API reference

184 operations across 23 resources, generated from the Management API's OpenAPI document. The document itself is served at /api/openapi.

Choose an operation to inspect its servers, authentication requirements, parameters, request media types, and responses.

All operations

Revoke one of a user's sessions

POST /api/identity/{tenantId}/users/{id}/sessions/{sessionId}/revoke

Operation ID: revokeUserSession

The session must belong to the user in the path; a session id belonging to someone else is a 404, never a cross-user revoke.

Servers

https://www.udibo.com
Production

Authentication

Use every scheme in this requirement.

- oauth2
  OAuth 2.0 authentication required
  Required scopes:
  - identity:users:write

Check the description and required headers; this does not establish public access.

Parameters

Parameter	Requirement	Description
`tenantId`	Required path	The tenant this operation acts on. The caller must hold admin authority over it; every refusal — no authority, unknown, malformed — is the same 404 string (uuid)
`id`	Required path	The user's id string (uuid)
`sessionId`	Required path	The session's id string (uuid)

Request body

No request body is declared.

Responses

Status	Description	Media types
`200`	The session was revoked	`application/json`
`401`	The request carried no credential (`error: access_denied`), or an expired or invalid one (`error: invalid_token`)	`application/problem+json`
`403`	The credential does not confer this operation: the token lacks the required scope (`error: insufficient_scope` with `requiredScope`), or an app-level rule refused (optionally with `reason`). A dashboard-session call without the `x-csrf` header is refused before the operation runs, as plain JSON	`application/problem+json` `application/json`
`404`	No such session — the same refusal whether the id is unknown, malformed, another tenant's, or one this caller may not read	`application/problem+json`

Full object schemas and examples are in the OpenAPI document.

Tenants

The tenants the caller administers

Method	Path	Summary
GET	/api/identity/tenants/{id}	Get a tenant
PATCH	/api/identity/tenants/{id}	Update a tenant
GET	/api/identity/tenants	List tenants
POST	/api/identity/tenants	Create a tenant
POST	/api/identity/tenants/{id}/transfer-ownership	Transfer a tenant's ownership to an organization
GET	/api/identity/{tenantId}/captcha	Get the tenant's bot protection
PUT	/api/identity/{tenantId}/captcha	Choose the tenant's bot protection
DELETE	/api/identity/{tenantId}/captcha/keys	Remove the tenant's stored Turnstile keys
GET	/api/identity/{tenantId}/email-sender	Get the tenant's email sender
PUT	/api/identity/{tenantId}/email-sender	Configure the tenant's email sender
DELETE	/api/identity/{tenantId}/email-sender	Clear the tenant's email sender
POST	/api/identity/{tenantId}/email-sender/verify	Refresh the email sender's domain verification

Users

A tenant's end users

Method	Path	Summary
GET	/api/identity/{tenantId}/users/export	Export the tenant's user directory
GET	/api/identity/{tenantId}/users	List users
POST	/api/identity/{tenantId}/users	Create a user
GET	/api/identity/{tenantId}/users/{id}	Get a user
DELETE	/api/identity/{tenantId}/users/{id}	Delete a user
PATCH	/api/identity/{tenantId}/users/{id}	Update a user
POST	/api/identity/{tenantId}/users/{id}/verify-email	Mark a user's email address verified
POST	/api/identity/{tenantId}/users/{id}/send-verification	Send a user an email-verification message
POST	/api/identity/{tenantId}/users/{id}/send-reset	Send a user a password-reset message
POST	/api/identity/{tenantId}/users/{id}/password	Set a user's password
POST	/api/identity/{tenantId}/users/{id}/disable	Disable a user's account
POST	/api/identity/{tenantId}/users/{id}/enable	Re-enable a disabled user's account
POST	/api/identity/{tenantId}/users/{id}/impersonate	Start a support impersonation of a user
POST	/api/identity/{tenantId}/users/{id}/sessions/revoke	Revoke all of a user's sessions
POST	/api/identity/{tenantId}/users/{id}/sessions/{sessionId}/revoke	Revoke one of a user's sessions
POST	/api/identity/{tenantId}/users/{id}/unsuspend	Restore a suspended (soft-deleted) user
GET	/api/identity/{tenantId}/users/{id}/roles	List the roles a user holds
POST	/api/identity/{tenantId}/users/{id}/roles	Assign a role to a user
DELETE	/api/identity/{tenantId}/users/{id}/roles/{roleId}	Revoke a role from a user
POST	/api/identity/{tenantId}/users/{id}/reset-mfa	Reset a user's MFA enrollment

Applications

A tenant's OAuth2 applications and their secrets

Method	Path	Summary
GET	/api/identity/{tenantId}/applications	List applications
POST	/api/identity/{tenantId}/applications	Create a application
GET	/api/identity/{tenantId}/applications/{id}	Get a application
DELETE	/api/identity/{tenantId}/applications/{id}	Delete a application
PATCH	/api/identity/{tenantId}/applications/{id}	Update a application
GET	/api/identity/{tenantId}/applications/{id}/machine-permissions	Read a machine application's management permissions
PUT	/api/identity/{tenantId}/applications/{id}/machine-permissions	Set a machine application's management permissions
POST	/api/identity/{tenantId}/applications/{id}/redirect-uris	Add redirect URIs to an application
POST	/api/identity/{tenantId}/applications/{id}/redirect-uris/remove	Remove redirect URIs from an application
GET	/api/identity/{tenantId}/applications/{id}/secrets	List an application's secrets
POST	/api/identity/{tenantId}/applications/{id}/secrets	Create an application secret
POST	/api/identity/{tenantId}/applications/{id}/secrets/{secretId}/revoke	Revoke an application secret
PATCH	/api/identity/{tenantId}/applications/{id}/secrets/{secretId}	Update an application secret's expiry

Webhooks

A tenant's webhook endpoints and delivery log

Method	Path	Summary
GET	/api/identity/{tenantId}/webhooks/event-types	List the subscribable webhook event types
GET	/api/identity/{tenantId}/webhooks	List webhook endpoints
POST	/api/identity/{tenantId}/webhooks	Create a webhook endpoint
GET	/api/identity/{tenantId}/webhooks/{id}	Get a webhook endpoint
DELETE	/api/identity/{tenantId}/webhooks/{id}	Delete a webhook endpoint
PATCH	/api/identity/{tenantId}/webhooks/{id}	Update a webhook endpoint
GET	/api/identity/{tenantId}/webhooks/{id}/deliveries	List a webhook endpoint's deliveries
GET	/api/identity/{tenantId}/webhooks/{id}/deliveries/{deliveryId}	Get one webhook delivery
POST	/api/identity/{tenantId}/webhooks/{id}/deliveries/{deliveryId}/replay	Replay a webhook delivery
POST	/api/identity/{tenantId}/webhooks/{id}/deliveries/{deliveryId}/redrive	Redrive an exhausted webhook delivery
POST	/api/identity/{tenantId}/webhooks/{id}/test	Send a test event to a webhook endpoint
GET	/api/identity/{tenantId}/webhooks/{id}/secret	Reveal a webhook endpoint's signing secret
POST	/api/identity/{tenantId}/webhooks/{id}/secret/rotate	Rotate a webhook endpoint's signing secret

Organizations

A tenant's organizations, memberships, and invitations, managed with tenant authority

Method	Path	Summary
GET	/api/identity/{tenantId}/organizations	List organizations
POST	/api/identity/{tenantId}/organizations	Create an organization
GET	/api/identity/{tenantId}/organizations/{organizationId}	Get an organization
DELETE	/api/identity/{tenantId}/organizations/{organizationId}	Delete an organization
PATCH	/api/identity/{tenantId}/organizations/{organizationId}	Update an organization
GET	/api/identity/{tenantId}/organizations/{organizationId}/members	List an organization's members
GET	/api/identity/{tenantId}/organizations/{organizationId}/member-count	Count an organization's memberships
DELETE	/api/identity/{tenantId}/organizations/{organizationId}/members/{userId}/{role}	Revoke an organization membership grant
GET	/api/identity/{tenantId}/organizations/{organizationId}/invitations	List an organization's invitations
POST	/api/identity/{tenantId}/organizations/{organizationId}/invitations	Invite an email address to an organization
DELETE	/api/identity/{tenantId}/organizations/{organizationId}/invitations/{invitationId}	Withdraw an organization invitation

Self-serve organizations

The caller's own organizations — gated by their own membership, never tenant authority

Method	Path	Summary
GET	/api/identity/organizations	List your organizations
POST	/api/identity/organizations	Create an organization
GET	/api/identity/organizations/offers	List the offers waiting for you
POST	/api/identity/organizations/offers/{offerId}/accept	Accept an offer made to you
GET	/api/identity/organizations/{organizationId}	Get an organization you belong to
DELETE	/api/identity/organizations/{organizationId}	Delete an organization you own
PATCH	/api/identity/organizations/{organizationId}	Update an organization you manage
GET	/api/identity/organizations/{organizationId}/members	List an organization's members
GET	/api/identity/organizations/{organizationId}/member-roles	List the roles an invitation may offer
DELETE	/api/identity/organizations/{organizationId}/members/{userId}/{role}	Revoke a member's role
GET	/api/identity/organizations/{organizationId}/members/{userId}/roles	List the application roles a member holds here
POST	/api/identity/organizations/{organizationId}/members/{userId}/roles	Grant a member an application role here
DELETE	/api/identity/organizations/{organizationId}/members/{userId}/roles/{roleId}	Revoke an application role a member holds here
GET	/api/identity/organizations/{organizationId}/invitations	List the organization's invitations
POST	/api/identity/organizations/{organizationId}/invitations	Invite someone to the organization
DELETE	/api/identity/organizations/{organizationId}/invitations/{invitationId}	Withdraw an invitation
GET	/api/identity/organizations/{organizationId}/roles	List the organization's own roles
POST	/api/identity/organizations/{organizationId}/roles	Define one of the organization's own roles
GET	/api/identity/organizations/{organizationId}/roles/{roleId}	Get one of the organization's own roles
DELETE	/api/identity/organizations/{organizationId}/roles/{roleId}	Retire one of the organization's own roles
PATCH	/api/identity/organizations/{organizationId}/roles/{roleId}	Edit one of the organization's own roles

Roles

The tenant's organization-role vocabulary

Method	Path	Summary
GET	/api/identity/{tenantId}/organization-roles	List organization roles
POST	/api/identity/{tenantId}/organization-roles	Create an organization role
GET	/api/identity/{tenantId}/organization-roles/{roleId}	Get an organization role
DELETE	/api/identity/{tenantId}/organization-roles/{roleId}	Delete an organization role
PATCH	/api/identity/{tenantId}/organization-roles/{roleId}	Update an organization role

Permissions

The tenant's customer permission registry — capability strings their own app interprets

Method	Path	Summary
GET	/api/identity/{tenantId}/permissions	List permissions
POST	/api/identity/{tenantId}/permissions	Register a permission
GET	/api/identity/{tenantId}/permissions/{permissionId}	Get a permission
DELETE	/api/identity/{tenantId}/permissions/{permissionId}	Delete a permission
PATCH	/api/identity/{tenantId}/permissions/{permissionId}	Update a permission's description

Administrators

Dashboard administrator seats and organization-held grants

Method	Path	Summary
GET	/api/identity/administrators	List dashboard administrator seats
POST	/api/identity/administrators	Invite an administrator
POST	/api/identity/administrators/{userId}/grants	Grant an administrator further access
DELETE	/api/identity/administrators/{userId}	Revoke an administrator seat
GET	/api/identity/{tenantId}/administrators	List a tenant's administrators
POST	/api/identity/{tenantId}/administrators	Invite an administrator to a tenant
POST	/api/identity/{tenantId}/administrators/{userId}/grants	Grant a tenant administrator further access
DELETE	/api/identity/{tenantId}/administrators/{userId}	Revoke a tenant administrator's seat
DELETE	/api/identity/{tenantId}/administrators/organizations/{organizationId}	Revoke an organization's grant over the tenant

Identity providers

A tenant's social and OpenID Connect sign-in connectors — configuration only; a client secret is never returned

Method	Path	Summary
GET	/api/identity/{tenantId}/identity-providers	List identity providers
POST	/api/identity/{tenantId}/identity-providers	Configure an identity provider
GET	/api/identity/{tenantId}/identity-providers/{id}	Get an identity provider
DELETE	/api/identity/{tenantId}/identity-providers/{id}	Delete an identity provider
PATCH	/api/identity/{tenantId}/identity-providers/{id}	Update an identity provider

Waitlist

A waitlisted tenant's sign-up queue — entries captured before they become users

Method	Path	Summary
GET	/api/identity/{tenantId}/waitlist/summary	Summarize the waitlist queue
GET	/api/identity/{tenantId}/waitlist/{id}	Get a waitlist entry
DELETE	/api/identity/{tenantId}/waitlist/{id}	Remove a waitlist entry
GET	/api/identity/{tenantId}/waitlist	List waitlist entries
POST	/api/identity/{tenantId}/waitlist/notify-open	Email the waitlist that sign-up is open
POST	/api/identity/{tenantId}/waitlist/invite-all	Invite every pending waitlist entry
POST	/api/identity/{tenantId}/waitlist/{id}/invite	Approve a waitlist entry
POST	/api/identity/{tenantId}/waitlist/{id}/reinvite	Re-invite a waitlist entry
POST	/api/identity/{tenantId}/waitlist/{id}/deny	Deny a waitlist entry
GET	/api/signup	Read the tenant's sign-up posture
POST	/api/waitlist	Join the tenant's waitlist
POST	/api/waitlist/removal-requests	Ask for a waitlist removal link
POST	/api/waitlist/removals	Remove an address with its emailed token

Account

The caller's own record

Method	Path	Summary
GET	/api/account	Read your own user metadata
PATCH	/api/account	Update your own user metadata
GET	/api/account/linked-accounts	List your linked sign-in accounts
DELETE	/api/account/linked-accounts/{identityId}	Disconnect one of your linked sign-in accounts
GET	/api/account/sessions	List your active tenant login sessions
DELETE	/api/account/sessions/{sessionId}	Sign out one of your other devices
POST	/api/account/sessions/revoke-others	Sign out your other devices
PATCH	/api/identity/metadata	Update your own user metadata

Audit log

A tenant's append-only audit log

Method	Path	Summary
GET	/api/identity/{tenantId}/audit-events/export	Export the tenant's audit log
GET	/api/identity/{tenantId}/audit-events	List audit events

Export

Own-your-data exports: the directory tier and the step-up-gated credential tier

Method	Path	Summary
GET	/api/identity/{tenantId}/export/directory	Export the tenant's directory data
GET	/api/identity/{tenantId}/export/credentials	List the tenant's credential-export requests
POST	/api/identity/{tenantId}/export/credentials	Open a credential export
POST	/api/identity/{tenantId}/export/credentials/{id}/cancel	Cancel a credential export during its hold
GET	/api/identity/{tenantId}/export/credentials/{id}/download	Download a credential-export artifact

Metrics

Dashboard overview aggregates

Method	Path	Summary
GET	/api/identity/{tenantId}/metrics	Get the tenant's dashboard overview metrics

Organizations in your application

The same caller-relative organizations, on the tenant's own origin, for a customer's application to call with its signed-in user's token — authority is that user's own membership, and no identity scope is required or accepted

Method	Path	Summary
GET	/api/organizations	List your organizations
POST	/api/organizations	Create an organization
GET	/api/organizations/offers	List the offers waiting for you
POST	/api/organizations/offers/{offerId}/accept	Accept an offer made to you
GET	/api/organizations/{organizationId}	Get an organization you belong to
DELETE	/api/organizations/{organizationId}	Delete an organization you own
PATCH	/api/organizations/{organizationId}	Update an organization you manage
GET	/api/organizations/{organizationId}/members	List an organization's members
GET	/api/organizations/{organizationId}/member-roles	List the roles an invitation may offer
DELETE	/api/organizations/{organizationId}/members/{userId}/{role}	Revoke a member's role
GET	/api/organizations/{organizationId}/members/{userId}/roles	List the application roles a member holds here
POST	/api/organizations/{organizationId}/members/{userId}/roles	Grant a member an application role here
DELETE	/api/organizations/{organizationId}/members/{userId}/roles/{roleId}	Revoke an application role a member holds here
GET	/api/organizations/{organizationId}/invitations	List the organization's invitations
POST	/api/organizations/{organizationId}/invitations	Invite someone to the organization
DELETE	/api/organizations/{organizationId}/invitations/{invitationId}	Withdraw an invitation
GET	/api/organizations/{organizationId}/roles	List the organization's own roles
POST	/api/organizations/{organizationId}/roles	Define one of the organization's own roles
GET	/api/organizations/{organizationId}/roles/{roleId}	Get one of the organization's own roles
DELETE	/api/organizations/{organizationId}/roles/{roleId}	Retire one of the organization's own roles
PATCH	/api/organizations/{organizationId}/roles/{roleId}	Edit one of the organization's own roles

Resource grants in your application

Who holds which of a tenant's roles on one of its resources, read and written by that tenant's own application with its own machine credential — the application is the authority and an end user's token is refused

Method	Path	Summary
GET	/api/resource-grants	List the grants on one of your resources
POST	/api/resource-grants	Grant one of your roles on one of your resources
POST	/api/resource-grants/revoke	Revoke a role on one of your resources

Authorization

Authorization checks a tenant's own application makes for its signed-in user, on the tenant's own origin

Method	Path	Summary
POST	/api/check	Check the caller's own permissions
POST	/api/check/batch	Check the caller's own permissions across many resources
GET	/api/memberships	List the caller's own organization memberships

Billing

Method	Path	Summary
GET	/api/identity/{tenantId}/billing	Get the tenant's plan and the month so far
GET	/api/identity/{tenantId}/billing/invoices	List the tenant's invoices

Resource grants

Method	Path	Summary
GET	/api/identity/{tenantId}/resource-grants	List the grants on a resource
POST	/api/identity/{tenantId}/resource-grants	Grant a role on a resource
POST	/api/identity/{tenantId}/resource-grants/revoke	Revoke a role on a resource

Resource types

Method	Path	Summary
GET	/api/identity/{tenantId}/resource-types	List resource types
POST	/api/identity/{tenantId}/resource-types	Register a resource type
GET	/api/identity/{tenantId}/resource-types/{resourceTypeId}	Get a resource type
DELETE	/api/identity/{tenantId}/resource-types/{resourceTypeId}	Delete a resource type
PATCH	/api/identity/{tenantId}/resource-types/{resourceTypeId}	Update a resource type's description

Usage limits

Method	Path	Summary
GET	/api/identity/{tenantId}/usage-limits	Get the tenant's usage limits
PUT	/api/identity/{tenantId}/usage-limits	Replace the tenant's usage limits
POST	/api/identity/{tenantId}/usage-limits/confirmations	Send a nominated alert recipient its confirmation again

system

Method	Path	Summary
GET	/api/health	Service health