{id}	Update a application
GET	/api/identity/{tenantId}/applications/{id}/machine-permissions	Read a machine application's management permissions
PUT	/api/identity/{tenantId}/applications/{id}/machine-permissions	Set a machine application's management permissions
POST	/api/identity/{tenantId}/applications/{id}/redirect-uris	Add redirect URIs to an application
POST	/api/identity/{tenantId}/applications/{id}/redirect-uris/remove	Remove redirect URIs from an application
GET	/api/identity/{tenantId}/applications/{id}/secrets	List an application's secrets
POST	/api/identity/{tenantId}/applications/{id}/secrets	Create an application secret
POST	/api/identity/{tenantId}/applications/{id}/secrets/{secretId}/revoke	Revoke an application secret
PATCH	/api/identity/{tenantId}/applications/{id}/secrets/{secretId}	Update an application secret's expiry

Webhooks

A tenant's webhook endpoints and delivery log

Method	Path	Summary
GET	/api/identity/{tenantId}/webhooks/event-types	List the subscribable webhook event types
GET	/api/identity/{tenantId}/webhooks	List webhook endpoints
POST	/api/identity/{tenantId}/webhooks	Create a webhook endpoint
GET	/api/identity/{tenantId}/webhooks/{id}	Get a webhook endpoint
DELETE	/api/identity/{tenantId}/webhooks/{id}	Delete a webhook endpoint
PATCH	/api/identity/{tenantId}/webhooks/{id}	Update a webhook endpoint
GET	/api/identity/{tenantId}/webhooks/{id}/deliveries	List a webhook endpoint's deliveries
GET	/api/identity/{tenantId}/webhooks/{id}/deliveries/{deliveryId}	Get one webhook delivery
POST	/api/identity/{tenantId}/webhooks/{id}/deliveries/{deliveryId}/replay	Replay a webhook delivery
POST	/api/identity/{tenantId}/webhooks/{id}/deliveries/{deliveryId}/redrive	Redrive an exhausted webhook delivery
POST	/api/identity/{tenantId}/webhooks/{id}/test	Send a test event to a webhook endpoint
GET	/api/identity/{tenantId}/webhooks/{id}/secret	Reveal a webhook endpoint's signing secret
POST	/api/identity/{tenantId}/webhooks/{id}/secret/rotate	Rotate a webhook endpoint's signing secret

Organizations

A tenant's organizations, memberships, and invitations, managed with tenant authority

Method	Path	Summary
GET	/api/identity/{tenantId}/organizations	List organizations
POST	/api/identity/{tenantId}/organizations	Create an organization
GET	/api/identity/{tenantId}/organizations/{organizationId}	Get an organization
DELETE	/api/identity/{tenantId}/organizations/{organizationId}	Delete an organization
PATCH	/api/identity/{tenantId}/organizations/{organizationId}	Update an organization
GET	/api/identity/{tenantId}/organizations/{organizationId}/members	List an organization's members
GET	/api/identity/{tenantId}/organizations/{organizationId}/member-count	Count an organization's memberships
DELETE	/api/identity/{tenantId}/organizations/{organizationId}/members/{userId}/{role}	Revoke an organization membership grant
GET	/api/identity/{tenantId}/organizations/{organizationId}/invitations	List an organization's invitations
POST	/api/identity/{tenantId}/organizations/{organizationId}/invitations	Invite an email address to an organization
DELETE	/api/identity/{tenantId}/organizations/{organizationId}/invitations/{invitationId}	Withdraw an organization invitation

Self-serve organizations

The caller's own organizations — gated by their own membership, never tenant authority

Method	Path	Summary
GET	/api/identity/organizations	List your organizations
POST	/api/identity/organizations	Create an organization
GET	/api/identity/organizations/offers	List the offers waiting for you
POST	/api/identity/organizations/offers/{offerId}/accept	Accept an offer made to you
GET	/api/identity/organizations/{organizationId}	Get an organization you belong to
DELETE	/api/identity/organizations/{organizationId}	Delete an organization you own
PATCH	/api/identity/organizations/{organizationId}	Update an organization you manage
GET	/api/identity/organizations/{organizationId}/members	List an organization's members
GET	/api/identity/organizations/{organizationId}/member-roles	List the roles an invitation may offer
DELETE	/api/identity/organizations/{organizationId}/members/{userId}/{role}	Revoke a member's role
GET	/api/identity/organizations/{organizationId}/members/{userId}/roles	List the application roles a member holds here
POST	/api/identity/organizations/{organizationId}/members/{userId}/roles	Grant a member an application role here
DELETE	/api/identity/organizations/{organizationId}/members/{userId}/roles/{roleId}	Revoke an application role a member holds here
GET	/api/identity/organizations/{organizationId}/invitations	List the organization's invitations
POST	/api/identity/organizations/{organizationId}/invitations	Invite someone to the organization
DELETE	/api/identity/organizations/{organizationId}/invitations/{invitationId}	Withdraw an invitation
GET	/api/identity/organizations/{organizationId}/roles	List the organization's own roles
POST	/api/identity/organizations/{organizationId}/roles	Define one of the organization's own roles
GET	/api/identity/organizations/{organizationId}/roles/{roleId}	Get one of the organization's own roles
DELETE	/api/identity/organizations/{organizationId}/roles/{roleId}	Retire one of the organization's own roles
PATCH	/api/identity/organizations/{organizationId}/roles/{roleId}	Edit one of the organization's own roles

Roles

The tenant's organization-role vocabulary

Method	Path	Summary
GET	/api/identity/{tenantId}/organization-roles	List organization roles
POST	/api/identity/{tenantId}/organization-roles	Create an organization role
GET	/api/identity/{tenantId}/organization-roles/{roleId}	Get an organization role
DELETE	/api/identity/{tenantId}/organization-roles/{roleId}	Delete an organization role
PATCH	/api/identity/{tenantId}/organization-roles/{roleId}	Update an organization role

Permissions

The tenant's customer permission registry — capability strings their own app interprets

Method	Path	Summary
GET	/api/identity/{tenantId}/permissions	List permissions
POST	/api/identity/{tenantId}/permissions	Register a permission
GET	/api/identity/{tenantId}/permissions/{permissionId}	Get a permission
DELETE	/api/identity/{tenantId}/permissions/{permissionId}	Delete a permission
PATCH	/api/identity/{tenantId}/permissions/{permissionId}	Update a permission's description

Administrators

Dashboard administrator seats and organization-held grants

Method	Path	Summary
GET	/api/identity/administrators	List dashboard administrator seats
POST	/api/identity/administrators	Invite an administrator
POST	/api/identity/administrators/{userId}/grants	Grant an administrator further access
DELETE	/api/identity/administrators/{userId}	Revoke an administrator seat
GET	/api/identity/{tenantId}/administrators	List a tenant's administrators
POST	/api/identity/{tenantId}/administrators	Invite an administrator to a tenant
POST	/api/identity/{tenantId}/administrators/{userId}/grants	Grant a tenant administrator further access
DELETE	/api/identity/{tenantId}/administrators/{userId}	Revoke a tenant administrator's seat
DELETE	/api/identity/{tenantId}/administrators/organizations/{organizationId}	Revoke an organization's grant over the tenant

Identity providers

A tenant's social and OpenID Connect sign-in connectors — configuration only; a client secret is never returned

Method	Path	Summary
GET	/api/identity/{tenantId}/identity-providers	List identity providers
POST	/api/identity/{tenantId}/identity-providers	Configure an identity provider
GET	/api/identity/{tenantId}/identity-providers/{id}	Get an identity provider
DELETE	/api/identity/{tenantId}/identity-providers/{id}	Delete an identity provider
PATCH	/api/identity/{tenantId}/identity-providers/{id}	Update an identity provider

Waitlist

A waitlisted tenant's sign-up queue — entries captured before they become users

Method	Path	Summary
GET	/api/identity/{tenantId}/waitlist/summary	Summarize the waitlist queue
GET	/api/identity/{tenantId}/waitlist/{id}	Get a waitlist entry
DELETE	/api/identity/{tenantId}/waitlist/{id}	Remove a waitlist entry
GET	/api/identity/{tenantId}/waitlist	List waitlist entries
POST	/api/identity/{tenantId}/waitlist/notify-open	Email the waitlist that sign-up is open
POST	/api/identity/{tenantId}/waitlist/invite-all	Invite every pending waitlist entry
POST	/api/identity/{tenantId}/waitlist/{id}/invite	Approve a waitlist entry
POST	/api/identity/{tenantId}/waitlist/{id}/reinvite	Re-invite a waitlist entry
POST	/api/identity/{tenantId}/waitlist/{id}/deny	Deny a waitlist entry
GET	/api/signup	Read the tenant's sign-up posture
POST	/api/waitlist	Join the tenant's waitlist
POST	/api/waitlist/removal-requests	Ask for a waitlist removal link
POST	/api/waitlist/removals	Remove an address with its emailed token

Account

The caller's own record

Method	Path	Summary
GET	/api/account	Read your own user metadata
PATCH	/api/account	Update your own user metadata
GET	/api/account/linked-accounts	List your linked sign-in accounts
DELETE	/api/account/linked-accounts/{identityId}	Disconnect one of your linked sign-in accounts
GET	/api/account/sessions	List your active tenant login sessions
DELETE	/api/account/sessions/{sessionId}	Sign out one of your other devices
POST	/api/account/sessions/revoke-others	Sign out your other devices
PATCH	/api/identity/metadata	Update your own user metadata

Audit log

A tenant's append-only audit log

Method	Path	Summary
GET	/api/identity/{tenantId}/audit-events/export	Export the tenant's audit log
GET	/api/identity/{tenantId}/audit-events	List audit events

Export

Own-your-data exports: the directory tier and the step-up-gated credential tier

Method	Path	Summary
GET	/api/identity/{tenantId}/export/directory	Export the tenant's directory data
GET	/api/identity/{tenantId}/export/credentials	List the tenant's credential-export requests
POST	/api/identity/{tenantId}/export/credentials	Open a credential export
POST	/api/identity/{tenantId}/export/credentials/{id}/cancel	Cancel a credential export during its hold
GET	/api/identity/{tenantId}/export/credentials/{id}/download	Download a credential-export artifact

Metrics

Dashboard overview aggregates

Method	Path	Summary
GET	/api/identity/{tenantId}/metrics	Get the tenant's dashboard overview metrics

Organizations in your application

The same caller-relative organizations, on the tenant's own origin, for a customer's application to call with its signed-in user's token — authority is that user's own membership, and no identity scope is required or accepted

Method	Path	Summary
GET	/api/organizations	List your organizations
POST	/api/organizations	Create an organization
GET	/api/organizations/offers	List the offers waiting for you
POST	/api/organizations/offers/{offerId}/accept	Accept an offer made to you
GET	/api/organizations/{organizationId}	Get an organization you belong to
DELETE	/api/organizations/{organizationId}	Delete an organization you own
PATCH	/api/organizations/{organizationId}	Update an organization you manage
GET	/api/organizations/{organizationId}/members	List an organization's members
GET	/api/organizations/{organizationId}/member-roles	List the roles an invitation may offer
DELETE	/api/organizations/{organizationId}/members/{userId}/{role}	Revoke a member's role
GET	/api/organizations/{organizationId}/members/{userId}/roles	List the application roles a member holds here
POST	/api/organizations/{organizationId}/members/{userId}/roles	Grant a member an application role here
DELETE	/api/organizations/{organizationId}/members/{userId}/roles/{roleId}	Revoke an application role a member holds here
GET	/api/organizations/{organizationId}/invitations	List the organization's invitations
POST	/api/organizations/{organizationId}/invitations	Invite someone to the organization
DELETE	/api/organizations/{organizationId}/invitations/{invitationId}	Withdraw an invitation
GET	/api/organizations/{organizationId}/roles	List the organization's own roles
POST	/api/organizations/{organizationId}/roles	Define one of the organization's own roles
GET	/api/organizations/{organizationId}/roles/{roleId}	Get one of the organization's own roles
DELETE	/api/organizations/{organizationId}/roles/{roleId}	Retire one of the organization's own roles
PATCH	/api/organizations/{organizationId}/roles/{roleId}	Edit one of the organization's own roles

Resource grants in your application

Who holds which of a tenant's roles on one of its resources, read and written by that tenant's own application with its own machine credential — the application is the authority and an end user's token is refused

Method	Path	Summary
GET	/api/resource-grants	List the grants on one of your resources
POST	/api/resource-grants	Grant one of your roles on one of your resources
POST	/api/resource-grants/revoke	Revoke a role on one of your resources

Authorization

Authorization checks a tenant's own application makes for its signed-in user, on the tenant's own origin

Method	Path	Summary
POST	/api/check	Check the caller's own permissions
POST	/api/check/batch	Check the caller's own permissions across many resources
GET	/api/memberships	List the caller's own organization memberships

Billing

Method	Path	Summary
GET	/api/identity/{tenantId}/billing	Get the tenant's plan and the month so far
GET	/api/identity/{tenantId}/billing/invoices	List the tenant's invoices

Resource grants

Method	Path	Summary
GET	/api/identity/{tenantId}/resource-grants	List the grants on a resource
POST	/api/identity/{tenantId}/resource-grants	Grant a role on a resource
POST	/api/identity/{tenantId}/resource-grants/revoke	Revoke a role on a resource

Resource types

Method	Path	Summary
GET	/api/identity/{tenantId}/resource-types	List resource types
POST	/api/identity/{tenantId}/resource-types	Register a resource type
GET	/api/identity/{tenantId}/resource-types/{resourceTypeId}	Get a resource type
DELETE	/api/identity/{tenantId}/resource-types/{resourceTypeId}	Delete a resource type
PATCH	/api/identity/{tenantId}/resource-types/{resourceTypeId}	Update a resource type's description

Usage limits

Method	Path	Summary
GET	/api/identity/{tenantId}/usage-limits	Get the tenant's usage limits
PUT	/api/identity/{tenantId}/usage-limits	Replace the tenant's usage limits
POST	/api/identity/{tenantId}/usage-limits/confirmations	Send a nominated alert recipient its confirmation again

system

Method	Path	Summary
GET	/api/health	Service health