> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation. # Get all resource rules `GET /api/web/v2/resourcerules` Get all resource rules. Caller requires the CONTEXTRULES:VIEW permission. ## Responses ### 200 Successful #### application/json Schema ```json { "type": "array", "items": { "required": [ "disableSSO", "groups", "name", "skipSecondFactorIfUserNotExist", "strictAccess" ], "type": "object", "properties": { "acrFilter": { "type": "string", "description": "Identifies how the resource rule acr access filter operates. NA: The resource rule will apply to all requests. This is the default value. NONE: The resource rule will only apply if no acrs were requested. ANY: The resource rule will only apply if acrs were requested. SPECIFIC: The resource rule will only apply if acrs were requested and one of the requested acrs matches one from a specified list.", "enum": [ "NA", "NONE", "ANY", "SPECIFIC" ] }, "acrs": { "type": "array", "description": "The acrs associated with this resource rule if acrFilter is set to SPECIFIC. The resource rule will only apply if a requested acr is one of the specified acrs.", "items": { "required": [ "id" ], "type": "object", "properties": { "id": { "type": "string", "description": "The unique UUID assigned to the acr when it is created." }, "name": { "type": "string", "description": "The name of the acr." }, "readOnly": { "type": "boolean", "description": "A flag indicating if the authentication flow can be modified or deleted." }, "resourceRules": { "type": "array", "description": "List of resource rule names using the acr.", "items": { "type": "string", "description": "List of resource rule names using the acr." } } }, "description": "The acrs associated with this resource rule if acrFilter is set to SPECIFIC. The resource rule will only apply if a requested acr is one of the specified acrs.", "title": "Acr" } }, "apiVersion": { "type": "integer", "description": "The resource rules API version used to create or last update this resource rule. If the resource rule is at version 2, then it cannot be updated using a version 1 API.", "format": "int32", "readOnly": true, "enum": [ 1, 2 ] }, "dateTimeContext": { "required": [ "denyAccess", "riskPoint" ], "type": "object", "properties": { "allowedDateTime": { "type": "boolean", "description": "If true, the startDateTime and endDateTime define the allowed range. If false, the startDateTime and endDateTime define the denied range." }, "allowedTime": { "type": "boolean", "description": "If true, the startTime and endTime define the allowed time range. If false, the startTime and endTime define the denied time range." }, "denyAccess": { "type": "boolean", "description": "If true, the resource rule evaluating the context will return Access Denied." }, "endDateTime": { "type": "string", "description": "If specifying a date range, the end date of the range.", "format": "date-time", "example": "2019-02-19T13:15:27Z" }, "endTime": { "type": "string", "description": "If specifying a time range, the end time of the range. The value should be of the form hh:mm:ss", "example": "17:00:00" }, "riskPoint": { "maximum": 100, "minimum": 0, "type": "integer", "description": "The number of risk points that apply if this context applies.", "format": "int32" }, "startDateTime": { "type": "string", "description": "If specifying a date range, the start date of the range.", "format": "date-time", "example": "2019-02-19T13:15:27Z" }, "startTime": { "type": "string", "description": "If specifying a time range, the start time of the range. The value should be of the form hh:mm:ss", "example": "08:00:00" }, "weekDays": { "type": "array", "description": "If specifying a time range, the days of the week to which the time range will apply.", "items": { "type": "string", "description": "If specifying a time range, the days of the week to which the time range will apply.", "enum": [ "Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun" ] } }, "zoneId": { "type": "string", "description": "The time zone or fixed offset in which dates and times are interpreted. For example, a value like -05:00 to specify a fixed offset of 5 hours behind UTC, or a time zone ID like America/New_York to account for regional time zone rules, including daylight saving time. Set this value if you want to interpret times (e.g., 8 AM to 5 PM) in the customer's local time zone rather than the timezone of the service. If not specified, the default is Z (UTC).", "example": "America/New_York" } }, "description": "The DateTimeContext context specifies an allowed or disallowed date or time range. Only a date range or a time range can be specified. Risk is applied to the authentication if the current time is outside an allowed range or inside a disallowed range. A date range specifies a start and end date. For example 2019/01/01 to 2019/03/01. A time range species a start and end time and days of the week. For example Monday to Friday, 8am to 5pm.", "title": "DateTimeContext" }, "description": { "type": "string", "description": "The description of the resource rule." }, "deviceCertificateContext": { "required": [ "denyAccess", "riskPoint" ], "type": "object", "properties": { "denyAccess": { "type": "boolean", "description": "If true, the resource rule evaluating the context will return Access Denied." }, "riskPoint": { "maximum": 100, "minimum": 0, "type": "integer", "description": "The number of risk points that apply if this context applies.", "format": "int32" } }, "description": "Device Certificate checks to see if the user presented a trusted device certificate that's valid. If not found, risk is applied.", "title": "DeviceCertificateContext" }, "disableSSO": { "type": "boolean", "description": "A flag indicating if single-sign on is disabled for this resource rule." }, "domainIdpFilter": { "type": "string", "description": "Identifies how the resource rule domain idp access filter operates. This is the default value. NA: The resource rule will apply to all requests. NONE: The resource rule will only apply if the user does not have a domain-based IDP. ANY: The resource rule will only apply if the user has a domain-based IDP. SPECIFIC: The resource rule will only apply if the user has a domain-based IDP and the user's domain matches one from a specified list.", "enum": [ "NA", "NONE", "ANY", "SPECIFIC" ] }, "domainIdps": { "type": "array", "description": "The domain-based identity providers associated with this resource rule if domainIdpFilter is set to SPECIFIC. The resource rule will only apply to users using one of the specified domain-based identity providers.", "items": { "type": "object", "properties": { "authenticationEnabled": { "type": "boolean", "description": "A flag indicating if the external identity provider can be used for user authentication.", "example": true }, "buttonImage": { "type": "string", "description": "The URI of the logo to display on the login button for this external identity provider.", "example": "https://account.mycompany.com/images/logo.png" }, "buttonText": { "type": "string", "description": "The unique text to display on the login button for this external identity provider.", "example": "Sign in With MyCompany Co." }, "createUser": { "type": "boolean", "description": "A flag indicating if the user should be created after authenticating to the external identity provider if it doesn't exist. The user attributes specified by the userAttributeMappings attribute are used to populate the user in IDaaS. This value is used if authenticationEnabled is true.", "example": true }, "defaultProvider": { "type": "boolean", "description": "A flag indicating if this is the tenant's default identity provider. This value applies only to non-domain based identity providers. Only one identity provider can be set as the default at a time." }, "domains": { "type": "string", "description": "The space separated list of domains associated with the external identity provider for use with user authentication.", "example": "test.com sample.com" }, "id": { "type": "string", "description": "The UUID of the external identity provider.", "example": "6784549d-433c-44ea-a42f-4701458dg245" }, "issuer": { "type": "string", "description": "The issuer URI for the external OIDC identity provider or the issuer, or IDP Entity ID, for the external SAML identity provider.", "example": "https://accounts.mycompany.com" }, "name": { "type": "string", "description": "The unique name of the external identity provider.", "example": "MyCompany Co." }, "protocol": { "type": "string", "description": "The type of the external identity provider.", "example": "OIDC", "enum": [ "OIDC", "SAML" ] }, "spId": { "type": "string", "description": "The client identifier provided by the external OIDC identity provider or the SP entity ID provided to the external SAML identity provider.", "example": "client123" }, "type": { "type": "string", "description": "The type of the external identity provider.", "example": "GENERIC" }, "verificationCertificate2DN": { "type": "string", "description": "The verification certificate2 DN used with the external identity provider." }, "verificationCertificate2ExpiryDate": { "type": "string", "description": "The verification certificate2 expiry date used with the external identity provider.", "format": "date-time", "example": "2019-02-19T13:15:27Z" }, "verificationCertificateDN": { "type": "string", "description": "The verification certificate DN used with the external identity provider." }, "verificationCertificateExpiryDate": { "type": "string", "description": "The verification certificate expiry date used with the external identity provider.", "format": "date-time", "example": "2019-02-19T13:15:27Z" }, "verificationEnabled": { "type": "boolean", "description": "A flag indicating if the external identity provider can be used for user verification.", "example": true } }, "description": "An IdentityProvider defines the information returned about an external identity provider for use with user authentication or user verification.", "title": "IdentityProvider" } }, "enabled": { "type": "boolean", "description": "A flag indicating if this resource rule is enabled or not. Only enabled resource rules are considered during authentication." }, "groups": { "type": "array", "description": "The groups associated with this resource rule. The resource rule only applies to users in one of the specified groups. A resource rule must specify at least one group which can be the default All Groups if you want the resource rule to apply to all users.", "items": { "required": [ "name" ], "type": "object", "properties": { "attribute": { "type": "string", "description": "The attribute of this group." }, "created": { "type": "string", "description": "When the group was created.", "format": "date-time", "example": "2019-02-19T13:15:27Z" }, "directoryDesynced": { "type": "boolean", "description": "Whether the directory group is desynced. Desynced groups can be deleted.", "example": false }, "externalId": { "type": "string", "description": "The externalId of this group." }, "id": { "type": "string", "description": "The UUID of this group. This value is generated when the group is created." }, "lastModified": { "type": "string", "description": "When the group was last modified.", "format": "date-time", "example": "2019-02-19T13:15:27Z" }, "name": { "type": "string", "description": "The name of this group." }, "type": { "type": "string", "description": "The type of group indicating if this group was synchronized from a directory (LDAP_AD) or was created in Identity as a Service (MGMT_UI).", "example": "MGMT_UI", "enum": [ "LDAP_AD", "MGMT_UI" ] } }, "description": "Information returned about a group.", "title": "Group" } }, "highRiskAuthenticationFlow": { "required": [ "id", "loginFlows", "name", "readOnly" ], "type": "object", "properties": { "applications": { "type": "array", "description": "List of applications using this authentication flow.", "items": { "required": [ "resourceRules" ], "type": "object", "properties": { "id": { "type": "string", "description": "The UUID of the application." }, "name": { "type": "string", "description": "The name of the application." }, "resourceRules": { "type": "array", "description": "List of resource rules associated to this application.", "items": { "required": [ "id", "name" ], "type": "object", "properties": { "id": { "type": "string", "description": "The unique UUID assigned to the resource rule when it is created." }, "name": { "type": "string", "description": "The name of the resource rule." } }, "description": "A ResourceRuleNameId contains a resource rule name and unique id.", "title": "ResourceRuleNameId" } } }, "description": "An ApplicationResourceRule defines the resource rules used by an application.", "title": "ApplicationResourceRule" } }, "id": { "type": "string", "description": "The unique UUID assigned to the authentication flow when it is created." }, "identityProviders": { "type": "array", "description": "The identity providers, both OIDC and SAML, supported when the IDP login flow is enabled--limited info is returned. This parameter should be used instead of oidcIdentityProviders.", "items": { "type": "object", "properties": { "authenticationEnabled": { "type": "boolean", "description": "A flag indicating if the external identity provider can be used for user authentication.", "example": true }, "buttonImage": { "type": "string", "description": "The URI of the logo to display on the login button for this external identity provider.", "example": "https://account.mycompany.com/images/logo.png" }, "buttonText": { "type": "string", "description": "The unique text to display on the login button for this external identity provider.", "example": "Sign in With MyCompany Co." }, "createUser": { "type": "boolean", "description": "A flag indicating if the user should be created after authenticating to the external identity provider if it doesn't exist. The user attributes specified by the userAttributeMappings attribute are used to populate the user in IDaaS. This value is used if authenticationEnabled is true.", "example": true }, "defaultProvider": { "type": "boolean", "description": "A flag indicating if this is the tenant's default identity provider. This value applies only to non-domain based identity providers. Only one identity provider can be set as the default at a time." }, "domains": { "type": "string", "description": "The space separated list of domains associated with the external identity provider for use with user authentication.", "example": "test.com sample.com" }, "id": { "type": "string", "description": "The UUID of the external identity provider.", "example": "6784549d-433c-44ea-a42f-4701458dg245" }, "issuer": { "type": "string", "description": "The issuer URI for the external OIDC identity provider or the issuer, or IDP Entity ID, for the external SAML identity provider.", "example": "https://accounts.mycompany.com" }, "name": { "type": "string", "description": "The unique name of the external identity provider.", "example": "MyCompany Co." }, "protocol": { "type": "string", "description": "The type of the external identity provider.", "example": "OIDC", "enum": [ "OIDC", "SAML" ] }, "spId": { "type": "string", "description": "The client identifier provided by the external OIDC identity provider or the SP entity ID provided to the external SAML identity provider.", "example": "client123" }, "type": { "type": "string", "description": "The type of the external identity provider.", "example": "GENERIC" }, "verificationCertificate2DN": { "type": "string", "description": "The verification certificate2 DN used with the external identity provider." }, "verificationCertificate2ExpiryDate": { "type": "string", "description": "The verification certificate2 expiry date used with the external identity provider.", "format": "date-time", "example": "2019-02-19T13:15:27Z" }, "verificationCertificateDN": { "type": "string", "description": "The verification certificate DN used with the external identity provider." }, "verificationCertificateExpiryDate": { "type": "string", "description": "The verification certificate expiry date used with the external identity provider.", "format": "date-time", "example": "2019-02-19T13:15:27Z" }, "verificationEnabled": { "type": "boolean", "description": "A flag indicating if the external identity provider can be used for user verification.", "example": true } }, "description": "An IdentityProvider defines the information returned about an external identity provider for use with user authentication or user verification.", "title": "IdentityProvider" } }, "idpDefault": { "type": "boolean", "description": "A flag indicating whether the authentication flow uses the tenant's default IDP. When true, domain-based IDPs are not supported." }, "idpDomainBased": { "type": "boolean", "description": "A flag indicating if the authentication flow will be using domain-based IDPs." }, "idpLoginSecondStep": { "type": "array", "description": "The authenticator type to use during in the second step of a two-step authentication scenario when the identity provider Login flow is enabled and requires a second factor. PASSTHROUGH is not supported.", "items": { "type": "string", "description": "The authenticator type to use during in the second step of a two-step authentication scenario when the identity provider Login flow is enabled and requires a second factor. PASSTHROUGH is not supported.", "enum": [ "NONE", "KBA", "TEMP_ACCESS_CODE", "OTP", "GRID", "TOKEN", "TOKENCR", "TOKENPUSH", "FIDO", "USER_CERTIFICATE", "SMARTCREDENTIALPUSH", "FACE", "PASSTHROUGH", "MAGICLINK" ] } }, "loginFlows": { "type": "array", "description": "List of login flows.", "items": { "required": [ "enabled", "loginFlowType" ], "type": "object", "properties": { "enabled": { "type": "boolean", "description": "Whether the login flow is enabled or not.", "example": true }, "loginFlowType": { "type": "string", "description": "Identifies the login flow type.", "enum": [ "USER_LOGIN", "SMART_LOGIN", "IDP_LOGIN", "PASSKEY_LOGIN", "USER_CERTIFICATE_LOGIN" ] } }, "description": "An LoginFlow defines an authentication option available in the authentication flow.", "title": "LoginFlow" } }, "name": { "type": "string", "description": "The name of the authentication flow." }, "namedPasswordId": { "type": "string", "description": "The Named Password Id used for password authentication." }, "oidcIdentityProviders": { "type": "array", "description": "The OIDC identity providers supported when the IDP login flow is enabled--limited info is returned. This parameter is deprecated, use identityProviders instead.", "deprecated": true, "items": { "type": "object", "properties": { "acrValues": { "type": "string", "description": "The space separated list of authentication context request values to request as part of the external OIDC identity provider user authentication or user verification request.", "example": "level1 level2" }, "amrValues": { "type": "string", "description": "The space separated list of authentication method request values to request as part of the external OIDC identity provider user authentication or user verification request.", "example": "level1 level2" }, "authenticationEnabled": { "type": "boolean", "description": "A flag indicating if the external OIDC identity provider can be used for user authentication.", "example": true }, "authorizationEndpoint": { "type": "string", "description": "The authorization endpoint for the external OIDC identity provider.", "example": "https://account.mycompany.com/oauth/authorize" }, "buttonImage": { "type": "string", "description": "The URI of the logo to display on the login button for this external OIDC identity provider.", "example": "https://account.mycompany.com/images/logo.png" }, "buttonText": { "type": "string", "description": "The unique text to display on the login button for this external OIDC identity provider.", "example": "Sign in With MyCompany Co." }, "clientAuthenticationMethod": { "type": "string", "description": "The client authentication method to use with the external OIDC identity provider.", "example": "ClientAuthenticationMethod.CLIENT_SECRET_BASIC", "enum": [ "CLIENT_SECRET_BASIC", "CLIENT_SECRET_POST" ] }, "clientId": { "type": "string", "description": "The client identifier provided by the external OIDC identity provider.", "example": "client123" }, "clientSecret": { "type": "string", "description": "The client secret provided by the external OIDC identity provider. Currently this value is not returned.", "example": "cl1en7S3cr3t!" }, "createUser": { "type": "boolean", "description": "A flag indicating if the user should be created after authenticating to the external OIDC identity provider if it doesn't exist. The user attributes specified by the userAttributeMappings attribute are used to populate the user in IDaaS. This value is used if authenticationEnabled is true.", "example": true }, "defaultProvider": { "type": "boolean", "description": "A flag indicating if this is the tenant's default identity provider. This value applies only to non-domain based identity providers. Only one identity provider can be set as the default at a time." }, "domains": { "type": "string", "description": "The space separated list of domains associated with the external OIDC identity provider for use with user authentication.", "example": "test.com sample.com" }, "externalGroupMappings": { "type": "array", "description": "The association between a group claim returned from the external OIDC identity provider and authorization groups. This mapping is used to associate OIDC identity provider external groups when a user is created or modified based on user authentication or when it is modified based on an external OIDC identity provider user verification. This value can only be set if createUser, updateUser, or updateVerificationUser is true and groupMapping is present.", "items": { "required": [ "externalGroupId", "groupId" ], "type": "object", "properties": { "externalGroupId": { "type": "string", "description": "The external group name/ID returned from the identity provider.", "example": "admin-group" }, "groupId": { "type": "string", "description": "The Authorization Group UUID this external group maps to." }, "id": { "type": "string", "description": "The UUID of the identity provider external group mapping. This value is generated once the mapping is created.", "example": "6781549d-433c-44ea-a42f-4705c26f3245" }, "identityProviderId": { "type": "string", "description": "The ID of the identity provider this external group mapping belongs to.", "example": "6781549d-433c-44ea-a42f-4705c26f3245" } }, "description": "A IdentityProviderExternalGroupMapping maps a group name/ID returned from an external identity provider to an Authorization Group for matching purposes.", "title": "IdentityProviderExternalGroupMapping" } }, "fields": { "type": "string", "description": "The value of user fields that need to be set the external OIDC identity provider when acquiring user information. This value is used with a TWITTER IDP.", "example": "email,name,first_name,last_name" }, "groupIds": { "type": "array", "description": "The UUIDs of groups that will be assigned to users created after an external OIDC identity provider user authentication. An empty list means the user will be assigned to All Groups. If configured, the full set of groups must be configured. This value is used if createUser is true.", "items": { "type": "string", "description": "The UUIDs of groups that will be assigned to users created after an external OIDC identity provider user authentication. An empty list means the user will be assigned to All Groups. If configured, the full set of groups must be configured. This value is used if createUser is true." } }, "groupMapping": { "type": "string", "description": "The association between a specified claim returned from the external OIDC identity provider and IDaaS groups. This mapping is used to associated IDaaS groups when a user is created or modified based on an external OIDC identity provider user authentication or when it is modified based on an external OIDC identity provider user verification. This value is used if createUser, updateUser, or updateVerificationUser is true." }, "id": { "type": "string", "description": "The UUID of the external OIDC identity provider.", "example": "6784549d-433c-44ea-a42f-4701458dg245" }, "idTokenClaims": { "type": "string", "description": "The space separated list of id token claims to request as part of the external OIDC identity provider user authentication or user verification request.", "example": "groups upn" }, "issuer": { "type": "string", "description": "The issuer URI for the external OIDC identity provider.", "example": "https://accounts.mycompany.com" }, "jwksUri": { "type": "string", "description": "The JWKS URI endpoint for the external OIDC identity provider used to verify a token signature.", "example": "https://account.mycompany.com/oauth/discovery/keys" }, "maxAge": { "maximum": 2592000, "minimum": -1, "type": "integer", "description": "The max age to request as part of the external OIDC identity provider user authentication or user verification request. If -1, the value will not be included in the request.", "format": "int32", "example": 300 }, "name": { "type": "string", "description": "The unique name of the external OIDC identity provider.", "example": "MyCompany Co." }, "organizationIds": { "type": "array", "description": "The UUIDs of organizations that will be assigned to users created after an external OIDC identity provider user authentication. If configured, the full set of organizations must be configured. This value is used if createUser is true.", "items": { "type": "string", "description": "The UUIDs of organizations that will be assigned to users created after an external OIDC identity provider user authentication. If configured, the full set of organizations must be configured. This value is used if createUser is true." } }, "requireUserinfoSignature": { "type": "boolean", "description": "A flag indicating if the user information endpoint of the external OIDC identity provider should be signed and verified.", "example": true }, "revocationEndpoint": { "type": "string", "description": "The revocation endpoint for the external OIDC identity provider.", "example": "https://account.mycompany.com/oauth/revoke" }, "roleId": { "type": "string", "description": "The UUID of the role that will be assigned to users created after an external OIDC identity provider user authentication. An empty string means the user will not be assigned a role by default. This role acts as the default if role mapping is empty. This value can only be set if createUser is true." }, "roleMapping": { "type": "string", "description": "The association between a specified claim returned from the external OIDC identity provider and an IDaaS role. This mapping is used to associated an IDaaS role when a user is created or modified based on an external OIDC identity provider user authentication or when it is modified based on an external OIDC identity provider user verification. This value is used if createUser, updateUser, or updateVerificationUser is true." }, "scopes": { "type": "string", "description": "The space separated list of scopes to request as part of the external OIDC identity provider user authentication or user verification request.", "example": "openid email" }, "tokenEndpoint": { "type": "string", "description": "The token endpoint for the external OIDC identity provider.", "example": "https://account.mycompany.com/oauth/token" }, "type": { "type": "string", "description": "The type of the external OIDC identity provider. Once created, this value cannot be updated.", "example": "FACEBOOK", "enum": [ "FACEBOOK", "GENERIC", "GOOGLE", "IDV", "MICROSOFT", "SP", "TWITTER" ] }, "updateUser": { "type": "boolean", "description": "A flag indicating if the user should be updated after authenticating to the external OIDC identity provider if it exists. The user attributes specified by the userAttributeMappings attribute are used to populate the user in IDaaS. This value is used if authenticationEnabled is true.", "example": true }, "updateUserVerification": { "type": "boolean", "description": "A flag indicating if the user should be updated after user verification to the external OIDC identity provider if it exists. The user attributes specified by the userAttributeMappings attribute are used to populate the user in IDaaS. This value is used if verificationEnabled is true.", "example": true }, "userAttributeId": { "type": "string", "description": "The IDaaS user attribute ID used to find IDaaS users associated with an external OIDC identity provider user authentication. This value is used if authenticationEnabled is true." }, "userAttributeMappings": { "type": "array", "description": "The association between the claims returned from the external OIDC identity provider and IDaaS user attributes. These attributes are used to populate user attributes when it is created or modified based on an external OIDC identity provider user authentication or when it is modified based on an external OIDC identity provider user verification. If configured, the full set of mappings must be configured. This value is used if createUser, updateUser, or updateVerificationUser is true.", "items": { "required": [ "claim", "userAttributeId" ], "type": "object", "properties": { "claim": { "type": "string", "description": "The name of the claim being mapped. This value must be provided when creating or modifying an attribute mapping.", "example": "email" }, "id": { "type": "string", "description": "The UUID of the OIDC identity provider attribute mapping.", "example": "6781549d-433c-44ea-a42f-4705c26f3245" }, "oidcIdentityProviderId": { "type": "string", "description": "The UUID of the OIDC identity provider the attribute mapping belongs to.", "example": "6881549d-433c-44ea-a42f-4705c26f3245" }, "userAttribute": { "required": [ "mandatory", "name", "systemDefined", "unique" ], "type": "object", "properties": { "id": { "type": "string", "description": "The UUID for this user attribute. Generated when the user attribute is created." }, "mandatory": { "type": "boolean", "description": "A flag indicating if users must have a value for this user attribute." }, "name": { "type": "string", "description": "The name of this user attribute." }, "systemDefined": { "type": "boolean", "description": "A flag indicating if this user attribute is one of the system defined user attributes." }, "type": { "type": "string", "description": "Type of user attribute. Currently only used to specify the type of contact if the attribute is to be used for OTP delivery.", "example": "OTP_EMAIL", "enum": [ "NONE", "OTP_EMAIL", "OTP_SMS", "OTP_VOICE", "OTP_WECHAT", "OTP_WHATSAPP" ] }, "unique": { "type": "boolean", "description": "A flag indicating if this attribute is intended to be unique." } }, "description": "Information about user attribute definitions.", "title": "UserAttribute" }, "userAttributeId": { "type": "string", "description": "The UUID of the IDaaS user attribute being mapped to. This value must be provided when creating or modifying an attribute mapping.", "example": "6981549d-433c-44ea-a42f-4705c26f3245" } }, "description": "An OidcIdentityProviderAttributeMapping maps a claim returned from an external OIDC identity provider user authentication or user verification to an IDaaS user attribute.", "title": "OidcIdentityProviderAttributeMapping" } }, "userAuthMatchMappings": { "type": "array", "description": "The association between the claims returned from the external OIDC identity provider and IDaaS user attributes. These attributes are used to match an existing IDaaS user based on an external OIDC identity provider user authentication. If configured, the full set of mappings must be configured. This value is used if authenticationEnabled is true.", "items": { "required": [ "claim", "userAttributeId" ], "type": "object", "properties": { "claim": { "type": "string", "description": "The name of the claim being mapped. This value must be provided when creating or modifying a user authentication match mapping.", "example": "email" }, "id": { "type": "string", "description": "The UUID of the OIDC identity provider user authentication match mapping.", "example": "6781549d-433c-44ea-a42f-4705c26f3245" }, "oidcIdentityProviderId": { "type": "string", "description": "The UUID of the OIDC identity provider the user authentication match mapping belongs to.", "example": "6881549d-433c-44ea-a42f-4705c26f3245" }, "userAttribute": { "required": [ "mandatory", "name", "systemDefined", "unique" ], "type": "object", "properties": { "id": { "type": "string", "description": "The UUID for this user attribute. Generated when the user attribute is created." }, "mandatory": { "type": "boolean", "description": "A flag indicating if users must have a value for this user attribute." }, "name": { "type": "string", "description": "The name of this user attribute." }, "systemDefined": { "type": "boolean", "description": "A flag indicating if this user attribute is one of the system defined user attributes." }, "type": { "type": "string", "description": "Type of user attribute. Currently only used to specify the type of contact if the attribute is to be used for OTP delivery.", "example": "OTP_EMAIL", "enum": [ "NONE", "OTP_EMAIL", "OTP_SMS", "OTP_VOICE", "OTP_WECHAT", "OTP_WHATSAPP" ] }, "unique": { "type": "boolean", "description": "A flag indicating if this attribute is intended to be unique." } }, "description": "Information about user attribute definitions.", "title": "UserAttribute" }, "userAttributeId": { "type": "string", "description": "The UUID of the IDaaS user attribute being mapped to. This value must be provided when creating or modifying a user authentication match mapping.", "example": "6981549d-433c-44ea-a42f-4705c26f3245" } }, "description": "An OidcIdentityProviderUserAuthMatchMapping maps a claim returned from an external OIDC identity provide user authentication to an IDaaS User user attribute for matching purposes.", "title": "OidcIdentityProviderUserAuthMatchMapping" } }, "userClaim": { "type": "string", "description": "The external OIDC identity provider claim used to find IDaaS users associated with an external OIDC identity provider user authentication. This value is used if authenticationEnabled is true." }, "userVerMatchMappings": { "type": "array", "description": "The association between the claims returned from the external OIDC identity provider and IDaaS user attributes. These attributes are used to match an existing IDaaS user based on an external OIDC identity provider user verification. If configured, the full set of mappings must be configured. This value is used if verificationEnabled is true.", "items": { "required": [ "claim", "userAttributeId" ], "type": "object", "properties": { "claim": { "type": "string", "description": "The name of the claim being mapped. This value must be provided when creating or modifying a user verification match mapping.", "example": "email" }, "id": { "type": "string", "description": "The UUID of the OIDC identity provider user verification match mapping.", "example": "6781549d-433c-44ea-a42f-4705c26f3245" }, "oidcIdentityProviderId": { "type": "string", "description": "The UUID of the OIDC identity provider the user verification match mapping belongs to.", "example": "6881549d-433c-44ea-a42f-4705c26f3245" }, "userAttribute": { "required": [ "mandatory", "name", "systemDefined", "unique" ], "type": "object", "properties": { "id": { "type": "string", "description": "The UUID for this user attribute. Generated when the user attribute is created." }, "mandatory": { "type": "boolean", "description": "A flag indicating if users must have a value for this user attribute." }, "name": { "type": "string", "description": "The name of this user attribute." }, "systemDefined": { "type": "boolean", "description": "A flag indicating if this user attribute is one of the system defined user attributes." }, "type": { "type": "string", "description": "Type of user attribute. Currently only used to specify the type of contact if the attribute is to be used for OTP delivery.", "example": "OTP_EMAIL", "enum": [ "NONE", "OTP_EMAIL", "OTP_SMS", "OTP_VOICE", "OTP_WECHAT", "OTP_WHATSAPP" ] }, "unique": { "type": "boolean", "description": "A flag indicating if this attribute is intended to be unique." } }, "description": "Information about user attribute definitions.", "title": "UserAttribute" }, "userAttributeId": { "type": "string", "description": "The UUID of the IDaaS user attribute being mapped to. This value must be provided when creating or modifying a user verification match mapping.", "example": "6981549d-433c-44ea-a42f-4705c26f3245" } }, "description": "An OidcIdentityProviderUserVerMatchMapping maps a claim returned from an external OIDC identity provide user verification to an IDaaS User user attribute for matching purposes.", "title": "OidcIdentityProviderUserVerMatchMapping" } }, "userinfoClaims": { "type": "string", "description": "The space separated list of user information claims to request as part of the external OIDC identity provider user authentication or user verification request.", "example": "groups upn" }, "userinfoEndpoint": { "type": "string", "description": "The user information endpoint for the external OIDC identity provider.", "example": "https://account.mycompany.com/oauth/userinfo" }, "verificationEnabled": { "type": "boolean", "description": "A flag indicating if the external OIDC identity provider can be used for user verification.", "example": true } }, "description": "An OidcIdentityProvider defines the information returned about an external OpenID Connect identity provider for use with user authentication or user verification.", "title": "OidcIdentityProvider" } }, "otpDeliveryPreference": { "type": "array", "description": "The order preference to use for OTP delivery.", "items": { "required": [ "type" ], "type": "object", "properties": { "contactAttributes": { "type": "array", "description": "A list of uuids of the otp contact attributes in order which indicates the OTP contacts preference.", "items": { "type": "string", "description": "A list of uuids of the otp contact attributes in order which indicates the OTP contacts preference." } }, "type": { "type": "string", "description": "Indicates the type of the otp preference details.", "example": "SMS", "enum": [ "EMAIL", "SMS", "VOICE", "WECHAT", "WHATSAPP", "NONE" ] } }, "description": "Settings that control the behavior of OTP authentication.", "title": "OTPPreferenceDetails" } }, "overrideOtpContacts": { "type": "boolean", "description": "A flag indicating if group based OTP policy can be overridden by the authentication flow OTP policy." }, "readOnly": { "type": "boolean", "description": "A flag indicating if the authentication flow can be modified or deleted." }, "userLoginFirstStep": { "type": "string", "description": "The authenticator type to use in the first step of a two-step authentication scenario when the User Login flow is enabled.", "enum": [ "NONE", "EXTERNAL", "PASSWORD", "KBA", "OTP", "TOKEN", "TOKENPUSH", "SMARTCREDENTIALPUSH", "IDP", "PASSKEY", "SMART_LOGIN", "USER_CERTIFICATE", "FACE", "DENY", "MAGICLINK" ] }, "userLoginSecondStep": { "type": "array", "description": "The authenticator type to use during in the second step of a two-step authentication scenario when the User Login flow is enabled.", "items": { "type": "string", "description": "The authenticator type to use during in the second step of a two-step authentication scenario when the User Login flow is enabled.", "enum": [ "NONE", "KBA", "TEMP_ACCESS_CODE", "OTP", "GRID", "TOKEN", "TOKENCR", "TOKENPUSH", "FIDO", "USER_CERTIFICATE", "SMARTCREDENTIALPUSH", "FACE", "PASSTHROUGH", "MAGICLINK" ] } } }, "description": "An AuthenticationFlow defines the authentication options available for a given risk level.", "title": "AuthenticationFlow" }, "highRiskEnableSmartLogin": { "type": "boolean", "description": "A flag indicating if Smart Login is enabled for High risk. This parameter is deprecated, use the highRiskAuthenticationFlow attribute with v2 APIs.", "deprecated": true }, "highRiskFirstStep": { "type": "string", "description": "The authenticator type to use in the first step of a two-step authentication scenario when the risk score is High. This parameter is deprecated, use the highRiskAuthenticationFlow attribute with v2 APIs.", "deprecated": true, "enum": [ "NONE", "EXTERNAL", "PASSWORD", "KBA", "OTP", "TOKEN", "TOKENPUSH", "SMARTCREDENTIALPUSH", "IDP", "PASSKEY", "SMART_LOGIN", "USER_CERTIFICATE", "FACE", "DENY", "MAGICLINK" ] }, "highRiskSecondStep": { "type": "array", "description": "The authenticator type to use during in the second step of a two-step authentication scenario when the risk score is High. This parameter is deprecated, use the highRiskAuthenticationFlow attribute with v2 APIs.", "deprecated": true, "items": { "type": "string", "description": "The authenticator type to use during in the second step of a two-step authentication scenario when the risk score is High. This parameter is deprecated, use the highRiskAuthenticationFlow attribute with v2 APIs.", "deprecated": true, "enum": [ "NONE", "KBA", "TEMP_ACCESS_CODE", "OTP", "GRID", "TOKEN", "TOKENCR", "TOKENPUSH", "FIDO", "USER_CERTIFICATE", "SMARTCREDENTIALPUSH", "FACE", "PASSTHROUGH", "MAGICLINK" ] } }, "id": { "type": "string", "description": "The unique UUID assigned to the resource rule when it is created." }, "ipContext": { "required": [ "denyAccess", "riskPoint" ], "type": "object", "properties": { "allowedIpList": { "type": "string", "description": "The UUID of an existing IP List that defines IPs that can access the resource. Risk applies if the given IP address is not found in the IP List. If specified, the allowed IP List takes precedence over the denied IP List." }, "allowedIpRanges": { "type": "array", "description": "List of IP Address ranges (in CIDR notation) that are allowed access the resource. Risk applies if the given IP address is not in one of the allowed IP ranges. If specified, the allowed IP values take precedence over the denied IP values.", "items": { "type": "string", "description": "List of IP Address ranges (in CIDR notation) that are allowed access the resource. Risk applies if the given IP address is not in one of the allowed IP ranges. If specified, the allowed IP values take precedence over the denied IP values." } }, "deniedIpList": { "type": "string", "description": "The UUID of an existing IP List that defines IPs that cannot access the resource. Risk applies if the given IP address is found in the IP List. The denied IP List is ignored if an allowed IP List is specified." }, "deniedIpRanges": { "type": "array", "description": "List of IP Address ranges (in CIDR notation) that cannot access the resource. Risk applies if the given IP address is in one of the denied IP ranges. The denied IP values are ignored if allowed IP ranges are specified.", "items": { "type": "string", "description": "List of IP Address ranges (in CIDR notation) that cannot access the resource. Risk applies if the given IP address is in one of the denied IP ranges. The denied IP values are ignored if allowed IP ranges are specified." } }, "denyAccess": { "type": "boolean", "description": "If true, the resource rule evaluating the context will return Access Denied." }, "riskPoint": { "maximum": 100, "minimum": 0, "type": "integer", "description": "The number of risk points that apply if this context applies.", "format": "int32" }, "type": { "type": "string", "description": "The type of IpContext. If not specified, this value defaults to CUSTOM.", "enum": [ "CUSTOM", "IPLIST" ] } }, "description": "The IP context specifies allowed or denied IP address ranges or lists. Risk is applied to the authentication if the current IP address does not match an allowed IP address range/list or does match a denied IP address range/list.", "title": "IpContext" }, "kbaContext": { "required": [ "denyAccess" ], "type": "object", "properties": { "challengeSize": { "type": "integer", "description": "Number of questions that the user must answer. If not provided, the default QA challenge size in the KBA settings is used.", "format": "int32" }, "denyAccess": { "type": "boolean", "description": "If true, the resource rule evaluating the context will return Access Denied." }, "wrongAnswersAllowed": { "type": "integer", "description": "Number of questions that the user could answer incorrectly and still be considered a valid response. If not provided, the default wrong answers allowed in the KBA settings is used.", "format": "int32" } }, "description": "The KBA context allows the settings for knowledge-based authentication to be overridden for a particular resource rule. For example, a different challenge size can be specified.", "title": "KbaContext" }, "locationContext": { "required": [ "allowed", "anonymousAllowed", "countryCodes", "denyAccess", "riskPoint" ], "type": "object", "properties": { "allowed": { "type": "boolean", "description": "If true, the list of countries defines allowed countries. If false, the list of countries defines denied countries." }, "anonymousAllowed": { "type": "boolean", "description": "If true, then allows anonymous/TOR IP addresses. If false, then denies anonymous/TOR IP addresses." }, "countryCodes": { "type": "array", "description": "List of country codes (ISO alpha-2) that can access(allowed=true) or not access (allowed=false).", "items": { "type": "string", "description": "List of country codes (ISO alpha-2) that can access(allowed=true) or not access (allowed=false)." } }, "denyAccess": { "type": "boolean", "description": "If true, the resource rule evaluating the context will return Access Denied." }, "riskPoint": { "maximum": 100, "minimum": 0, "type": "integer", "description": "The number of risk points that apply if this context applies.", "format": "int32" } }, "description": "The location context specifies allowed or denied country codes. Risk is applied to the authentication if the location of the current IP address does not match an allowed country or matches a disallowed country.", "title": "LocationContext" }, "locationHistoryContext": { "required": [ "denyAccess", "riskPoint" ], "type": "object", "properties": { "denyAccess": { "type": "boolean", "description": "If true, the resource rule evaluating the context will return Access Denied." }, "riskPoint": { "maximum": 100, "minimum": 0, "type": "integer", "description": "The number of risk points that apply if this context applies.", "format": "int32" } }, "description": "Location history checks to see if the location of the current IP address matches a location from a previous authentication. If the current location does not match history, risk is applied.", "title": "LocationHistoryContext" }, "lowRiskAuthenticationFlow": { "required": [ "id", "loginFlows", "name", "readOnly" ], "type": "object", "properties": { "applications": { "type": "array", "description": "List of applications using this authentication flow.", "items": { "required": [ "resourceRules" ], "type": "object", "properties": { "id": { "type": "string", "description": "The UUID of the application." }, "name": { "type": "string", "description": "The name of the application." }, "resourceRules": { "type": "array", "description": "List of resource rules associated to this application.", "items": { "required": [ "id", "name" ], "type": "object", "properties": { "id": { "type": "string", "description": "The unique UUID assigned to the resource rule when it is created." }, "name": { "type": "string", "description": "The name of the resource rule." } }, "description": "A ResourceRuleNameId contains a resource rule name and unique id.", "title": "ResourceRuleNameId" } } }, "description": "An ApplicationResourceRule defines the resource rules used by an application.", "title": "ApplicationResourceRule" } }, "id": { "type": "string", "description": "The unique UUID assigned to the authentication flow when it is created." }, "identityProviders": { "type": "array", "description": "The identity providers, both OIDC and SAML, supported when the IDP login flow is enabled--limited info is returned. This parameter should be used instead of oidcIdentityProviders.", "items": { "type": "object", "properties": { "authenticationEnabled": { "type": "boolean", "description": "A flag indicating if the external identity provider can be used for user authentication.", "example": true }, "buttonImage": { "type": "string", "description": "The URI of the logo to display on the login button for this external identity provider.", "example": "https://account.mycompany.com/images/logo.png" }, "buttonText": { "type": "string", "description": "The unique text to display on the login button for this external identity provider.", "example": "Sign in With MyCompany Co." }, "createUser": { "type": "boolean", "description": "A flag indicating if the user should be created after authenticating to the external identity provider if it doesn't exist. The user attributes specified by the userAttributeMappings attribute are used to populate the user in IDaaS. This value is used if authenticationEnabled is true.", "example": true }, "defaultProvider": { "type": "boolean", "description": "A flag indicating if this is the tenant's default identity provider. This value applies only to non-domain based identity providers. Only one identity provider can be set as the default at a time." }, "domains": { "type": "string", "description": "The space separated list of domains associated with the external identity provider for use with user authentication.", "example": "test.com sample.com" }, "id": { "type": "string", "description": "The UUID of the external identity provider.", "example": "6784549d-433c-44ea-a42f-4701458dg245" }, "issuer": { "type": "string", "description": "The issuer URI for the external OIDC identity provider or the issuer, or IDP Entity ID, for the external SAML identity provider.", "example": "https://accounts.mycompany.com" }, "name": { "type": "string", "description": "The unique name of the external identity provider.", "example": "MyCompany Co." }, "protocol": { "type": "string", "description": "The type of the external identity provider.", "example": "OIDC", "enum": [ "OIDC", "SAML" ] }, "spId": { "type": "string", "description": "The client identifier provided by the external OIDC identity provider or the SP entity ID provided to the external SAML identity provider.", "example": "client123" }, "type": { "type": "string", "description": "The type of the external identity provider.", "example": "GENERIC" }, "verificationCertificate2DN": { "type": "string", "description": "The verification certificate2 DN used with the external identity provider." }, "verificationCertificate2ExpiryDate": { "type": "string", "description": "The verification certificate2 expiry date used with the external identity provider.", "format": "date-time", "example": "2019-02-19T13:15:27Z" }, "verificationCertificateDN": { "type": "string", "description": "The verification certificate DN used with the external identity provider." }, "verificationCertificateExpiryDate": { "type": "string", "description": "The verification certificate expiry date used with the external identity provider.", "format": "date-time", "example": "2019-02-19T13:15:27Z" }, "verificationEnabled": { "type": "boolean", "description": "A flag indicating if the external identity provider can be used for user verification.", "example": true } }, "description": "An IdentityProvider defines the information returned about an external identity provider for use with user authentication or user verification.", "title": "IdentityProvider" } }, "idpDefault": { "type": "boolean", "description": "A flag indicating whether the authentication flow uses the tenant's default IDP. When true, domain-based IDPs are not supported." }, "idpDomainBased": { "type": "boolean", "description": "A flag indicating if the authentication flow will be using domain-based IDPs." }, "idpLoginSecondStep": { "type": "array", "description": "The authenticator type to use during in the second step of a two-step authentication scenario when the identity provider Login flow is enabled and requires a second factor. PASSTHROUGH is not supported.", "items": { "type": "string", "description": "The authenticator type to use during in the second step of a two-step authentication scenario when the identity provider Login flow is enabled and requires a second factor. PASSTHROUGH is not supported.", "enum": [ "NONE", "KBA", "TEMP_ACCESS_CODE", "OTP", "GRID", "TOKEN", "TOKENCR", "TOKENPUSH", "FIDO", "USER_CERTIFICATE", "SMARTCREDENTIALPUSH", "FACE", "PASSTHROUGH", "MAGICLINK" ] } }, "loginFlows": { "type": "array", "description": "List of login flows.", "items": { "required": [ "enabled", "loginFlowType" ], "type": "object", "properties": { "enabled": { "type": "boolean", "description": "Whether the login flow is enabled or not.", "example": true }, "loginFlowType": { "type": "string", "description": "Identifies the login flow type.", "enum": [ "USER_LOGIN", "SMART_LOGIN", "IDP_LOGIN", "PASSKEY_LOGIN", "USER_CERTIFICATE_LOGIN" ] } }, "description": "An LoginFlow defines an authentication option available in the authentication flow.", "title": "LoginFlow" } }, "name": { "type": "string", "description": "The name of the authentication flow." }, "namedPasswordId": { "type": "string", "description": "The Named Password Id used for password authentication." }, "oidcIdentityProviders": { "type": "array", "description": "The OIDC identity providers supported when the IDP login flow is enabled--limited info is returned. This parameter is deprecated, use identityProviders instead.", "deprecated": true, "items": { "type": "object", "properties": { "acrValues": { "type": "string", "description": "The space separated list of authentication context request values to request as part of the external OIDC identity provider user authentication or user verification request.", "example": "level1 level2" }, "amrValues": { "type": "string", "description": "The space separated list of authentication method request values to request as part of the external OIDC identity provider user authentication or user verification request.", "example": "level1 level2" }, "authenticationEnabled": { "type": "boolean", "description": "A flag indicating if the external OIDC identity provider can be used for user authentication.", "example": true }, "authorizationEndpoint": { "type": "string", "description": "The authorization endpoint for the external OIDC identity provider.", "example": "https://account.mycompany.com/oauth/authorize" }, "buttonImage": { "type": "string", "description": "The URI of the logo to display on the login button for this external OIDC identity provider.", "example": "https://account.mycompany.com/images/logo.png" }, "buttonText": { "type": "string", "description": "The unique text to display on the login button for this external OIDC identity provider.", "example": "Sign in With MyCompany Co." }, "clientAuthenticationMethod": { "type": "string", "description": "The client authentication method to use with the external OIDC identity provider.", "example": "ClientAuthenticationMethod.CLIENT_SECRET_BASIC", "enum": [ "CLIENT_SECRET_BASIC", "CLIENT_SECRET_POST" ] }, "clientId": { "type": "string", "description": "The client identifier provided by the external OIDC identity provider.", "example": "client123" }, "clientSecret": { "type": "string", "description": "The client secret provided by the external OIDC identity provider. Currently this value is not returned.", "example": "cl1en7S3cr3t!" }, "createUser": { "type": "boolean", "description": "A flag indicating if the user should be created after authenticating to the external OIDC identity provider if it doesn't exist. The user attributes specified by the userAttributeMappings attribute are used to populate the user in IDaaS. This value is used if authenticationEnabled is true.", "example": true }, "defaultProvider": { "type": "boolean", "description": "A flag indicating if this is the tenant's default identity provider. This value applies only to non-domain based identity providers. Only one identity provider can be set as the default at a time." }, "domains": { "type": "string", "description": "The space separated list of domains associated with the external OIDC identity provider for use with user authentication.", "example": "test.com sample.com" }, "externalGroupMappings": { "type": "array", "description": "The association between a group claim returned from the external OIDC identity provider and authorization groups. This mapping is used to associate OIDC identity provider external groups when a user is created or modified based on user authentication or when it is modified based on an external OIDC identity provider user verification. This value can only be set if createUser, updateUser, or updateVerificationUser is true and groupMapping is present.", "items": { "required": [ "externalGroupId", "groupId" ], "type": "object", "properties": { "externalGroupId": { "type": "string", "description": "The external group name/ID returned from the identity provider.", "example": "admin-group" }, "groupId": { "type": "string", "description": "The Authorization Group UUID this external group maps to." }, "id": { "type": "string", "description": "The UUID of the identity provider external group mapping. This value is generated once the mapping is created.", "example": "6781549d-433c-44ea-a42f-4705c26f3245" }, "identityProviderId": { "type": "string", "description": "The ID of the identity provider this external group mapping belongs to.", "example": "6781549d-433c-44ea-a42f-4705c26f3245" } }, "description": "A IdentityProviderExternalGroupMapping maps a group name/ID returned from an external identity provider to an Authorization Group for matching purposes.", "title": "IdentityProviderExternalGroupMapping" } }, "fields": { "type": "string", "description": "The value of user fields that need to be set the external OIDC identity provider when acquiring user information. This value is used with a TWITTER IDP.", "example": "email,name,first_name,last_name" }, "groupIds": { "type": "array", "description": "The UUIDs of groups that will be assigned to users created after an external OIDC identity provider user authentication. An empty list means the user will be assigned to All Groups. If configured, the full set of groups must be configured. This value is used if createUser is true.", "items": { "type": "string", "description": "The UUIDs of groups that will be assigned to users created after an external OIDC identity provider user authentication. An empty list means the user will be assigned to All Groups. If configured, the full set of groups must be configured. This value is used if createUser is true." } }, "groupMapping": { "type": "string", "description": "The association between a specified claim returned from the external OIDC identity provider and IDaaS groups. This mapping is used to associated IDaaS groups when a user is created or modified based on an external OIDC identity provider user authentication or when it is modified based on an external OIDC identity provider user verification. This value is used if createUser, updateUser, or updateVerificationUser is true." }, "id": { "type": "string", "description": "The UUID of the external OIDC identity provider.", "example": "6784549d-433c-44ea-a42f-4701458dg245" }, "idTokenClaims": { "type": "string", "description": "The space separated list of id token claims to request as part of the external OIDC identity provider user authentication or user verification request.", "example": "groups upn" }, "issuer": { "type": "string", "description": "The issuer URI for the external OIDC identity provider.", "example": "https://accounts.mycompany.com" }, "jwksUri": { "type": "string", "description": "The JWKS URI endpoint for the external OIDC identity provider used to verify a token signature.", "example": "https://account.mycompany.com/oauth/discovery/keys" }, "maxAge": { "maximum": 2592000, "minimum": -1, "type": "integer", "description": "The max age to request as part of the external OIDC identity provider user authentication or user verification request. If -1, the value will not be included in the request.", "format": "int32", "example": 300 }, "name": { "type": "string", "description": "The unique name of the external OIDC identity provider.", "example": "MyCompany Co." }, "organizationIds": { "type": "array", "description": "The UUIDs of organizations that will be assigned to users created after an external OIDC identity provider user authentication. If configured, the full set of organizations must be configured. This value is used if createUser is true.", "items": { "type": "string", "description": "The UUIDs of organizations that will be assigned to users created after an external OIDC identity provider user authentication. If configured, the full set of organizations must be configured. This value is used if createUser is true." } }, "requireUserinfoSignature": { "type": "boolean", "description": "A flag indicating if the user information endpoint of the external OIDC identity provider should be signed and verified.", "example": true }, "revocationEndpoint": { "type": "string", "description": "The revocation endpoint for the external OIDC identity provider.", "example": "https://account.mycompany.com/oauth/revoke" }, "roleId": { "type": "string", "description": "The UUID of the role that will be assigned to users created after an external OIDC identity provider user authentication. An empty string means the user will not be assigned a role by default. This role acts as the default if role mapping is empty. This value can only be set if createUser is true." }, "roleMapping": { "type": "string", "description": "The association between a specified claim returned from the external OIDC identity provider and an IDaaS role. This mapping is used to associated an IDaaS role when a user is created or modified based on an external OIDC identity provider user authentication or when it is modified based on an external OIDC identity provider user verification. This value is used if createUser, updateUser, or updateVerificationUser is true." }, "scopes": { "type": "string", "description": "The space separated list of scopes to request as part of the external OIDC identity provider user authentication or user verification request.", "example": "openid email" }, "tokenEndpoint": { "type": "string", "description": "The token endpoint for the external OIDC identity provider.", "example": "https://account.mycompany.com/oauth/token" }, "type": { "type": "string", "description": "The type of the external OIDC identity provider. Once created, this value cannot be updated.", "example": "FACEBOOK", "enum": [ "FACEBOOK", "GENERIC", "GOOGLE", "IDV", "MICROSOFT", "SP", "TWITTER" ] }, "updateUser": { "type": "boolean", "description": "A flag indicating if the user should be updated after authenticating to the external OIDC identity provider if it exists. The user attributes specified by the userAttributeMappings attribute are used to populate the user in IDaaS. This value is used if authenticationEnabled is true.", "example": true }, "updateUserVerification": { "type": "boolean", "description": "A flag indicating if the user should be updated after user verification to the external OIDC identity provider if it exists. The user attributes specified by the userAttributeMappings attribute are used to populate the user in IDaaS. This value is used if verificationEnabled is true.", "example": true }, "userAttributeId": { "type": "string", "description": "The IDaaS user attribute ID used to find IDaaS users associated with an external OIDC identity provider user authentication. This value is used if authenticationEnabled is true." }, "userAttributeMappings": { "type": "array", "description": "The association between the claims returned from the external OIDC identity provider and IDaaS user attributes. These attributes are used to populate user attributes when it is created or modified based on an external OIDC identity provider user authentication or when it is modified based on an external OIDC identity provider user verification. If configured, the full set of mappings must be configured. This value is used if createUser, updateUser, or updateVerificationUser is true.", "items": { "required": [ "claim", "userAttributeId" ], "type": "object", "properties": { "claim": { "type": "string", "description": "The name of the claim being mapped. This value must be provided when creating or modifying an attribute mapping.", "example": "email" }, "id": { "type": "string", "description": "The UUID of the OIDC identity provider attribute mapping.", "example": "6781549d-433c-44ea-a42f-4705c26f3245" }, "oidcIdentityProviderId": { "type": "string", "description": "The UUID of the OIDC identity provider the attribute mapping belongs to.", "example": "6881549d-433c-44ea-a42f-4705c26f3245" }, "userAttribute": { "required": [ "mandatory", "name", "systemDefined", "unique" ], "type": "object", "properties": { "id": { "type": "string", "description": "The UUID for this user attribute. Generated when the user attribute is created." }, "mandatory": { "type": "boolean", "description": "A flag indicating if users must have a value for this user attribute." }, "name": { "type": "string", "description": "The name of this user attribute." }, "systemDefined": { "type": "boolean", "description": "A flag indicating if this user attribute is one of the system defined user attributes." }, "type": { "type": "string", "description": "Type of user attribute. Currently only used to specify the type of contact if the attribute is to be used for OTP delivery.", "example": "OTP_EMAIL", "enum": [ "NONE", "OTP_EMAIL", "OTP_SMS", "OTP_VOICE", "OTP_WECHAT", "OTP_WHATSAPP" ] }, "unique": { "type": "boolean", "description": "A flag indicating if this attribute is intended to be unique." } }, "description": "Information about user attribute definitions.", "title": "UserAttribute" }, "userAttributeId": { "type": "string", "description": "The UUID of the IDaaS user attribute being mapped to. This value must be provided when creating or modifying an attribute mapping.", "example": "6981549d-433c-44ea-a42f-4705c26f3245" } }, "description": "An OidcIdentityProviderAttributeMapping maps a claim returned from an external OIDC identity provider user authentication or user verification to an IDaaS user attribute.", "title": "OidcIdentityProviderAttributeMapping" } }, "userAuthMatchMappings": { "type": "array", "description": "The association between the claims returned from the external OIDC identity provider and IDaaS user attributes. These attributes are used to match an existing IDaaS user based on an external OIDC identity provider user authentication. If configured, the full set of mappings must be configured. This value is used if authenticationEnabled is true.", "items": { "required": [ "claim", "userAttributeId" ], "type": "object", "properties": { "claim": { "type": "string", "description": "The name of the claim being mapped. This value must be provided when creating or modifying a user authentication match mapping.", "example": "email" }, "id": { "type": "string", "description": "The UUID of the OIDC identity provider user authentication match mapping.", "example": "6781549d-433c-44ea-a42f-4705c26f3245" }, "oidcIdentityProviderId": { "type": "string", "description": "The UUID of the OIDC identity provider the user authentication match mapping belongs to.", "example": "6881549d-433c-44ea-a42f-4705c26f3245" }, "userAttribute": { "required": [ "mandatory", "name", "systemDefined", "unique" ], "type": "object", "properties": { "id": { "type": "string", "description": "The UUID for this user attribute. Generated when the user attribute is created." }, "mandatory": { "type": "boolean", "description": "A flag indicating if users must have a value for this user attribute." }, "name": { "type": "string", "description": "The name of this user attribute." }, "systemDefined": { "type": "boolean", "description": "A flag indicating if this user attribute is one of the system defined user attributes." }, "type": { "type": "string", "description": "Type of user attribute. Currently only used to specify the type of contact if the attribute is to be used for OTP delivery.", "example": "OTP_EMAIL", "enum": [ "NONE", "OTP_EMAIL", "OTP_SMS", "OTP_VOICE", "OTP_WECHAT", "OTP_WHATSAPP" ] }, "unique": { "type": "boolean", "description": "A flag indicating if this attribute is intended to be unique." } }, "description": "Information about user attribute definitions.", "title": "UserAttribute" }, "userAttributeId": { "type": "string", "description": "The UUID of the IDaaS user attribute being mapped to. This value must be provided when creating or modifying a user authentication match mapping.", "example": "6981549d-433c-44ea-a42f-4705c26f3245" } }, "description": "An OidcIdentityProviderUserAuthMatchMapping maps a claim returned from an external OIDC identity provide user authentication to an IDaaS User user attribute for matching purposes.", "title": "OidcIdentityProviderUserAuthMatchMapping" } }, "userClaim": { "type": "string", "description": "The external OIDC identity provider claim used to find IDaaS users associated with an external OIDC identity provider user authentication. This value is used if authenticationEnabled is true." }, "userVerMatchMappings": { "type": "array", "description": "The association between the claims returned from the external OIDC identity provider and IDaaS user attributes. These attributes are used to match an existing IDaaS user based on an external OIDC identity provider user verification. If configured, the full set of mappings must be configured. This value is used if verificationEnabled is true.", "items": { "required": [ "claim", "userAttributeId" ], "type": "object", "properties": { "claim": { "type": "string", "description": "The name of the claim being mapped. This value must be provided when creating or modifying a user verification match mapping.", "example": "email" }, "id": { "type": "string", "description": "The UUID of the OIDC identity provider user verification match mapping.", "example": "6781549d-433c-44ea-a42f-4705c26f3245" }, "oidcIdentityProviderId": { "type": "string", "description": "The UUID of the OIDC identity provider the user verification match mapping belongs to.", "example": "6881549d-433c-44ea-a42f-4705c26f3245" }, "userAttribute": { "required": [ "mandatory", "name", "systemDefined", "unique" ], "type": "object", "properties": { "id": { "type": "string", "description": "The UUID for this user attribute. Generated when the user attribute is created." }, "mandatory": { "type": "boolean", "description": "A flag indicating if users must have a value for this user attribute." }, "name": { "type": "string", "description": "The name of this user attribute." }, "systemDefined": { "type": "boolean", "description": "A flag indicating if this user attribute is one of the system defined user attributes." }, "type": { "type": "string", "description": "Type of user attribute. Currently only used to specify the type of contact if the attribute is to be used for OTP delivery.", "example": "OTP_EMAIL", "enum": [ "NONE", "OTP_EMAIL", "OTP_SMS", "OTP_VOICE", "OTP_WECHAT", "OTP_WHATSAPP" ] }, "unique": { "type": "boolean", "description": "A flag indicating if this attribute is intended to be unique." } }, "description": "Information about user attribute definitions.", "title": "UserAttribute" }, "userAttributeId": { "type": "string", "description": "The UUID of the IDaaS user attribute being mapped to. This value must be provided when creating or modifying a user verification match mapping.", "example": "6981549d-433c-44ea-a42f-4705c26f3245" } }, "description": "An OidcIdentityProviderUserVerMatchMapping maps a claim returned from an external OIDC identity provide user verification to an IDaaS User user attribute for matching purposes.", "title": "OidcIdentityProviderUserVerMatchMapping" } }, "userinfoClaims": { "type": "string", "description": "The space separated list of user information claims to request as part of the external OIDC identity provider user authentication or user verification request.", "example": "groups upn" }, "userinfoEndpoint": { "type": "string", "description": "The user information endpoint for the external OIDC identity provider.", "example": "https://account.mycompany.com/oauth/userinfo" }, "verificationEnabled": { "type": "boolean", "description": "A flag indicating if the external OIDC identity provider can be used for user verification.", "example": true } }, "description": "An OidcIdentityProvider defines the information returned about an external OpenID Connect identity provider for use with user authentication or user verification.", "title": "OidcIdentityProvider" } }, "otpDeliveryPreference": { "type": "array", "description": "The order preference to use for OTP delivery.", "items": { "required": [ "type" ], "type": "object", "properties": { "contactAttributes": { "type": "array", "description": "A list of uuids of the otp contact attributes in order which indicates the OTP contacts preference.", "items": { "type": "string", "description": "A list of uuids of the otp contact attributes in order which indicates the OTP contacts preference." } }, "type": { "type": "string", "description": "Indicates the type of the otp preference details.", "example": "SMS", "enum": [ "EMAIL", "SMS", "VOICE", "WECHAT", "WHATSAPP", "NONE" ] } }, "description": "Settings that control the behavior of OTP authentication.", "title": "OTPPreferenceDetails" } }, "overrideOtpContacts": { "type": "boolean", "description": "A flag indicating if group based OTP policy can be overridden by the authentication flow OTP policy." }, "readOnly": { "type": "boolean", "description": "A flag indicating if the authentication flow can be modified or deleted." }, "userLoginFirstStep": { "type": "string", "description": "The authenticator type to use in the first step of a two-step authentication scenario when the User Login flow is enabled.", "enum": [ "NONE", "EXTERNAL", "PASSWORD", "KBA", "OTP", "TOKEN", "TOKENPUSH", "SMARTCREDENTIALPUSH", "IDP", "PASSKEY", "SMART_LOGIN", "USER_CERTIFICATE", "FACE", "DENY", "MAGICLINK" ] }, "userLoginSecondStep": { "type": "array", "description": "The authenticator type to use during in the second step of a two-step authentication scenario when the User Login flow is enabled.", "items": { "type": "string", "description": "The authenticator type to use during in the second step of a two-step authentication scenario when the User Login flow is enabled.", "enum": [ "NONE", "KBA", "TEMP_ACCESS_CODE", "OTP", "GRID", "TOKEN", "TOKENCR", "TOKENPUSH", "FIDO", "USER_CERTIFICATE", "SMARTCREDENTIALPUSH", "FACE", "PASSTHROUGH", "MAGICLINK" ] } } }, "description": "An AuthenticationFlow defines the authentication options available for a given risk level.", "title": "AuthenticationFlow" }, "lowRiskEnableSmartLogin": { "type": "boolean", "description": "A flag indicating if Smart Login is enabled for Low risk. This parameter is deprecated, use the lowRiskAuthenticationFlow attribute with v2 APIs.", "deprecated": true }, "lowRiskFirstStep": { "type": "string", "description": "The authenticator type to use in the first step of a two-step authentication scenario when the risk score is Low. This parameter is deprecated, use the lowRiskAuthenticationFlow attribute with v2 APIs.", "deprecated": true, "enum": [ "NONE", "EXTERNAL", "PASSWORD", "KBA", "OTP", "TOKEN", "TOKENPUSH", "SMARTCREDENTIALPUSH", "IDP", "PASSKEY", "SMART_LOGIN", "USER_CERTIFICATE", "FACE", "DENY", "MAGICLINK" ] }, "lowRiskSecondStep": { "type": "array", "description": "The authenticator type to use during in the second step of a two-step authentication scenario when the risk score is Low. This parameter is deprecated, use the lowRiskAuthenticationFlow attribute with v2 APIs.", "deprecated": true, "items": { "type": "string", "description": "The authenticator type to use during in the second step of a two-step authentication scenario when the risk score is Low. This parameter is deprecated, use the lowRiskAuthenticationFlow attribute with v2 APIs.", "deprecated": true, "enum": [ "NONE", "KBA", "TEMP_ACCESS_CODE", "OTP", "GRID", "TOKEN", "TOKENCR", "TOKENPUSH", "FIDO", "USER_CERTIFICATE", "SMARTCREDENTIALPUSH", "FACE", "PASSTHROUGH", "MAGICLINK" ] } }, "lowRiskThreshold": { "maximum": 100, "minimum": 0, "type": "integer", "description": "Risk scores below this value are considered Low risk.", "format": "int32" }, "machineContext": { "required": [ "denyAccess", "riskLimit", "riskPoint" ], "type": "object", "properties": { "denyAccess": { "type": "boolean", "description": "If true, the resource rule evaluating the context will return Access Denied." }, "riskLimit": { "type": "integer", "description": "The risk points apply if the machine authenticator risk is below or equal to this value.", "format": "int32" }, "riskPoint": { "maximum": 100, "minimum": 0, "type": "integer", "description": "The number of risk points that apply if this context applies.", "format": "int32" } }, "description": "Represents a Machine Authenticator authentication context. When defined, a Machine Authentication authenticator is expected in the authentication request. Risk will apply if the machine authentication authenticator is not present or if the risk for the machine authentication authentication is greater than the risk limit define for the Machine context.", "title": "MachineContext" }, "mediumRiskAuthenticationFlow": { "required": [ "id", "loginFlows", "name", "readOnly" ], "type": "object", "properties": { "applications": { "type": "array", "description": "List of applications using this authentication flow.", "items": { "required": [ "resourceRules" ], "type": "object", "properties": { "id": { "type": "string", "description": "The UUID of the application." }, "name": { "type": "string", "description": "The name of the application." }, "resourceRules": { "type": "array", "description": "List of resource rules associated to this application.", "items": { "required": [ "id", "name" ], "type": "object", "properties": { "id": { "type": "string", "description": "The unique UUID assigned to the resource rule when it is created." }, "name": { "type": "string", "description": "The name of the resource rule." } }, "description": "A ResourceRuleNameId contains a resource rule name and unique id.", "title": "ResourceRuleNameId" } } }, "description": "An ApplicationResourceRule defines the resource rules used by an application.", "title": "ApplicationResourceRule" } }, "id": { "type": "string", "description": "The unique UUID assigned to the authentication flow when it is created." }, "identityProviders": { "type": "array", "description": "The identity providers, both OIDC and SAML, supported when the IDP login flow is enabled--limited info is returned. This parameter should be used instead of oidcIdentityProviders.", "items": { "type": "object", "properties": { "authenticationEnabled": { "type": "boolean", "description": "A flag indicating if the external identity provider can be used for user authentication.", "example": true }, "buttonImage": { "type": "string", "description": "The URI of the logo to display on the login button for this external identity provider.", "example": "https://account.mycompany.com/images/logo.png" }, "buttonText": { "type": "string", "description": "The unique text to display on the login button for this external identity provider.", "example": "Sign in With MyCompany Co." }, "createUser": { "type": "boolean", "description": "A flag indicating if the user should be created after authenticating to the external identity provider if it doesn't exist. The user attributes specified by the userAttributeMappings attribute are used to populate the user in IDaaS. This value is used if authenticationEnabled is true.", "example": true }, "defaultProvider": { "type": "boolean", "description": "A flag indicating if this is the tenant's default identity provider. This value applies only to non-domain based identity providers. Only one identity provider can be set as the default at a time." }, "domains": { "type": "string", "description": "The space separated list of domains associated with the external identity provider for use with user authentication.", "example": "test.com sample.com" }, "id": { "type": "string", "description": "The UUID of the external identity provider.", "example": "6784549d-433c-44ea-a42f-4701458dg245" }, "issuer": { "type": "string", "description": "The issuer URI for the external OIDC identity provider or the issuer, or IDP Entity ID, for the external SAML identity provider.", "example": "https://accounts.mycompany.com" }, "name": { "type": "string", "description": "The unique name of the external identity provider.", "example": "MyCompany Co." }, "protocol": { "type": "string", "description": "The type of the external identity provider.", "example": "OIDC", "enum": [ "OIDC", "SAML" ] }, "spId": { "type": "string", "description": "The client identifier provided by the external OIDC identity provider or the SP entity ID provided to the external SAML identity provider.", "example": "client123" }, "type": { "type": "string", "description": "The type of the external identity provider.", "example": "GENERIC" }, "verificationCertificate2DN": { "type": "string", "description": "The verification certificate2 DN used with the external identity provider." }, "verificationCertificate2ExpiryDate": { "type": "string", "description": "The verification certificate2 expiry date used with the external identity provider.", "format": "date-time", "example": "2019-02-19T13:15:27Z" }, "verificationCertificateDN": { "type": "string", "description": "The verification certificate DN used with the external identity provider." }, "verificationCertificateExpiryDate": { "type": "string", "description": "The verification certificate expiry date used with the external identity provider.", "format": "date-time", "example": "2019-02-19T13:15:27Z" }, "verificationEnabled": { "type": "boolean", "description": "A flag indicating if the external identity provider can be used for user verification.", "example": true } }, "description": "An IdentityProvider defines the information returned about an external identity provider for use with user authentication or user verification.", "title": "IdentityProvider" } }, "idpDefault": { "type": "boolean", "description": "A flag indicating whether the authentication flow uses the tenant's default IDP. When true, domain-based IDPs are not supported." }, "idpDomainBased": { "type": "boolean", "description": "A flag indicating if the authentication flow will be using domain-based IDPs." }, "idpLoginSecondStep": { "type": "array", "description": "The authenticator type to use during in the second step of a two-step authentication scenario when the identity provider Login flow is enabled and requires a second factor. PASSTHROUGH is not supported.", "items": { "type": "string", "description": "The authenticator type to use during in the second step of a two-step authentication scenario when the identity provider Login flow is enabled and requires a second factor. PASSTHROUGH is not supported.", "enum": [ "NONE", "KBA", "TEMP_ACCESS_CODE", "OTP", "GRID", "TOKEN", "TOKENCR", "TOKENPUSH", "FIDO", "USER_CERTIFICATE", "SMARTCREDENTIALPUSH", "FACE", "PASSTHROUGH", "MAGICLINK" ] } }, "loginFlows": { "type": "array", "description": "List of login flows.", "items": { "required": [ "enabled", "loginFlowType" ], "type": "object", "properties": { "enabled": { "type": "boolean", "description": "Whether the login flow is enabled or not.", "example": true }, "loginFlowType": { "type": "string", "description": "Identifies the login flow type.", "enum": [ "USER_LOGIN", "SMART_LOGIN", "IDP_LOGIN", "PASSKEY_LOGIN", "USER_CERTIFICATE_LOGIN" ] } }, "description": "An LoginFlow defines an authentication option available in the authentication flow.", "title": "LoginFlow" } }, "name": { "type": "string", "description": "The name of the authentication flow." }, "namedPasswordId": { "type": "string", "description": "The Named Password Id used for password authentication." }, "oidcIdentityProviders": { "type": "array", "description": "The OIDC identity providers supported when the IDP login flow is enabled--limited info is returned. This parameter is deprecated, use identityProviders instead.", "deprecated": true, "items": { "type": "object", "properties": { "acrValues": { "type": "string", "description": "The space separated list of authentication context request values to request as part of the external OIDC identity provider user authentication or user verification request.", "example": "level1 level2" }, "amrValues": { "type": "string", "description": "The space separated list of authentication method request values to request as part of the external OIDC identity provider user authentication or user verification request.", "example": "level1 level2" }, "authenticationEnabled": { "type": "boolean", "description": "A flag indicating if the external OIDC identity provider can be used for user authentication.", "example": true }, "authorizationEndpoint": { "type": "string", "description": "The authorization endpoint for the external OIDC identity provider.", "example": "https://account.mycompany.com/oauth/authorize" }, "buttonImage": { "type": "string", "description": "The URI of the logo to display on the login button for this external OIDC identity provider.", "example": "https://account.mycompany.com/images/logo.png" }, "buttonText": { "type": "string", "description": "The unique text to display on the login button for this external OIDC identity provider.", "example": "Sign in With MyCompany Co." }, "clientAuthenticationMethod": { "type": "string", "description": "The client authentication method to use with the external OIDC identity provider.", "example": "ClientAuthenticationMethod.CLIENT_SECRET_BASIC", "enum": [ "CLIENT_SECRET_BASIC", "CLIENT_SECRET_POST" ] }, "clientId": { "type": "string", "description": "The client identifier provided by the external OIDC identity provider.", "example": "client123" }, "clientSecret": { "type": "string", "description": "The client secret provided by the external OIDC identity provider. Currently this value is not returned.", "example": "cl1en7S3cr3t!" }, "createUser": { "type": "boolean", "description": "A flag indicating if the user should be created after authenticating to the external OIDC identity provider if it doesn't exist. The user attributes specified by the userAttributeMappings attribute are used to populate the user in IDaaS. This value is used if authenticationEnabled is true.", "example": true }, "defaultProvider": { "type": "boolean", "description": "A flag indicating if this is the tenant's default identity provider. This value applies only to non-domain based identity providers. Only one identity provider can be set as the default at a time." }, "domains": { "type": "string", "description": "The space separated list of domains associated with the external OIDC identity provider for use with user authentication.", "example": "test.com sample.com" }, "externalGroupMappings": { "type": "array", "description": "The association between a group claim returned from the external OIDC identity provider and authorization groups. This mapping is used to associate OIDC identity provider external groups when a user is created or modified based on user authentication or when it is modified based on an external OIDC identity provider user verification. This value can only be set if createUser, updateUser, or updateVerificationUser is true and groupMapping is present.", "items": { "required": [ "externalGroupId", "groupId" ], "type": "object", "properties": { "externalGroupId": { "type": "string", "description": "The external group name/ID returned from the identity provider.", "example": "admin-group" }, "groupId": { "type": "string", "description": "The Authorization Group UUID this external group maps to." }, "id": { "type": "string", "description": "The UUID of the identity provider external group mapping. This value is generated once the mapping is created.", "example": "6781549d-433c-44ea-a42f-4705c26f3245" }, "identityProviderId": { "type": "string", "description": "The ID of the identity provider this external group mapping belongs to.", "example": "6781549d-433c-44ea-a42f-4705c26f3245" } }, "description": "A IdentityProviderExternalGroupMapping maps a group name/ID returned from an external identity provider to an Authorization Group for matching purposes.", "title": "IdentityProviderExternalGroupMapping" } }, "fields": { "type": "string", "description": "The value of user fields that need to be set the external OIDC identity provider when acquiring user information. This value is used with a TWITTER IDP.", "example": "email,name,first_name,last_name" }, "groupIds": { "type": "array", "description": "The UUIDs of groups that will be assigned to users created after an external OIDC identity provider user authentication. An empty list means the user will be assigned to All Groups. If configured, the full set of groups must be configured. This value is used if createUser is true.", "items": { "type": "string", "description": "The UUIDs of groups that will be assigned to users created after an external OIDC identity provider user authentication. An empty list means the user will be assigned to All Groups. If configured, the full set of groups must be configured. This value is used if createUser is true." } }, "groupMapping": { "type": "string", "description": "The association between a specified claim returned from the external OIDC identity provider and IDaaS groups. This mapping is used to associated IDaaS groups when a user is created or modified based on an external OIDC identity provider user authentication or when it is modified based on an external OIDC identity provider user verification. This value is used if createUser, updateUser, or updateVerificationUser is true." }, "id": { "type": "string", "description": "The UUID of the external OIDC identity provider.", "example": "6784549d-433c-44ea-a42f-4701458dg245" }, "idTokenClaims": { "type": "string", "description": "The space separated list of id token claims to request as part of the external OIDC identity provider user authentication or user verification request.", "example": "groups upn" }, "issuer": { "type": "string", "description": "The issuer URI for the external OIDC identity provider.", "example": "https://accounts.mycompany.com" }, "jwksUri": { "type": "string", "description": "The JWKS URI endpoint for the external OIDC identity provider used to verify a token signature.", "example": "https://account.mycompany.com/oauth/discovery/keys" }, "maxAge": { "maximum": 2592000, "minimum": -1, "type": "integer", "description": "The max age to request as part of the external OIDC identity provider user authentication or user verification request. If -1, the value will not be included in the request.", "format": "int32", "example": 300 }, "name": { "type": "string", "description": "The unique name of the external OIDC identity provider.", "example": "MyCompany Co." }, "organizationIds": { "type": "array", "description": "The UUIDs of organizations that will be assigned to users created after an external OIDC identity provider user authentication. If configured, the full set of organizations must be configured. This value is used if createUser is true.", "items": { "type": "string", "description": "The UUIDs of organizations that will be assigned to users created after an external OIDC identity provider user authentication. If configured, the full set of organizations must be configured. This value is used if createUser is true." } }, "requireUserinfoSignature": { "type": "boolean", "description": "A flag indicating if the user information endpoint of the external OIDC identity provider should be signed and verified.", "example": true }, "revocationEndpoint": { "type": "string", "description": "The revocation endpoint for the external OIDC identity provider.", "example": "https://account.mycompany.com/oauth/revoke" }, "roleId": { "type": "string", "description": "The UUID of the role that will be assigned to users created after an external OIDC identity provider user authentication. An empty string means the user will not be assigned a role by default. This role acts as the default if role mapping is empty. This value can only be set if createUser is true." }, "roleMapping": { "type": "string", "description": "The association between a specified claim returned from the external OIDC identity provider and an IDaaS role. This mapping is used to associated an IDaaS role when a user is created or modified based on an external OIDC identity provider user authentication or when it is modified based on an external OIDC identity provider user verification. This value is used if createUser, updateUser, or updateVerificationUser is true." }, "scopes": { "type": "string", "description": "The space separated list of scopes to request as part of the external OIDC identity provider user authentication or user verification request.", "example": "openid email" }, "tokenEndpoint": { "type": "string", "description": "The token endpoint for the external OIDC identity provider.", "example": "https://account.mycompany.com/oauth/token" }, "type": { "type": "string", "description": "The type of the external OIDC identity provider. Once created, this value cannot be updated.", "example": "FACEBOOK", "enum": [ "FACEBOOK", "GENERIC", "GOOGLE", "IDV", "MICROSOFT", "SP", "TWITTER" ] }, "updateUser": { "type": "boolean", "description": "A flag indicating if the user should be updated after authenticating to the external OIDC identity provider if it exists. The user attributes specified by the userAttributeMappings attribute are used to populate the user in IDaaS. This value is used if authenticationEnabled is true.", "example": true }, "updateUserVerification": { "type": "boolean", "description": "A flag indicating if the user should be updated after user verification to the external OIDC identity provider if it exists. The user attributes specified by the userAttributeMappings attribute are used to populate the user in IDaaS. This value is used if verificationEnabled is true.", "example": true }, "userAttributeId": { "type": "string", "description": "The IDaaS user attribute ID used to find IDaaS users associated with an external OIDC identity provider user authentication. This value is used if authenticationEnabled is true." }, "userAttributeMappings": { "type": "array", "description": "The association between the claims returned from the external OIDC identity provider and IDaaS user attributes. These attributes are used to populate user attributes when it is created or modified based on an external OIDC identity provider user authentication or when it is modified based on an external OIDC identity provider user verification. If configured, the full set of mappings must be configured. This value is used if createUser, updateUser, or updateVerificationUser is true.", "items": { "required": [ "claim", "userAttributeId" ], "type": "object", "properties": { "claim": { "type": "string", "description": "The name of the claim being mapped. This value must be provided when creating or modifying an attribute mapping.", "example": "email" }, "id": { "type": "string", "description": "The UUID of the OIDC identity provider attribute mapping.", "example": "6781549d-433c-44ea-a42f-4705c26f3245" }, "oidcIdentityProviderId": { "type": "string", "description": "The UUID of the OIDC identity provider the attribute mapping belongs to.", "example": "6881549d-433c-44ea-a42f-4705c26f3245" }, "userAttribute": { "required": [ "mandatory", "name", "systemDefined", "unique" ], "type": "object", "properties": { "id": { "type": "string", "description": "The UUID for this user attribute. Generated when the user attribute is created." }, "mandatory": { "type": "boolean", "description": "A flag indicating if users must have a value for this user attribute." }, "name": { "type": "string", "description": "The name of this user attribute." }, "systemDefined": { "type": "boolean", "description": "A flag indicating if this user attribute is one of the system defined user attributes." }, "type": { "type": "string", "description": "Type of user attribute. Currently only used to specify the type of contact if the attribute is to be used for OTP delivery.", "example": "OTP_EMAIL", "enum": [ "NONE", "OTP_EMAIL", "OTP_SMS", "OTP_VOICE", "OTP_WECHAT", "OTP_WHATSAPP" ] }, "unique": { "type": "boolean", "description": "A flag indicating if this attribute is intended to be unique." } }, "description": "Information about user attribute definitions.", "title": "UserAttribute" }, "userAttributeId": { "type": "string", "description": "The UUID of the IDaaS user attribute being mapped to. This value must be provided when creating or modifying an attribute mapping.", "example": "6981549d-433c-44ea-a42f-4705c26f3245" } }, "description": "An OidcIdentityProviderAttributeMapping maps a claim returned from an external OIDC identity provider user authentication or user verification to an IDaaS user attribute.", "title": "OidcIdentityProviderAttributeMapping" } }, "userAuthMatchMappings": { "type": "array", "description": "The association between the claims returned from the external OIDC identity provider and IDaaS user attributes. These attributes are used to match an existing IDaaS user based on an external OIDC identity provider user authentication. If configured, the full set of mappings must be configured. This value is used if authenticationEnabled is true.", "items": { "required": [ "claim", "userAttributeId" ], "type": "object", "properties": { "claim": { "type": "string", "description": "The name of the claim being mapped. This value must be provided when creating or modifying a user authentication match mapping.", "example": "email" }, "id": { "type": "string", "description": "The UUID of the OIDC identity provider user authentication match mapping.", "example": "6781549d-433c-44ea-a42f-4705c26f3245" }, "oidcIdentityProviderId": { "type": "string", "description": "The UUID of the OIDC identity provider the user authentication match mapping belongs to.", "example": "6881549d-433c-44ea-a42f-4705c26f3245" }, "userAttribute": { "required": [ "mandatory", "name", "systemDefined", "unique" ], "type": "object", "properties": { "id": { "type": "string", "description": "The UUID for this user attribute. Generated when the user attribute is created." }, "mandatory": { "type": "boolean", "description": "A flag indicating if users must have a value for this user attribute." }, "name": { "type": "string", "description": "The name of this user attribute." }, "systemDefined": { "type": "boolean", "description": "A flag indicating if this user attribute is one of the system defined user attributes." }, "type": { "type": "string", "description": "Type of user attribute. Currently only used to specify the type of contact if the attribute is to be used for OTP delivery.", "example": "OTP_EMAIL", "enum": [ "NONE", "OTP_EMAIL", "OTP_SMS", "OTP_VOICE", "OTP_WECHAT", "OTP_WHATSAPP" ] }, "unique": { "type": "boolean", "description": "A flag indicating if this attribute is intended to be unique." } }, "description": "Information about user attribute definitions.", "title": "UserAttribute" }, "userAttributeId": { "type": "string", "description": "The UUID of the IDaaS user attribute being mapped to. This value must be provided when creating or modifying a user authentication match mapping.", "example": "6981549d-433c-44ea-a42f-4705c26f3245" } }, "description": "An OidcIdentityProviderUserAuthMatchMapping maps a claim returned from an external OIDC identity provide user authentication to an IDaaS User user attribute for matching purposes.", "title": "OidcIdentityProviderUserAuthMatchMapping" } }, "userClaim": { "type": "string", "description": "The external OIDC identity provider claim used to find IDaaS users associated with an external OIDC identity provider user authentication. This value is used if authenticationEnabled is true." }, "userVerMatchMappings": { "type": "array", "description": "The association between the claims returned from the external OIDC identity provider and IDaaS user attributes. These attributes are used to match an existing IDaaS user based on an external OIDC identity provider user verification. If configured, the full set of mappings must be configured. This value is used if verificationEnabled is true.", "items": { "required": [ "claim", "userAttributeId" ], "type": "object", "properties": { "claim": { "type": "string", "description": "The name of the claim being mapped. This value must be provided when creating or modifying a user verification match mapping.", "example": "email" }, "id": { "type": "string", "description": "The UUID of the OIDC identity provider user verification match mapping.", "example": "6781549d-433c-44ea-a42f-4705c26f3245" }, "oidcIdentityProviderId": { "type": "string", "description": "The UUID of the OIDC identity provider the user verification match mapping belongs to.", "example": "6881549d-433c-44ea-a42f-4705c26f3245" }, "userAttribute": { "required": [ "mandatory", "name", "systemDefined", "unique" ], "type": "object", "properties": { "id": { "type": "string", "description": "The UUID for this user attribute. Generated when the user attribute is created." }, "mandatory": { "type": "boolean", "description": "A flag indicating if users must have a value for this user attribute." }, "name": { "type": "string", "description": "The name of this user attribute." }, "systemDefined": { "type": "boolean", "description": "A flag indicating if this user attribute is one of the system defined user attributes." }, "type": { "type": "string", "description": "Type of user attribute. Currently only used to specify the type of contact if the attribute is to be used for OTP delivery.", "example": "OTP_EMAIL", "enum": [ "NONE", "OTP_EMAIL", "OTP_SMS", "OTP_VOICE", "OTP_WECHAT", "OTP_WHATSAPP" ] }, "unique": { "type": "boolean", "description": "A flag indicating if this attribute is intended to be unique." } }, "description": "Information about user attribute definitions.", "title": "UserAttribute" }, "userAttributeId": { "type": "string", "description": "The UUID of the IDaaS user attribute being mapped to. This value must be provided when creating or modifying a user verification match mapping.", "example": "6981549d-433c-44ea-a42f-4705c26f3245" } }, "description": "An OidcIdentityProviderUserVerMatchMapping maps a claim returned from an external OIDC identity provide user verification to an IDaaS User user attribute for matching purposes.", "title": "OidcIdentityProviderUserVerMatchMapping" } }, "userinfoClaims": { "type": "string", "description": "The space separated list of user information claims to request as part of the external OIDC identity provider user authentication or user verification request.", "example": "groups upn" }, "userinfoEndpoint": { "type": "string", "description": "The user information endpoint for the external OIDC identity provider.", "example": "https://account.mycompany.com/oauth/userinfo" }, "verificationEnabled": { "type": "boolean", "description": "A flag indicating if the external OIDC identity provider can be used for user verification.", "example": true } }, "description": "An OidcIdentityProvider defines the information returned about an external OpenID Connect identity provider for use with user authentication or user verification.", "title": "OidcIdentityProvider" } }, "otpDeliveryPreference": { "type": "array", "description": "The order preference to use for OTP delivery.", "items": { "required": [ "type" ], "type": "object", "properties": { "contactAttributes": { "type": "array", "description": "A list of uuids of the otp contact attributes in order which indicates the OTP contacts preference.", "items": { "type": "string", "description": "A list of uuids of the otp contact attributes in order which indicates the OTP contacts preference." } }, "type": { "type": "string", "description": "Indicates the type of the otp preference details.", "example": "SMS", "enum": [ "EMAIL", "SMS", "VOICE", "WECHAT", "WHATSAPP", "NONE" ] } }, "description": "Settings that control the behavior of OTP authentication.", "title": "OTPPreferenceDetails" } }, "overrideOtpContacts": { "type": "boolean", "description": "A flag indicating if group based OTP policy can be overridden by the authentication flow OTP policy." }, "readOnly": { "type": "boolean", "description": "A flag indicating if the authentication flow can be modified or deleted." }, "userLoginFirstStep": { "type": "string", "description": "The authenticator type to use in the first step of a two-step authentication scenario when the User Login flow is enabled.", "enum": [ "NONE", "EXTERNAL", "PASSWORD", "KBA", "OTP", "TOKEN", "TOKENPUSH", "SMARTCREDENTIALPUSH", "IDP", "PASSKEY", "SMART_LOGIN", "USER_CERTIFICATE", "FACE", "DENY", "MAGICLINK" ] }, "userLoginSecondStep": { "type": "array", "description": "The authenticator type to use during in the second step of a two-step authentication scenario when the User Login flow is enabled.", "items": { "type": "string", "description": "The authenticator type to use during in the second step of a two-step authentication scenario when the User Login flow is enabled.", "enum": [ "NONE", "KBA", "TEMP_ACCESS_CODE", "OTP", "GRID", "TOKEN", "TOKENCR", "TOKENPUSH", "FIDO", "USER_CERTIFICATE", "SMARTCREDENTIALPUSH", "FACE", "PASSTHROUGH", "MAGICLINK" ] } } }, "description": "An AuthenticationFlow defines the authentication options available for a given risk level.", "title": "AuthenticationFlow" }, "mediumRiskEnableSmartLogin": { "type": "boolean", "description": "A flag indicating if Smart Login is enabled for Medium risk. This parameter is deprecated, use the mediumRiskAuthenticationFlow attribute with v2 APIs.", "deprecated": true }, "mediumRiskFirstStep": { "type": "string", "description": "The authenticator type to use in the first step of a two-step authentication scenario when the risk score is Medium. This parameter is deprecated, use the mediumRiskAuthenticationFlow attribute with v2 APIs.", "deprecated": true, "enum": [ "NONE", "EXTERNAL", "PASSWORD", "KBA", "OTP", "TOKEN", "TOKENPUSH", "SMARTCREDENTIALPUSH", "IDP", "PASSKEY", "SMART_LOGIN", "USER_CERTIFICATE", "FACE", "DENY", "MAGICLINK" ] }, "mediumRiskSecondStep": { "type": "array", "description": "The authenticator type to use during in the second step of a two-step authentication scenario when the risk score is Medium. This parameter is deprecated, use the mediumRiskAuthenticationFlow attribute with v2 APIs.", "deprecated": true, "items": { "type": "string", "description": "The authenticator type to use during in the second step of a two-step authentication scenario when the risk score is Medium. This parameter is deprecated, use the mediumRiskAuthenticationFlow attribute with v2 APIs.", "deprecated": true, "enum": [ "NONE", "KBA", "TEMP_ACCESS_CODE", "OTP", "GRID", "TOKEN", "TOKENCR", "TOKENPUSH", "FIDO", "USER_CERTIFICATE", "SMARTCREDENTIALPUSH", "FACE", "PASSTHROUGH", "MAGICLINK" ] } }, "mediumRiskThreshold": { "maximum": 100, "minimum": 0, "type": "integer", "description": "Risk scores below this value are considered Medium risk. Risk scores equal or greater than this value are considered High risk.", "format": "int32" }, "name": { "type": "string", "description": "The name of the resource rule." }, "resourceId": { "type": "string", "description": "The UUID of the resource to which this resource rule is assigned." }, "resourceName": { "type": "string", "description": "The name of the resource to which this resource rule is assigned." }, "riskEngineContexts": { "type": "array", "description": "If risk engine rules are defined, the transaction contexts specify the levels at which risk is applied to the authentication request if the corresponding risk engine rules trigger risk.", "items": { "required": [ "denyAccess", "name", "riskLimit", "riskPoint", "transactionRuleRisks" ], "type": "object", "properties": { "denyAccess": { "type": "boolean", "description": "If true, the resource rule evaluating the context will return Access Denied." }, "name": { "type": "string", "description": "The name of this transaction context." }, "riskLimit": { "type": "integer", "description": "The risk points apply if the accumulated risk of each configured transaction rule is above this value.", "format": "int32" }, "riskPoint": { "maximum": 100, "minimum": 0, "type": "integer", "description": "The number of risk points that apply if this context applies.", "format": "int32" }, "transactionRuleRisks": { "type": "array", "description": "The transaction rules associated with this context.", "items": { "required": [ "riskScore", "transactionRuleId" ], "type": "object", "properties": { "riskScore": { "maximum": 100, "minimum": 1, "type": "integer", "description": "The risk score that applies if this transaction rule is triggered.", "format": "int32" }, "transactionRuleId": { "type": "string", "description": "The id of the transaction rule associated with this risk definition." } }, "description": "Information associated with the risk of a specific transaction rule within a transaction context.", "title": "TransactionRuleRisk" } } }, "description": "The transaction context specifies transaction rules. Risk is applied to the authentication 1if the accumulated risk score of the transaction rules is above the risk limit.", "title": "TransactionContext" } }, "skipSecondFactorIfUserNotExist": { "type": "boolean", "description": "A flag indicating if second factor can be skipped if the user does not exist and the first factor is EXTERNAL." }, "strictAccess": { "type": "boolean", "description": "A flag indicating if this resource rule enforces strict access. Strict access means that if this rule denies access, the user is denied access even if other resource rules allow access.", "example": true }, "systemResourceContext": { "type": "boolean", "description": "A flag indicating if this resource rule is associated with a system resource including the Admin and User portals. A resource rule for a system resource cannot be deleted. They can only be disabled if there is at least one enabled resource rule for the resource." }, "transactionContexts": { "type": "array", "description": "If transaction details are specified during an authentication request, the transaction contexts specify the levels at which risk is applied to the authentication request if the corresponding transaction rules trigger risk. A maximum of two are allowed.", "items": { "required": [ "denyAccess", "name", "riskLimit", "riskPoint", "transactionRuleRisks" ], "type": "object", "properties": { "denyAccess": { "type": "boolean", "description": "If true, the resource rule evaluating the context will return Access Denied." }, "name": { "type": "string", "description": "The name of this transaction context." }, "riskLimit": { "type": "integer", "description": "The risk points apply if the accumulated risk of each configured transaction rule is above this value.", "format": "int32" }, "riskPoint": { "maximum": 100, "minimum": 0, "type": "integer", "description": "The number of risk points that apply if this context applies.", "format": "int32" }, "transactionRuleRisks": { "type": "array", "description": "The transaction rules associated with this context.", "items": { "required": [ "riskScore", "transactionRuleId" ], "type": "object", "properties": { "riskScore": { "maximum": 100, "minimum": 1, "type": "integer", "description": "The risk score that applies if this transaction rule is triggered.", "format": "int32" }, "transactionRuleId": { "type": "string", "description": "The id of the transaction rule associated with this risk definition." } }, "description": "Information associated with the risk of a specific transaction rule within a transaction context.", "title": "TransactionRuleRisk" } } }, "description": "The transaction context specifies transaction rules. Risk is applied to the authentication 1if the accumulated risk score of the transaction rules is above the risk limit.", "title": "TransactionContext" } }, "travelVelocityContext": { "required": [ "denyAccess", "riskPoint" ], "type": "object", "properties": { "denyAccess": { "type": "boolean", "description": "If true, the resource rule evaluating the context will return Access Denied." }, "riskPoint": { "maximum": 100, "minimum": 0, "type": "integer", "description": "The number of risk points that apply if this context applies.", "format": "int32" } }, "description": "Travel velocity checks to see if the time between authentications at different locations means the user has traveled faster than a given velocity. If the velocity is exceeded, risk applies.", "title": "TravelVelocityContext" } }, "description": "A ResourceRule defines the information returned about a resource rule. A resource rule is used to determine what authentication is used to authenticate to the specified resource (aka application).", "title": "ResourceRule" } } ``` ### 400 Bad Request #### application/json Schema ```json { "type": "object", "properties": { "errorCode": { "type": "string", "description": "Error Codes specific to cause of failure.", "example": "invalid_user_response" }, "errorMessage": { "type": "string", "description": "Additional Error Message describing the error.", "example": "Application id cannot be null" }, "parameters": { "type": "array", "description": "Optional additional error information.", "items": { "type": "object", "description": "Optional additional error information." } } }, "description": "Object containing information about errors reported by services.", "title": "ErrorInfo" } ``` ### 401 Access denied #### application/json Schema ```json { "type": "object", "properties": { "errorCode": { "type": "string", "description": "Error Codes specific to cause of failure.", "example": "invalid_user_response" }, "errorMessage": { "type": "string", "description": "Additional Error Message describing the error.", "example": "Application id cannot be null" }, "parameters": { "type": "array", "description": "Optional additional error information.", "items": { "type": "object", "description": "Optional additional error information." } } }, "description": "Object containing information about errors reported by services.", "title": "ErrorInfo" } ``` ### 403 Forbidden #### application/json Schema ```json { "type": "object", "properties": { "errorCode": { "type": "string", "description": "Error Codes specific to cause of failure.", "example": "invalid_user_response" }, "errorMessage": { "type": "string", "description": "Additional Error Message describing the error.", "example": "Application id cannot be null" }, "parameters": { "type": "array", "description": "Optional additional error information.", "items": { "type": "object", "description": "Optional additional error information." } } }, "description": "Object containing information about errors reported by services.", "title": "ErrorInfo" } ``` ### 404 Not Found #### application/json Schema ```json { "type": "object", "properties": { "errorCode": { "type": "string", "description": "Error Codes specific to cause of failure.", "example": "invalid_user_response" }, "errorMessage": { "type": "string", "description": "Additional Error Message describing the error.", "example": "Application id cannot be null" }, "parameters": { "type": "array", "description": "Optional additional error information.", "items": { "type": "object", "description": "Optional additional error information." } } }, "description": "Object containing information about errors reported by services.", "title": "ErrorInfo" } ``` ### 409 Conflict #### application/json Schema ```json { "type": "object", "properties": { "errorCode": { "type": "string", "description": "Error Codes specific to cause of failure.", "example": "invalid_user_response" }, "errorMessage": { "type": "string", "description": "Additional Error Message describing the error.", "example": "Application id cannot be null" }, "parameters": { "type": "array", "description": "Optional additional error information.", "items": { "type": "object", "description": "Optional additional error information." } } }, "description": "Object containing information about errors reported by services.", "title": "ErrorInfo" } ``` ## Security Requirements ```json [ { "AdminAPIAuthentication": [ "CONTEXTRULES:VIEW" ] } ] ```