API reference
184 operations across 23 resources, generated from the Management API's OpenAPI document. The document itself is served at /api/openapi.
Choose an operation to inspect its servers, authentication requirements, parameters, request media types, and responses.
Edit one of the organization's own roles
PATCH /api/identity/organizations/{organizationId}/roles/{roleId}
Operation ID: updateOwnOrganizationRole
Requires the caller's own accepted `owner` or `admin` membership. A permission key the tenant's own registry does not define is refused 400. In Udibo's own tenant, additions are further bounded by what the caller holds over every tenant the organization owns (the empty set when it owns nothing), so an addition the caller does not hold is refused 403, and a role already granted to a member is further bounded by what the caller holds at every scope it is granted at; a customer tenant's registry is that customer's own vocabulary and carries no such bound. Changing the slug is refused with 409 while a live grant still names the role, exactly as deleting it is; a write that keeps the slug is unaffected.
Servers
https://www.udibo.comProduction
Authentication
Use every scheme in this requirement.
oauth2OAuth 2.0 authentication required
Required scopes:
identity:organizations:write
Check the description and required headers; this does not establish public access.
Parameters
| Parameter | Requirement | Description |
|---|---|---|
organizationId | Required path | The organization's id string (uuid) |
roleId | Required path | The organization role's id string (uuid) |
Request body
Required
application/json
Responses
| Status | Description | Media types |
|---|---|---|
200 | The updated role |
|
400 | The organization role content was refused; `fieldErrors` maps each offending field's dotted path to its message when fields could be named |
|
401 | The request carried no credential (`error: access_denied`), or an expired or invalid one (`error: invalid_token`) |
|
403 | The credential does not confer this operation: the token lacks the required scope (`error: insufficient_scope` with `requiredScope`), or an app-level rule refused (optionally with `reason`). A dashboard-session call without the `x-csrf` header is refused before the operation runs, as plain JSON |
|
404 | No such organization role — the same refusal whether the id is unknown, malformed, another tenant's, or one this caller may not read |
|
409 | A role with this slug is already defined for this organization (`constraint` names the unique index), or the slug would change while a grant still holds the role (the detail counts them) |
|
413 | The request body was over this operation's limit of 1 MiB (1048576 bytes), counted as the bytes arrive whatever `Content-Length` declares. It is refused before the credential or the content is checked |
|
Full object schemas and examples are in the OpenAPI document.
Tenants
The tenants the caller administers
| Method | Path | Summary |
|---|---|---|
| GET | /api/identity/tenants/{id} | Get a tenant |
| PATCH | /api/identity/tenants/{id} | Update a tenant |
| GET | /api/identity/tenants | List tenants |
| POST | /api/identity/tenants | Create a tenant |
| POST | /api/identity/tenants/{id}/transfer-ownership | Transfer a tenant's ownership to an organization |
| GET | /api/identity/{tenantId}/captcha | Get the tenant's bot protection |
| PUT | /api/identity/{tenantId}/captcha | Choose the tenant's bot protection |
| DELETE | /api/identity/{tenantId}/captcha/keys | Remove the tenant's stored Turnstile keys |
| GET | /api/identity/{tenantId}/email-sender | Get the tenant's email sender |
| PUT | /api/identity/{tenantId}/email-sender | Configure the tenant's email sender |
| DELETE | /api/identity/{tenantId}/email-sender | Clear the tenant's email sender |
| POST | /api/identity/{tenantId}/email-sender/verify | Refresh the email sender's domain verification |
Users
A tenant's end users
Applications
A tenant's OAuth2 applications and their secrets
Webhooks
A tenant's webhook endpoints and delivery log
Organizations
A tenant's organizations, memberships, and invitations, managed with tenant authority
Self-serve organizations
The caller's own organizations — gated by their own membership, never tenant authority
Roles
The tenant's organization-role vocabulary
| Method | Path | Summary |
|---|---|---|
| GET | /api/identity/{tenantId}/organization-roles | List organization roles |
| POST | /api/identity/{tenantId}/organization-roles | Create an organization role |
| GET | /api/identity/{tenantId}/organization-roles/{roleId} | Get an organization role |
| DELETE | /api/identity/{tenantId}/organization-roles/{roleId} | Delete an organization role |
| PATCH | /api/identity/{tenantId}/organization-roles/{roleId} | Update an organization role |
Permissions
The tenant's customer permission registry — capability strings their own app interprets
| Method | Path | Summary |
|---|---|---|
| GET | /api/identity/{tenantId}/permissions | List permissions |
| POST | /api/identity/{tenantId}/permissions | Register a permission |
| GET | /api/identity/{tenantId}/permissions/{permissionId} | Get a permission |
| DELETE | /api/identity/{tenantId}/permissions/{permissionId} | Delete a permission |
| PATCH | /api/identity/{tenantId}/permissions/{permissionId} | Update a permission's description |
Administrators
Dashboard administrator seats and organization-held grants
| Method | Path | Summary |
|---|---|---|
| GET | /api/identity/administrators | List dashboard administrator seats |
| POST | /api/identity/administrators | Invite an administrator |
| POST | /api/identity/administrators/{userId}/grants | Grant an administrator further access |
| DELETE | /api/identity/administrators/{userId} | Revoke an administrator seat |
| GET | /api/identity/{tenantId}/administrators | List a tenant's administrators |
| POST | /api/identity/{tenantId}/administrators | Invite an administrator to a tenant |
| POST | /api/identity/{tenantId}/administrators/{userId}/grants | Grant a tenant administrator further access |
| DELETE | /api/identity/{tenantId}/administrators/{userId} | Revoke a tenant administrator's seat |
| DELETE | /api/identity/{tenantId}/administrators/organizations/{organizationId} | Revoke an organization's grant over the tenant |
Identity providers
A tenant's social and OpenID Connect sign-in connectors — configuration only; a client secret is never returned
| Method | Path | Summary |
|---|---|---|
| GET | /api/identity/{tenantId}/identity-providers | List identity providers |
| POST | /api/identity/{tenantId}/identity-providers | Configure an identity provider |
| GET | /api/identity/{tenantId}/identity-providers/{id} | Get an identity provider |
| DELETE | /api/identity/{tenantId}/identity-providers/{id} | Delete an identity provider |
| PATCH | /api/identity/{tenantId}/identity-providers/{id} | Update an identity provider |
Waitlist
A waitlisted tenant's sign-up queue — entries captured before they become users
| Method | Path | Summary |
|---|---|---|
| GET | /api/identity/{tenantId}/waitlist/summary | Summarize the waitlist queue |
| GET | /api/identity/{tenantId}/waitlist/{id} | Get a waitlist entry |
| DELETE | /api/identity/{tenantId}/waitlist/{id} | Remove a waitlist entry |
| GET | /api/identity/{tenantId}/waitlist | List waitlist entries |
| POST | /api/identity/{tenantId}/waitlist/notify-open | Email the waitlist that sign-up is open |
| POST | /api/identity/{tenantId}/waitlist/invite-all | Invite every pending waitlist entry |
| POST | /api/identity/{tenantId}/waitlist/{id}/invite | Approve a waitlist entry |
| POST | /api/identity/{tenantId}/waitlist/{id}/reinvite | Re-invite a waitlist entry |
| POST | /api/identity/{tenantId}/waitlist/{id}/deny | Deny a waitlist entry |
| GET | /api/signup | Read the tenant's sign-up posture |
| POST | /api/waitlist | Join the tenant's waitlist |
| POST | /api/waitlist/removal-requests | Ask for a waitlist removal link |
| POST | /api/waitlist/removals | Remove an address with its emailed token |
Account
The caller's own record
| Method | Path | Summary |
|---|---|---|
| GET | /api/account | Read your own user metadata |
| PATCH | /api/account | Update your own user metadata |
| GET | /api/account/linked-accounts | List your linked sign-in accounts |
| DELETE | /api/account/linked-accounts/{identityId} | Disconnect one of your linked sign-in accounts |
| GET | /api/account/sessions | List your active tenant login sessions |
| DELETE | /api/account/sessions/{sessionId} | Sign out one of your other devices |
| POST | /api/account/sessions/revoke-others | Sign out your other devices |
| PATCH | /api/identity/metadata | Update your own user metadata |
Audit log
A tenant's append-only audit log
| Method | Path | Summary |
|---|---|---|
| GET | /api/identity/{tenantId}/audit-events/export | Export the tenant's audit log |
| GET | /api/identity/{tenantId}/audit-events | List audit events |
Export
Own-your-data exports: the directory tier and the step-up-gated credential tier
| Method | Path | Summary |
|---|---|---|
| GET | /api/identity/{tenantId}/export/directory | Export the tenant's directory data |
| GET | /api/identity/{tenantId}/export/credentials | List the tenant's credential-export requests |
| POST | /api/identity/{tenantId}/export/credentials | Open a credential export |
| POST | /api/identity/{tenantId}/export/credentials/{id}/cancel | Cancel a credential export during its hold |
| GET | /api/identity/{tenantId}/export/credentials/{id}/download | Download a credential-export artifact |
Metrics
Dashboard overview aggregates
| Method | Path | Summary |
|---|---|---|
| GET | /api/identity/{tenantId}/metrics | Get the tenant's dashboard overview metrics |
Organizations in your application
The same caller-relative organizations, on the tenant's own origin, for a customer's application to call with its signed-in user's token — authority is that user's own membership, and no identity scope is required or accepted
Resource grants in your application
Who holds which of a tenant's roles on one of its resources, read and written by that tenant's own application with its own machine credential — the application is the authority and an end user's token is refused
| Method | Path | Summary |
|---|---|---|
| GET | /api/resource-grants | List the grants on one of your resources |
| POST | /api/resource-grants | Grant one of your roles on one of your resources |
| POST | /api/resource-grants/revoke | Revoke a role on one of your resources |
Authorization
Authorization checks a tenant's own application makes for its signed-in user, on the tenant's own origin
| Method | Path | Summary |
|---|---|---|
| POST | /api/check | Check the caller's own permissions |
| POST | /api/check/batch | Check the caller's own permissions across many resources |
| GET | /api/memberships | List the caller's own organization memberships |
Billing
| Method | Path | Summary |
|---|---|---|
| GET | /api/identity/{tenantId}/billing | Get the tenant's plan and the month so far |
| GET | /api/identity/{tenantId}/billing/invoices | List the tenant's invoices |
Resource grants
| Method | Path | Summary |
|---|---|---|
| GET | /api/identity/{tenantId}/resource-grants | List the grants on a resource |
| POST | /api/identity/{tenantId}/resource-grants | Grant a role on a resource |
| POST | /api/identity/{tenantId}/resource-grants/revoke | Revoke a role on a resource |
Resource types
| Method | Path | Summary |
|---|---|---|
| GET | /api/identity/{tenantId}/resource-types | List resource types |
| POST | /api/identity/{tenantId}/resource-types | Register a resource type |
| GET | /api/identity/{tenantId}/resource-types/{resourceTypeId} | Get a resource type |
| DELETE | /api/identity/{tenantId}/resource-types/{resourceTypeId} | Delete a resource type |
| PATCH | /api/identity/{tenantId}/resource-types/{resourceTypeId} | Update a resource type's description |
Usage limits
| Method | Path | Summary |
|---|---|---|
| GET | /api/identity/{tenantId}/usage-limits | Get the tenant's usage limits |
| PUT | /api/identity/{tenantId}/usage-limits | Replace the tenant's usage limits |
| POST | /api/identity/{tenantId}/usage-limits/confirmations | Send a nominated alert recipient its confirmation again |
system
| Method | Path | Summary |
|---|---|---|
| GET | /api/health | Service health |