openapi: 3.1.0 info: version: 16.10.0 title: Amplify Platform API v1.0.0 aca idp API description: 'The Amplify Platform API provides the interface to perform the following: - Manage account settings and credentials - Manage organization settings, users, service accounts, and teams - Retrieve organization usage data - Register and manage applications - Retrieve application metrics and analytics - Retrieve user, organization, and application activity See the Amplify Guide for documentation and examples on how to authorize API calls to platform services. For general documentation refer to the Amplify Platform documentation. © Axway 2026. All rights reserved.' contact: email: support@axway.com termsOfService: https://www.axway.com/en/axway-platform-terms-of-use servers: - url: https://platform.axway.com/api/v1 tags: - name: idp paths: /provider/{provider_id}/idp/saml: parameters: [] post: externalDocs: description: Managing Identity Providers url: https://docs.axway.com/bundle/platform-management/page/docs/management_guide/configuring_and_managing_identity_providers/index.html tags: - idp summary: Axway Create Consumer SAML V2.0 IdP description: "Configure a custom SAML v2.0 Identity Provider for a marketplace's consumer organizations\n\n___Auth Requirement___\n - _All of_\n - `administrator` access to the provider's organization.\n - The organization entitlements allow `idp`.\n" operationId: provider_idpCreateSAML x-publishes: - marketplace.idp.create responses: '200': description: Response content: application/json: schema: allOf: - $ref: '#/components/schemas/Response' - properties: result: type: object required: - guid - name - protocol unevaluatedProperties: false allOf: - $ref: '#/components/schemas/DefaultFields' properties: _id: type: string description: Document ID of the Identity Provider. deprecated: true description: type: string description: Description of the Identity Provider. guid: type: string format: uuid description: '`guid` of the Identity Provider.' name: type: string description: Name of Identity Provider protocol: type: string description: Protocol the Identity Provider uses. enum: - oidc - saml provider_guid: type: string examples: ProviderIdpcreatesaml200Example: summary: Default provider_idpCreateSAML 200 response x-microcks-default: true value: example_value '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/Error' examples: IDP_MIXED_MAPPERS: value: success: false description: Cannot configure mappers with the same value in both Friendly and Attribute Names. code: 400 FORBIDDEN: value: $ref: '#/components/examples/FORBIDDEN/value' NOT_FOUND: value: $ref: '#/components/examples/NOT_FOUND/value' USER_NOT_ADMIN: value: $ref: '#/components/examples/USER_NOT_ADMIN/value' LOGIN_REQUIRED: value: $ref: '#/components/examples/LOGIN_REQUIRED/value' PARAM_INVALID: value: $ref: '#/components/examples/PARAM_INVALID/value' PARAM_REQUIRED: value: $ref: '#/components/examples/PARAM_REQUIRED/value' security: - BearerClient: [] - SessionCookie: [] - BearerUser: [] parameters: - $ref: '#/components/parameters/fields' example: example_value - $ref: '#/components/parameters/exclude_fields' example: example_value - in: path name: provider_id required: true schema: $ref: '#/components/schemas/Provider/properties/guid' example: {} requestBody: content: '*/*': schema: properties: allowedClockSkew: type: integer description: Clock skew in seconds that is tolerated when validating identity provider tokens default: 0 attributeConsumingServiceIndex: type: integer description: Index of the Attribute Consuming Service profile to request during authentication default: 0 attributeConsumingServiceName: type: string description: Name of the Attribute Consuming Service profile to advertise in the SP metadata backchannelSupported: type: boolean description: Whether the IdP supports backchannel logout default: false description: $ref: '#/components/schemas/IdentityProvider/properties/description' encryptionAlgorithm: type: string description: Encryption algorithm which is used by the SAML Identity Provider for encryption of SAML documents, assertions or IDs. The corresponding decryption key for decrypt SAML document parts will be chosen based on this configured algorithm and is provided by Axway for the encryption (ENC) usage. If algorithm is not configured, then any supported algorithm is allowed and decryption key will be chosen based on the algorithm configured in SAML document itself. enum: - RSA-OAEP entityId: type: string description: The Entity ID that will be used to uniquely identify this SAML Service Provider forceAuthn: type: boolean description: Whether the IdP must authenticate the presenter directly rather than rely on a previous security context default: false idpEntityId: type: string description: The Entity ID used to validate the Issuer for received SAML assertions. If empty, no Issuer validation is performed loginHint: type: boolean description: Whether to pass login_hint to the IdP default: true metadataDescriptorUrl: type: string description: External URL where the Identity Provider publishes the SAML Descriptor metadata information to source the X509 certificates used to validate signatures name: $ref: '#/components/schemas/IdentityProvider/properties/name' nameIDPolicyFormat: type: string description: Specifies the URI reference corresponding to a name identifier format enum: - urn:oasis:names:tc:SAML:2.0:nameid-format:persistent - urn:oasis:names:tc:SAML:2.0:nameid-format:transient - urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress - urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos - urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName - urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName - urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified postBindingAuthnRequest: type: boolean description: Indicates whether the AuthnRequest must be sent using HTTP-POST binding default: true postBindingLogout: type: boolean description: Indicates whether to respond to requests using HTTP-POST binding default: false postBindingResponse: type: boolean description: Indicates whether to respond to requests using HTTP-POST binding default: true xmlSigKeyInfoKeyNameTransformer: type: string description: Signing key to use in KeyName element enum: - NONE - KEY_ID - CERT_SUBJECT signSpMetadata: type: boolean description: Enable/disable signature of the provider SAML metadata signatureAlgorithm: type: string description: The signature algorithm to use to sign documents enum: - RSA_SHA256 - RSA_SHA256_MGF1 - RSA_SHA512 - RSA_SHA512_MGF1 signingCertificate: type: string description: The certificate in PEM format that must be used to check for signatures. Multiple certificates can be entered, separated by comma singleLogoutServiceUrl: type: string description: The URL that must be used to send logout requests singleSignOnServiceUrl: type: string description: The URL that must be used to send authentication requests useMetadataDescriptorUrl: type: boolean description: Whether to use a configured Metadata Descriptor URL to source the X509 certificates used to validate signatures validateSignature: type: boolean description: Enable/disable signature validation of IdP signatures default: false wantAssertionsEncrypted: type: boolean description: Whether to expect an encrypted assertion default: false wantAssertionsSigned: type: boolean description: Whether to expect a signed assertion default: false wantAuthnRequestsSigned: type: boolean description: Indicates whether the IdP expects a signed AuthnRequest default: true mapperAttrEmail: type: string description: Attribute name of the attribute to map to a user's email mapperFriendlyEmail: type: string description: Friendly name of the attribute to map to a user's email. One of friendly or attribute name is required mapperAttrFirstname: type: string description: Attribute name of the attribute to map to a user's first name. One of friendly or attribute name is required mapperFriendlyFirstname: type: string description: Friendly name of the attribute to map to a user's first name. One of friendly or attribute name is required mapperAttrLastname: type: string description: Attribute name of the attribute to map to a user's last name. One of friendly or attribute name is required mapperFriendlyLastname: type: string description: Friendly name of the attribute to map to a user's last name. One of friendly or attribute name is required mapperAttrPhone: type: string description: Attribute name of the attribute to map to a user's phone number. One of friendly or attribute name can be supplied mapperFriendlyPhone: type: string description: Friendly name of the attribute to map to a user's phone number. One of friendly or attribute name can be supplied mapperAttrCountry: type: string description: Attribute name of the attribute to map to a user's country. One of friendly or attribute name can be supplied mapperFriendlyCountry: type: string description: Friendly name of the attribute to map to a user's country. One of friendly or attribute name can be supplied caseInsensitiveMappedRoles: $ref: '#/components/schemas/IdentityProvider/properties/orgs/items/properties/case_insensitive_mapped_roles' defaultRoles: $ref: '#/components/schemas/IdentityProvider/properties/orgs/items/properties/default_roles' enforceMappedRoles: $ref: '#/components/schemas/IdentityProvider/properties/orgs/items/properties/enforce_mapped_roles' mappedRoles: $ref: '#/components/schemas/IdentityProvider/properties/orgs/items/properties/mapped_roles' mapperAttrConsumerId: type: string description: Attribute name of the attribute to map to the consumer organization ID(s). One of friendly or attribute name can be supplied mapperFriendlyConsumerId: type: string description: Friendly name of the attribute to map to the consumer organization ID(s). One of friendly or attribute name can be supplied consumerDefaultTeam: type: boolean description: Whether to add new users to the default team of the consumer organization consumerDefaultTeamRoles: type: array description: The roles to assign to new users in the default team of the consumer organization items: type: string consumerDefaultTeamPrivate: type: boolean description: Whether to make the default team of the consumer organization private when a new organization is created required: - name - nameIDPolicyFormat - singleSignOnServiceUrl - defaultRoles x-microcks-operation: delay: 0 dispatcher: FALLBACK /provider/{provider_id}/idp/oidc: parameters: [] post: externalDocs: description: Managing Identity Providers url: https://docs.axway.com/bundle/platform-management/page/docs/management_guide/configuring_and_managing_identity_providers/index.html tags: - idp summary: Axway Create Consumer OIDC IdP description: "Configure a custom OIDC Identity Provider for a marketplace's consumer organizations\n\n___Auth Requirement___\n - _All of_\n - `administrator` access to the provider's organization.\n - The organization entitlements allow `idp`.\n" operationId: provider_idpCreateOIDC x-publishes: - marketplace.idp.create responses: '200': description: Response content: application/json: schema: allOf: - $ref: '#/components/schemas/Response' - properties: result: type: object required: - guid - name - protocol unevaluatedProperties: false allOf: - $ref: '#/components/schemas/DefaultFields' properties: _id: type: string description: Document ID of the Identity Provider. deprecated: true description: type: string description: Description of the Identity Provider. guid: type: string format: uuid description: '`guid` of the Identity Provider.' name: type: string description: Name of Identity Provider protocol: type: string description: Protocol the Identity Provider uses. enum: - oidc - saml provider_guid: type: string examples: ProviderIdpcreateoidc200Example: summary: Default provider_idpCreateOIDC 200 response x-microcks-default: true value: example_value '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/Error' examples: FORBIDDEN: value: $ref: '#/components/examples/FORBIDDEN/value' NOT_FOUND: value: $ref: '#/components/examples/NOT_FOUND/value' USER_NOT_ADMIN: value: $ref: '#/components/examples/USER_NOT_ADMIN/value' LOGIN_REQUIRED: value: $ref: '#/components/examples/LOGIN_REQUIRED/value' PARAM_INVALID: value: $ref: '#/components/examples/PARAM_INVALID/value' PARAM_REQUIRED: value: $ref: '#/components/examples/PARAM_REQUIRED/value' security: - BearerClient: [] - SessionCookie: [] - BearerUser: [] parameters: - $ref: '#/components/parameters/fields' example: example_value - $ref: '#/components/parameters/exclude_fields' example: example_value - in: path name: provider_id required: true schema: $ref: '#/components/schemas/Provider/properties/guid' example: {} requestBody: content: '*/*': schema: properties: allowedClockSkew: type: integer description: Clock skew in seconds that is tolerated when validating identity provider tokens default: 0 authorizationUrl: type: string description: Authorization URL backchannelSupported: type: boolean description: Whether the IdP supports backchannel logout default: false clientAssertionAudience: type: string description: The audience to use for the client assertion. The default value is the Identity Provider's token endpoint URL clientAssertionSigningAlg: type: string description: 'Signature algorithm to create JWT assertion as client authentication. In the case of JWT signed with private key or JWT signed with client secret, it is required. If no algorithm is specified, the following algorithm is adapted: `RS256` is adapted in the case of JWT signed with private key, `HS256` is adapted in the case of JWT signed with client secret' enum: - algorithmNotSpecified - ES256 - ES384 - ES512 - HS256 - HS384 - HS512 - PS256 - PS384 - PS512 - RS256 - RS384 - RS512 default: algorithmNotSpecified clientAuthMethod: type: string description: The client authentication method. In case of JWT signed with private key, Axway's private key is used enum: - client_secret_post - client_secret_basic - client_secret_jwt - private_key_jwt clientId: type: string description: The client identifier registered within the IdP clientSecret: type: string description: The client secret registered within the IdP defaultScope: type: string description: The scopes to be sent when asking for authorization. It can be a space-separated list of scopes description: $ref: '#/components/schemas/IdentityProvider/properties/description' issuer: type: string description: The issuer identifier for the issuer of the response. If not provided, no validation will be performed. jwksUrl: type: string description: URL where identity provider keys in JWK format are stored jwtX509HeadersEnabled: type: boolean description: If enabled, the `x5t` (X.509 Certificate SHA-1 Thumbprint) header will be added to the JWT to reference the certificate used to sign it. Otherwise, the `kid` (Key ID) header will be used instead loginHint: type: boolean description: Whether to pass login_hint to the IdP default: true logoutUrl: type: string description: End session endpoint to use to logout user from the external IdP name: $ref: '#/components/schemas/IdentityProvider/properties/name' pkceEnabled: type: boolean description: Use PKCE (Proof of Key-code exchange) for Identity Provider Brokering pkceMethod: type: string description: PKCE Method to use enum: - plain - S256 publicKeySignatureVerifier: type: string description: The public key in PEM format that must be used to verify IdP signatures publicKeySignatureVerifierKeyId: type: string description: Explicit ID of the supplied validating public key sendClientIdOnLogout: type: boolean description: If the `client_id` parameter should be sent in logout requests sendIdTokenOnLogout: type: boolean description: If the `id_token_hint` parameter should be sent in logout requests tokenUrl: type: string description: Token URL useJwksUrl: type: boolean description: If enabled, then identity provider public keys will be downloaded from given JWKS URL validateSignature: type: boolean description: Enable/disable signature validation of IdP signatures default: false mapperAttrEmail: type: string description: Name of claim to search for in token for the user's email address mapperAttrFirstname: type: string description: Name of claim to search for in token for the user's first name mapperAttrLastname: type: string description: Name of claim to search for in token for the user's last name mapperAttrPhone: type: string description: Name of claim to search for in token for the user's phone number mapperAttrCountry: type: string description: Name of claim to search for in token for the user's country caseInsensitiveMappedRoles: $ref: '#/components/schemas/IdentityProvider/properties/orgs/items/properties/case_insensitive_mapped_roles' defaultRoles: $ref: '#/components/schemas/IdentityProvider/properties/orgs/items/properties/default_roles' enforceMappedRoles: $ref: '#/components/schemas/IdentityProvider/properties/orgs/items/properties/enforce_mapped_roles' mappedRoles: $ref: '#/components/schemas/IdentityProvider/properties/orgs/items/properties/mapped_roles' mapperAttrConsumerId: type: string description: Name of claim to search for in token for the consumer organization ID(s) consumerDefaultTeam: type: boolean description: Whether to add new users to the default team of the consumer organization consumerDefaultTeamRoles: type: array description: The roles to assign to new users in the default team of the consumer organization items: type: string consumerDefaultTeamPrivate: type: boolean description: Whether to make the default team of the consumer organization private when a new organization is created required: - authorizationUrl - clientAuthMethod - clientId - defaultScope - name - tokenUrl - mapperAttrEmail - mapperAttrFirstname - mapperAttrLastname - defaultRoles - mapperAttrConsumerId x-microcks-operation: delay: 0 dispatcher: FALLBACK /provider/{provider_id}/idp: parameters: [] get: summary: Axway Get Consumer IdP description: "Returns external IdP configured for the marketplace's consumer organization\n\n___Auth Requirement___\n - _All of_\n - `administrator` access to the provider's organization.\n - The organization entitlements allow `idp`.\n" externalDocs: description: Managing Identity Providers url: https://docs.axway.com/bundle/platform-management/page/docs/management_guide/configuring_and_managing_identity_providers/index.html tags: - idp operationId: provider_idpFind responses: '200': description: Response content: application/json: schema: allOf: - $ref: '#/components/schemas/Response' - properties: result: $ref: '#/components/schemas/IdentityProviderList' examples: ProviderIdpfind200Example: summary: Default provider_idpFind 200 response x-microcks-default: true value: example_value '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/Error' examples: FORBIDDEN: value: $ref: '#/components/examples/FORBIDDEN/value' NOT_FOUND: value: $ref: '#/components/examples/NOT_FOUND/value' USER_NOT_ADMIN: value: $ref: '#/components/examples/USER_NOT_ADMIN/value' LOGIN_REQUIRED: value: $ref: '#/components/examples/LOGIN_REQUIRED/value' PARAM_INVALID: value: $ref: '#/components/examples/PARAM_INVALID/value' PARAM_REQUIRED: value: $ref: '#/components/examples/PARAM_REQUIRED/value' security: - BearerClient: [] - SessionCookie: [] - BearerUser: [] parameters: - $ref: '#/components/parameters/fields' example: example_value - $ref: '#/components/parameters/exclude_fields' example: example_value - in: path name: provider_id required: true schema: $ref: '#/components/schemas/Provider/properties/guid' example: {} - in: query name: basic required: false schema: type: boolean description: Whether to return a basic representation of the IdP default: false example: true x-microcks-operation: delay: 0 dispatcher: FALLBACK delete: summary: Axway Remove Consumer IdP description: "Removes a custom Identity Provider for a marketplace's consumer organizations\n\n___Auth Requirement___\n - _All of_\n - `administrator` access to the provider's organization.\n - The organization entitlements allow `idp`.\n" externalDocs: description: Managing Identity Providers url: https://docs.axway.com/bundle/platform-management/page/docs/management_guide/configuring_and_managing_identity_providers/index.html tags: - idp operationId: provider_idpRemove x-publishes: - marketplace.idp.remove responses: '204': description: No Content '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/Error' examples: NOT_FOUND: value: $ref: '#/components/examples/NOT_FOUND/value' PROVIDER_REMOVE_ENABLED_IDP: value: success: false description: Identity Provider cannot be removed as Identity Provider Managed Consumers is enabled for the Marketplace. code: 400 FORBIDDEN: value: $ref: '#/components/examples/FORBIDDEN/value' USER_NOT_ADMIN: value: $ref: '#/components/examples/USER_NOT_ADMIN/value' LOGIN_REQUIRED: value: $ref: '#/components/examples/LOGIN_REQUIRED/value' PARAM_INVALID: value: $ref: '#/components/examples/PARAM_INVALID/value' PARAM_REQUIRED: value: $ref: '#/components/examples/PARAM_REQUIRED/value' security: - BearerClient: [] - SessionCookie: [] - BearerUser: [] parameters: - in: path name: provider_id required: true schema: $ref: '#/components/schemas/Provider/properties/guid' example: {} - in: query name: cleanup required: false schema: type: boolean description: Whether to cascade delete consumer organizations and users created by this Identity Provider. default: false example: true x-microcks-operation: delay: 0 dispatcher: FALLBACK put: summary: Axway Update Consumer IdP description: "Update a custom Identity Provider for a marketplace's consumer organizations\n\n___Auth Requirement___\n - _All of_\n - `administrator` access to the provider's organization.\n - The organization entitlements allow `idp`.\n" externalDocs: description: Managing Identity Providers url: https://docs.axway.com/bundle/platform-management/page/docs/management_guide/configuring_and_managing_identity_providers/index.html tags: - idp operationId: provider_idpUpdate x-publishes: - marketplace.idp.update responses: '200': description: Response content: application/json: schema: allOf: - $ref: '#/components/schemas/Response' - properties: result: type: object required: - guid - name - protocol unevaluatedProperties: false allOf: - $ref: '#/components/schemas/DefaultFields' properties: _id: type: string description: Document ID of the Identity Provider. deprecated: true description: type: string description: Description of the Identity Provider. guid: type: string format: uuid description: '`guid` of the Identity Provider.' name: type: string description: Name of Identity Provider protocol: type: string description: Protocol the Identity Provider uses. enum: - oidc - saml provider_guid: type: string examples: ProviderIdpupdate200Example: summary: Default provider_idpUpdate 200 response x-microcks-default: true value: example_value '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/Error' examples: IDP_MIXED_MAPPERS: value: success: false description: Cannot configure mappers with the same value in both Friendly and Attribute Names. code: 400 FORBIDDEN: value: $ref: '#/components/examples/FORBIDDEN/value' NOT_FOUND: value: $ref: '#/components/examples/NOT_FOUND/value' USER_NOT_ADMIN: value: $ref: '#/components/examples/USER_NOT_ADMIN/value' LOGIN_REQUIRED: value: $ref: '#/components/examples/LOGIN_REQUIRED/value' PARAM_INVALID: value: $ref: '#/components/examples/PARAM_INVALID/value' PARAM_REQUIRED: value: $ref: '#/components/examples/PARAM_REQUIRED/value' security: - BearerClient: [] - SessionCookie: [] - BearerUser: [] parameters: - $ref: '#/components/parameters/fields' example: example_value - $ref: '#/components/parameters/exclude_fields' example: example_value - in: path name: provider_id required: true schema: $ref: '#/components/schemas/Provider/properties/guid' example: {} requestBody: content: '*/*': schema: properties: allowedClockSkew: type: integer description: Clock skew in seconds that is tolerated when validating identity provider tokens default: 0 attributeConsumingServiceIndex: type: integer description: Index of the Attribute Consuming Service profile to request during authentication default: 0 attributeConsumingServiceName: type: string description: Name of the Attribute Consuming Service profile to advertise in the SP metadata authorizationUrl: type: string description: Authorization URL backchannelSupported: type: boolean description: Whether the IdP supports backchannel logout caseInsensitiveMappedRoles: $ref: '#/components/schemas/IdentityProvider/properties/orgs/items/properties/case_insensitive_mapped_roles' clientAssertionAudience: type: string description: The audience to use for the client assertion. The default value is the Identity Provider's token endpoint URL clientAssertionSigningAlg: type: string description: 'Signature algorithm to create JWT assertion as client authentication. In the case of JWT signed with private key or JWT signed with client secret, it is required. If no algorithm is specified, the following algorithm is adapted: `RS256` is adapted in the case of JWT signed with private key, `HS256` is adapted in the case of JWT signed with client secret' enum: - algorithmNotSpecified - ES256 - ES384 - ES512 - HS256 - HS384 - HS512 - PS256 - PS384 - PS512 - RS256 - RS384 - RS512 default: algorithmNotSpecified clientAuthMethod: type: string description: The client authentication method. In case of JWT signed with private key, Axway's private key is used enum: - client_secret_post - client_secret_basic - client_secret_jwt - private_key_jwt clientId: type: string description: The client identifier registered within the IdP clientSecret: type: string description: The client secret registered within the IdP defaultRoles: $ref: '#/components/schemas/IdentityProvider/properties/orgs/items/properties/default_roles' defaultScope: type: string description: The scopes to be sent when asking for authorization. It can be a space-separated list of scopes description: type: string description: Description of Identity Provider encryptionAlgorithm: type: string description: Encryption algorithm which is used by the SAML Identity Provider for encryption of SAML documents, assertions or IDs. The corresponding decryption key for decrypt SAML document parts will be chosen based on this configured algorithm and is provided by Axway for the encryption (ENC) usage. If algorithm is not configured, then any supported algorithm is allowed and decryption key will be chosen based on the algorithm configured in SAML document itself. enum: - RSA-OAEP enforceMappedRoles: $ref: '#/components/schemas/IdentityProvider/properties/orgs/items/properties/enforce_mapped_roles' entityId: type: string description: The Entity ID that will be used to uniquely identify this SAML Service Provider forceAuthn: type: boolean description: Whether the IdP must authenticate the presenter directly rather than rely on a previous security context idpEntityId: type: string description: The Entity ID used to validate the Issuer for received SAML assertions. If empty, no Issuer validation is performed issuer: type: string description: The issuer identifier for the issuer of the response. If not provided, no validation will be performed. jwksUrl: type: string description: URL where identity provider keys in JWK format are stored jwtX509HeadersEnabled: type: boolean description: If enabled, the `x5t` (X.509 Certificate SHA-1 Thumbprint) header will be added to the JWT to reference the certificate used to sign it. Otherwise, the `kid` (Key ID) header will be used instead loginHint: type: boolean description: Whether to pass login_hint to the IdP default: true logoutUrl: type: string description: End session endpoint to use to logout user from the external IdP mappedRoles: $ref: '#/components/schemas/IdentityProvider/properties/orgs/items/properties/mapped_roles' mapperAttrCountry: type: string description: Attribute to map to a user's country mapperAttrEmail: type: string description: Attribute to map to a user's email mapperAttrFirstname: type: string description: Attribute to map to a user's first name mapperAttrLastname: type: string description: Attribute to map to a user's last name mapperAttrPhone: type: string description: Attribute to map to a user's phone number mapperFriendlyCountry: type: string description: Friendly name of the attribute to map to a user's country mapperFriendlyEmail: type: string description: Friendly name of the attribute to map to a user's email mapperFriendlyFirstname: type: string description: Friendly name of the attribute to map to a user's first name mapperFriendlyLastname: type: string description: Friendly name of the attribute to map to a user's last name mapperFriendlyPhone: type: string description: Friendly name of the attribute to map to a user's phone number metadataDescriptorUrl: type: string description: External URL where the Identity Provider publishes the SAML Descriptor metadata information to source the X509 certificates used to validate signatures name: type: string description: Name of Identity Provider nameIDPolicyFormat: type: string description: Specifies the URI reference corresponding to a name identifier format enum: - urn:oasis:names:tc:SAML:2.0:nameid-format:persistent - urn:oasis:names:tc:SAML:2.0:nameid-format:transient - urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress - urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos - urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName - urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName - urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified pkceEnabled: type: boolean description: Use PKCE (Proof of Key-code exchange) for Identity Provider Brokering pkceMethod: type: string description: PKCE Method to use enum: - plain - S256 postBindingAuthnRequest: type: boolean description: Indicates whether the AuthnRequest must be sent using HTTP-POST binding postBindingLogout: type: boolean description: Indicates whether to respond to requests using HTTP-POST binding postBindingResponse: type: boolean description: Indicates whether to respond to requests using HTTP-POST binding providerId: type: string description: The protocol of the IdP enum: - oidc - saml publicKeySignatureVerifier: type: string description: The public key in PEM format that must be used to verify IdP signatures publicKeySignatureVerifierKeyId: type: string description: Explicit ID of the supplied validating public key sendClientIdOnLogout: type: boolean description: If the `client_id` parameter should be sent in logout requests sendIdTokenOnLogout: type: boolean description: If the `id_token_hint` parameter should be sent in logout requests signatureAlgorithm: type: string description: The signature algorithm to use to sign documents enum: - RSA_SHA256 - RSA_SHA256_MGF1 - RSA_SHA512 - RSA_SHA512_MGF1 signingCertificate: type: string description: The certificate in PEM format that must be used to check for signatures. Multiple certificates can be entered, separated by comma signSpMetadata: type: boolean description: Enable/disable signature of the provider SAML metadata singleLogoutServiceUrl: type: string description: The Url that must be used to send logout requests singleSignOnServiceUrl: type: string description: The Url that must be used to send authentication requests tokenUrl: type: string description: Token URL useJwksUrl: type: boolean description: If enabled, then identity provider public keys will be downloaded from given JWKS URL useMetadataDescriptorUrl: type: boolean description: Whether to use a configured Metadata Descriptor URL to source the X509 certificates used to validate signatures validateSignature: type: boolean description: Enable/disable signature validation of IdP signatures wantAssertionsEncrypted: type: boolean description: Whether to expect an encrypted assertion wantAssertionsSigned: type: boolean description: Whether to expect a signed assertion wantAuthnRequestsSigned: type: boolean description: Indicates whether the IdP expects a signed AuthnRequest xmlSigKeyInfoKeyNameTransformer: type: string description: Signing key to use in KeyName element enum: - NONE - KEY_ID - CERT_SUBJECT consumerDefaultTeam: type: boolean description: Whether to add new users to the default team of the consumer organization consumerDefaultTeamPrivate: type: boolean description: Whether to make the default team of the consumer organization private when a new organization is created consumerDefaultTeamRoles: type: array description: The roles to assign to new users in the default team of the consumer organization items: type: string mapperAttrConsumerId: type: string description: Attribute to map to the consumer organization ID(s) mapperFriendlyConsumerId: type: string description: Friendly name of the attribute to map to the consumer organization ID(s) required: - providerId x-microcks-operation: delay: 0 dispatcher: FALLBACK /org/{org_id}/idp/saml: parameters: [] post: externalDocs: description: Managing Identity Providers url: https://docs.axway.com/bundle/platform-management/page/docs/management_guide/configuring_and_managing_identity_providers/index.html tags: - idp summary: Axway Create SAML V2.0 IdP description: "Configure a custom SAML v2.0 IdP for an organization\n\n___Auth Requirement___\n - _All of_\n - `administrator` access to the organization.\n - The organization entitlements allow `idp`.\n - Disallow action for internal organization.\n\n\n_Allows consumer organization access_\n" operationId: org_idpCreateSAML x-publishes: - platform.org.idp.create responses: '200': description: Response content: application/json: schema: allOf: - $ref: '#/components/schemas/Response' - properties: result: type: object required: - guid - name - protocol unevaluatedProperties: false allOf: - $ref: '#/components/schemas/DefaultFields' properties: _id: type: string description: Document ID of the Identity Provider. deprecated: true description: type: string description: Description of the Identity Provider. guid: type: string format: uuid description: '`guid` of the Identity Provider.' name: type: string description: Name of Identity Provider protocol: type: string description: Protocol the Identity Provider uses. enum: - oidc - saml provider_guid: type: string examples: OrgIdpcreatesaml200Example: summary: Default org_idpCreateSAML 200 response x-microcks-default: true value: example_value '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/Error' examples: IDP_MIXED_MAPPERS: value: success: false description: Cannot configure mappers with the same value in both Friendly and Attribute Names. code: 400 FORBIDDEN: value: $ref: '#/components/examples/FORBIDDEN/value' NOT_FOUND: value: $ref: '#/components/examples/NOT_FOUND/value' IDP_REQUIRED: value: $ref: '#/components/examples/IDP_REQUIRED/value' USER_NOT_ADMIN: value: $ref: '#/components/examples/USER_NOT_ADMIN/value' LOGIN_REQUIRED: value: $ref: '#/components/examples/LOGIN_REQUIRED/value' PARAM_INVALID: value: $ref: '#/components/examples/PARAM_INVALID/value' PARAM_REQUIRED: value: $ref: '#/components/examples/PARAM_REQUIRED/value' security: - BearerClient: [] - SessionCookie: [] - BearerUser: [] parameters: - $ref: '#/components/parameters/fields' example: example_value - $ref: '#/components/parameters/exclude_fields' example: example_value - in: path name: org_id required: true schema: type: string description: '`guid` or `org_id` of the organization' example: 507f1f77bcf86cd799439011 requestBody: content: '*/*': schema: properties: allowedClockSkew: type: integer description: Clock skew in seconds that is tolerated when validating identity provider tokens default: 0 attributeConsumingServiceIndex: type: integer description: Index of the Attribute Consuming Service profile to request during authentication default: 0 attributeConsumingServiceName: type: string description: Name of the Attribute Consuming Service profile to advertise in the SP metadata backchannelSupported: type: boolean description: Whether the IdP supports backchannel logout default: false description: $ref: '#/components/schemas/IdentityProvider/properties/description' encryptionAlgorithm: type: string description: Encryption algorithm which is used by the SAML Identity Provider for encryption of SAML documents, assertions or IDs. The corresponding decryption key for decrypt SAML document parts will be chosen based on this configured algorithm and is provided by Axway for the encryption (ENC) usage. If algorithm is not configured, then any supported algorithm is allowed and decryption key will be chosen based on the algorithm configured in SAML document itself. enum: - RSA-OAEP entityId: type: string description: The Entity ID that will be used to uniquely identify this SAML Service Provider forceAuthn: type: boolean description: Whether the IdP must authenticate the presenter directly rather than rely on a previous security context default: false idpEntityId: type: string description: The Entity ID used to validate the Issuer for received SAML assertions. If empty, no Issuer validation is performed loginHint: type: boolean description: Whether to pass login_hint to the IdP default: true metadataDescriptorUrl: type: string description: External URL where the Identity Provider publishes the SAML Descriptor metadata information to source the X509 certificates used to validate signatures name: $ref: '#/components/schemas/IdentityProvider/properties/name' nameIDPolicyFormat: type: string description: Specifies the URI reference corresponding to a name identifier format enum: - urn:oasis:names:tc:SAML:2.0:nameid-format:persistent - urn:oasis:names:tc:SAML:2.0:nameid-format:transient - urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress - urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos - urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName - urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName - urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified postBindingAuthnRequest: type: boolean description: Indicates whether the AuthnRequest must be sent using HTTP-POST binding default: true postBindingLogout: type: boolean description: Indicates whether to respond to requests using HTTP-POST binding default: false postBindingResponse: type: boolean description: Indicates whether to respond to requests using HTTP-POST binding default: true xmlSigKeyInfoKeyNameTransformer: type: string description: Signing key to use in KeyName element enum: - NONE - KEY_ID - CERT_SUBJECT signSpMetadata: type: boolean description: Enable/disable signature of the provider SAML metadata signatureAlgorithm: type: string description: The signature algorithm to use to sign documents enum: - RSA_SHA256 - RSA_SHA256_MGF1 - RSA_SHA512 - RSA_SHA512_MGF1 signingCertificate: type: string description: The certificate in PEM format that must be used to check for signatures. Multiple certificates can be entered, separated by comma singleLogoutServiceUrl: type: string description: The URL that must be used to send logout requests singleSignOnServiceUrl: type: string description: The URL that must be used to send authentication requests useMetadataDescriptorUrl: type: boolean description: Whether to use a configured Metadata Descriptor URL to source the X509 certificates used to validate signatures validateSignature: type: boolean description: Enable/disable signature validation of IdP signatures default: false wantAssertionsEncrypted: type: boolean description: Whether to expect an encrypted assertion default: false wantAssertionsSigned: type: boolean description: Whether to expect a signed assertion default: false wantAuthnRequestsSigned: type: boolean description: Indicates whether the IdP expects a signed AuthnRequest default: true mapperAttrEmail: type: string description: Attribute name of the attribute to map to a user's email mapperFriendlyEmail: type: string description: Friendly name of the attribute to map to a user's email. One of friendly or attribute name is required mapperAttrFirstname: type: string description: Attribute name of the attribute to map to a user's first name. One of friendly or attribute name is required mapperFriendlyFirstname: type: string description: Friendly name of the attribute to map to a user's first name. One of friendly or attribute name is required mapperAttrLastname: type: string description: Attribute name of the attribute to map to a user's last name. One of friendly or attribute name is required mapperFriendlyLastname: type: string description: Friendly name of the attribute to map to a user's last name. One of friendly or attribute name is required mapperAttrPhone: type: string description: Attribute name of the attribute to map to a user's phone number. One of friendly or attribute name can be supplied mapperFriendlyPhone: type: string description: Friendly name of the attribute to map to a user's phone number. One of friendly or attribute name can be supplied mapperAttrCountry: type: string description: Attribute name of the attribute to map to a user's country. One of friendly or attribute name can be supplied mapperFriendlyCountry: type: string description: Friendly name of the attribute to map to a user's country. One of friendly or attribute name can be supplied provisionAdHoc: type: boolean description: Whether to automatically register users who authenticate using the Identity Provider that are not on an associated claimed email domain as members of the organization default: false restrictDomainUsers: type: boolean description: Whether to automatically restrict users provisioned via domain association to authenticate using the Identity Provider. default: false caseInsensitiveMappedRoles: $ref: '#/components/schemas/IdentityProvider/properties/orgs/items/properties/case_insensitive_mapped_roles' defaultRoles: $ref: '#/components/schemas/IdentityProvider/properties/orgs/items/properties/default_roles' defaultTeams: $ref: '#/components/schemas/IdentityProvider/properties/orgs/items/properties/default_teams' enforceMappedRoles: $ref: '#/components/schemas/IdentityProvider/properties/orgs/items/properties/enforce_mapped_roles' enforceMappedTeams: $ref: '#/components/schemas/IdentityProvider/properties/orgs/items/properties/enforce_mapped_teams' mappedRoles: $ref: '#/components/schemas/IdentityProvider/properties/orgs/items/properties/mapped_roles' mappedTeams: $ref: '#/components/schemas/IdentityProvider/properties/orgs/items/properties/mapped_teams' required: - name - nameIDPolicyFormat - singleSignOnServiceUrl - defaultRoles x-microcks-operation: delay: 0 dispatcher: FALLBACK /org/{org_id}/idp/oidc: parameters: [] post: externalDocs: description: Managing Identity Providers url: https://docs.axway.com/bundle/platform-management/page/docs/management_guide/configuring_and_managing_identity_providers/index.html tags: - idp summary: Axway Create OIDC IdP description: "Configure a custom OIDC IdP for an organization\n\n___Auth Requirement___\n - _All of_\n - `administrator` access to the organization.\n - The organization entitlements allow `idp`.\n - Disallow action for internal organization.\n\n\n_Allows consumer organization access_\n" operationId: org_idpCreateOIDC x-publishes: - platform.org.idp.create responses: '200': description: Response content: application/json: schema: allOf: - $ref: '#/components/schemas/Response' - properties: result: type: object required: - guid - name - protocol unevaluatedProperties: false allOf: - $ref: '#/components/schemas/DefaultFields' properties: _id: type: string description: Document ID of the Identity Provider. deprecated: true description: type: string description: Description of the Identity Provider. guid: type: string format: uuid description: '`guid` of the Identity Provider.' name: type: string description: Name of Identity Provider protocol: type: string description: Protocol the Identity Provider uses. enum: - oidc - saml provider_guid: type: string examples: OrgIdpcreateoidc200Example: summary: Default org_idpCreateOIDC 200 response x-microcks-default: true value: example_value '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/Error' examples: FORBIDDEN: value: $ref: '#/components/examples/FORBIDDEN/value' NOT_FOUND: value: $ref: '#/components/examples/NOT_FOUND/value' IDP_REQUIRED: value: $ref: '#/components/examples/IDP_REQUIRED/value' USER_NOT_ADMIN: value: $ref: '#/components/examples/USER_NOT_ADMIN/value' LOGIN_REQUIRED: value: $ref: '#/components/examples/LOGIN_REQUIRED/value' PARAM_INVALID: value: $ref: '#/components/examples/PARAM_INVALID/value' PARAM_REQUIRED: value: $ref: '#/components/examples/PARAM_REQUIRED/value' security: - BearerClient: [] - SessionCookie: [] - BearerUser: [] parameters: - $ref: '#/components/parameters/fields' example: example_value - $ref: '#/components/parameters/exclude_fields' example: example_value - in: path name: org_id required: true schema: type: string description: '`guid` or `org_id` of the organization' example: 507f1f77bcf86cd799439011 requestBody: content: '*/*': schema: properties: allowedClockSkew: type: integer description: Clock skew in seconds that is tolerated when validating identity provider tokens default: 0 authorizationUrl: type: string description: Authorization URL backchannelSupported: type: boolean description: Whether the IdP supports backchannel logout default: false clientAssertionAudience: type: string description: The audience to use for the client assertion. The default value is the Identity Provider's token endpoint URL clientAssertionSigningAlg: type: string description: 'Signature algorithm to create JWT assertion as client authentication. In the case of JWT signed with private key or JWT signed with client secret, it is required. If no algorithm is specified, the following algorithm is adapted: `RS256` is adapted in the case of JWT signed with private key, `HS256` is adapted in the case of JWT signed with client secret' enum: - algorithmNotSpecified - ES256 - ES384 - ES512 - HS256 - HS384 - HS512 - PS256 - PS384 - PS512 - RS256 - RS384 - RS512 default: algorithmNotSpecified clientAuthMethod: type: string description: The client authentication method. In case of JWT signed with private key, Axway's private key is used enum: - client_secret_post - client_secret_basic - client_secret_jwt - private_key_jwt clientId: type: string description: The client identifier registered within the IdP clientSecret: type: string description: The client secret registered within the IdP defaultScope: type: string description: The scopes to be sent when asking for authorization. It can be a space-separated list of scopes description: $ref: '#/components/schemas/IdentityProvider/properties/description' issuer: type: string description: The issuer identifier for the issuer of the response. If not provided, no validation will be performed. jwksUrl: type: string description: URL where identity provider keys in JWK format are stored jwtX509HeadersEnabled: type: boolean description: If enabled, the `x5t` (X.509 Certificate SHA-1 Thumbprint) header will be added to the JWT to reference the certificate used to sign it. Otherwise, the `kid` (Key ID) header will be used instead loginHint: type: boolean description: Whether to pass login_hint to the IdP default: true logoutUrl: type: string description: End session endpoint to use to logout user from the external IdP name: $ref: '#/components/schemas/IdentityProvider/properties/name' pkceEnabled: type: boolean description: Use PKCE (Proof of Key-code exchange) for Identity Provider Brokering pkceMethod: type: string description: PKCE Method to use enum: - plain - S256 publicKeySignatureVerifier: type: string description: The public key in PEM format that must be used to verify IdP signatures publicKeySignatureVerifierKeyId: type: string description: Explicit ID of the supplied validating public key sendClientIdOnLogout: type: boolean description: If the `client_id` parameter should be sent in logout requests sendIdTokenOnLogout: type: boolean description: If the `id_token_hint` parameter should be sent in logout requests tokenUrl: type: string description: Token URL useJwksUrl: type: boolean description: If enabled, then identity provider public keys will be downloaded from given JWKS URL validateSignature: type: boolean description: Enable/disable signature validation of IdP signatures default: false mapperAttrEmail: type: string description: Name of claim to search for in token for the user's email address mapperAttrFirstname: type: string description: Name of claim to search for in token for the user's first name mapperAttrLastname: type: string description: Name of claim to search for in token for the user's last name mapperAttrPhone: type: string description: Name of claim to search for in token for the user's phone number mapperAttrCountry: type: string description: Name of claim to search for in token for the user's country provisionAdHoc: type: boolean description: Whether to automatically register users who authenticate using the Identity Provider that are not on an associated claimed email domain as members of the organization default: false restrictDomainUsers: type: boolean description: Whether to automatically restrict users provisioned via domain association to authenticate using the Identity Provider. default: false caseInsensitiveMappedRoles: $ref: '#/components/schemas/IdentityProvider/properties/orgs/items/properties/case_insensitive_mapped_roles' defaultRoles: $ref: '#/components/schemas/IdentityProvider/properties/orgs/items/properties/default_roles' defaultTeams: $ref: '#/components/schemas/IdentityProvider/properties/orgs/items/properties/default_teams' enforceMappedRoles: $ref: '#/components/schemas/IdentityProvider/properties/orgs/items/properties/enforce_mapped_roles' enforceMappedTeams: $ref: '#/components/schemas/IdentityProvider/properties/orgs/items/properties/enforce_mapped_teams' mappedRoles: $ref: '#/components/schemas/IdentityProvider/properties/orgs/items/properties/mapped_roles' mappedTeams: $ref: '#/components/schemas/IdentityProvider/properties/orgs/items/properties/mapped_teams' required: - authorizationUrl - clientAuthMethod - clientId - defaultScope - name - tokenUrl - mapperAttrEmail - mapperAttrFirstname - mapperAttrLastname - defaultRoles x-microcks-operation: delay: 0 dispatcher: FALLBACK /org/{org_id}/idp/{idp_id}/reload-keys: parameters: [] get: summary: Axway Reload SAML Validating Certificates description: "Trigger the fetching of updated Validating X509 Certificates from the configured Metadata Descriptor URL\n\n___Auth Requirement___\n - _All of_\n - `administrator` access to the organization.\n - The organization entitlements allow `idp`.\n\n\n_Allows consumer organization access_\n" externalDocs: description: Managing Identity Providers url: https://docs.axway.com/bundle/platform-management/page/docs/management_guide/configuring_and_managing_identity_providers/index.html tags: - idp operationId: org_idpReloadKeys responses: '204': description: No Content '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/Error' examples: NOT_FOUND: value: $ref: '#/components/examples/NOT_FOUND/value' INVALID_DESCRIPTOR: value: success: false description: An error occurred attempting to fetch the Validating X509 Certificates from the configured Metadata Descriptor URL. Please verify the configured URL is correct. code: 400 FORBIDDEN: value: $ref: '#/components/examples/FORBIDDEN/value' IDP_REQUIRED: value: $ref: '#/components/examples/IDP_REQUIRED/value' USER_NOT_ADMIN: value: $ref: '#/components/examples/USER_NOT_ADMIN/value' LOGIN_REQUIRED: value: $ref: '#/components/examples/LOGIN_REQUIRED/value' PARAM_INVALID: value: $ref: '#/components/examples/PARAM_INVALID/value' PARAM_REQUIRED: value: $ref: '#/components/examples/PARAM_REQUIRED/value' security: - BearerClient: [] - SessionCookie: [] - BearerUser: [] parameters: - in: path name: idp_id required: true schema: type: string description: ID of the Identity Provider example: 507f1f77bcf86cd799439011 - in: path name: org_id required: true schema: type: string description: '`guid` or `org_id` of the organization' example: 507f1f77bcf86cd799439011 x-microcks-operation: delay: 0 dispatcher: FALLBACK /org/{org_id}/idp/{idp_id}/descriptor: parameters: [] get: summary: Axway Get IdP Descriptor description: "Trigger the download of an IdPs SAML descriptor\n\n___Auth Requirement___\n - _All of_\n - `administrator` access to the organization.\n - The organization entitlements allow `idp`.\n\n\n_Allows consumer organization access_\n" externalDocs: description: Managing Identity Providers url: https://docs.axway.com/bundle/platform-management/page/docs/management_guide/configuring_and_managing_identity_providers/index.html tags: - idp operationId: org_idpDownloadDescriptor responses: '200': description: Success content: application/octet-stream: schema: type: string format: binary description: SAML descriptor file. '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/Error' examples: NOT_FOUND: value: $ref: '#/components/examples/NOT_FOUND/value' FORBIDDEN: value: $ref: '#/components/examples/FORBIDDEN/value' IDP_REQUIRED: value: $ref: '#/components/examples/IDP_REQUIRED/value' USER_NOT_ADMIN: value: $ref: '#/components/examples/USER_NOT_ADMIN/value' LOGIN_REQUIRED: value: $ref: '#/components/examples/LOGIN_REQUIRED/value' PARAM_INVALID: value: $ref: '#/components/examples/PARAM_INVALID/value' PARAM_REQUIRED: value: $ref: '#/components/examples/PARAM_REQUIRED/value' security: - BearerClient: [] - SessionCookie: [] - BearerUser: [] parameters: - in: path name: idp_id required: true schema: type: string description: ID of the Identity Provider example: 507f1f77bcf86cd799439011 - in: path name: org_id required: true schema: type: string description: '`guid` or `org_id` of the organization' example: 507f1f77bcf86cd799439011 x-microcks-operation: delay: 0 dispatcher: FALLBACK /org/{org_id}/idp/{idp_id}/certificate: parameters: [] get: summary: Axway Get Public IdP Signing or Encryption Certificate description: "Trigger the download of the public key certificate used for signatures or encryption\n\n___Auth Requirement___\n - _All of_\n - `administrator` access to the organization.\n - The organization entitlements allow `idp`.\n\n\n_Allows consumer organization access_\n" externalDocs: description: Managing Identity Providers url: https://docs.axway.com/bundle/platform-management/page/docs/management_guide/configuring_and_managing_identity_providers/index.html tags: - idp operationId: org_idpDownloadCert responses: '200': description: Success content: application/octet-stream: schema: type: string format: binary description: Requested X509 certificate. '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/Error' examples: NOT_FOUND: value: $ref: '#/components/examples/NOT_FOUND/value' FORBIDDEN: value: $ref: '#/components/examples/FORBIDDEN/value' IDP_REQUIRED: value: $ref: '#/components/examples/IDP_REQUIRED/value' USER_NOT_ADMIN: value: $ref: '#/components/examples/USER_NOT_ADMIN/value' LOGIN_REQUIRED: value: $ref: '#/components/examples/LOGIN_REQUIRED/value' PARAM_INVALID: value: $ref: '#/components/examples/PARAM_INVALID/value' PARAM_REQUIRED: value: $ref: '#/components/examples/PARAM_REQUIRED/value' security: - BearerClient: [] - SessionCookie: [] - BearerUser: [] parameters: - in: path name: idp_id required: true schema: type: string description: ID of the Identity Provider example: 507f1f77bcf86cd799439011 - in: path name: org_id required: true schema: type: string description: '`guid` or `org_id` of the organization' example: 507f1f77bcf86cd799439011 - in: query name: use required: false schema: type: string description: Which certificate to download enum: - signing - encryption default: signing example: signing x-microcks-operation: delay: 0 dispatcher: FALLBACK /org/{org_id}/idp/{idp_id}: parameters: [] post: summary: Axway Associate with Another Organizations IdP description: "Associates an existing organizations custom IdP with the requested organization\n\n___Auth Requirement___\n - _All of_\n - `administrator` access to the organization.\n - The organization entitlements allow `idp`.\n - Disallow action for internal organization.\n\n\n_Allows consumer organization access_\n" externalDocs: description: Managing Identity Providers url: https://docs.axway.com/bundle/platform-management/page/docs/management_guide/configuring_and_managing_identity_providers/index.html tags: - idp operationId: org_idpAssociate x-publishes: - platform.org.idp.create responses: '204': description: No Content '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/Error' examples: NOT_FOUND: value: $ref: '#/components/examples/NOT_FOUND/value' FORBIDDEN: value: $ref: '#/components/examples/FORBIDDEN/value' IDP_REQUIRED: value: $ref: '#/components/examples/IDP_REQUIRED/value' USER_NOT_ADMIN: value: $ref: '#/components/examples/USER_NOT_ADMIN/value' LOGIN_REQUIRED: value: $ref: '#/components/examples/LOGIN_REQUIRED/value' PARAM_INVALID: value: $ref: '#/components/examples/PARAM_INVALID/value' PARAM_REQUIRED: value: $ref: '#/components/examples/PARAM_REQUIRED/value' security: - BearerClient: [] - SessionCookie: [] - BearerUser: [] parameters: - in: path name: idp_id required: true schema: type: string description: ID of the Identity Provider example: 507f1f77bcf86cd799439011 - in: path name: org_id required: true schema: type: string description: '`guid` or `org_id` of the target organization' example: 507f1f77bcf86cd799439011 requestBody: content: '*/*': schema: properties: domain: type: string description: Domain to associate the identity provider to org_id: type: string description: '`guid` or `org_id` of the source organization' required: - domain - org_id x-microcks-operation: delay: 0 dispatcher: FALLBACK get: summary: Axway Get IdP description: "Returns configuration for an external IdP\n\n___Auth Requirement___\n - _All of_\n - `administrator` access to the organization.\n - The organization entitlements allow `idp`. Allows unentitled access to an existing configuration.\n\n\n_Allows consumer organization access_\n" externalDocs: description: Managing Identity Providers url: https://docs.axway.com/bundle/platform-management/page/docs/management_guide/configuring_and_managing_identity_providers/index.html tags: - idp operationId: org_idpFindOne responses: '200': description: Response content: application/json: schema: allOf: - $ref: '#/components/schemas/Response' - properties: result: $ref: '#/components/schemas/IdentityProvider' examples: OrgIdpfindone200Example: summary: Default org_idpFindOne 200 response x-microcks-default: true value: example_value '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/Error' examples: NOT_FOUND: value: $ref: '#/components/examples/NOT_FOUND/value' FORBIDDEN: value: $ref: '#/components/examples/FORBIDDEN/value' IDP_REQUIRED: value: $ref: '#/components/examples/IDP_REQUIRED/value' USER_NOT_ADMIN: value: $ref: '#/components/examples/USER_NOT_ADMIN/value' LOGIN_REQUIRED: value: $ref: '#/components/examples/LOGIN_REQUIRED/value' PARAM_INVALID: value: $ref: '#/components/examples/PARAM_INVALID/value' PARAM_REQUIRED: value: $ref: '#/components/examples/PARAM_REQUIRED/value' security: - BearerClient: [] - SessionCookie: [] - BearerUser: [] parameters: - $ref: '#/components/parameters/fields' example: example_value - $ref: '#/components/parameters/exclude_fields' example: example_value - in: path name: idp_id required: true schema: type: string description: ID of the Identity Provider example: 507f1f77bcf86cd799439011 - in: path name: org_id required: true schema: type: string description: org_id of the organization to get example: 507f1f77bcf86cd799439011 x-microcks-operation: delay: 0 dispatcher: FALLBACK delete: summary: Axway Remove Organization IdP Config description: "Removes an organizations custom IdP\n\n___Auth Requirement___\n - _All of_\n - `administrator` access to the organization.\n - The organization entitlements allow `idp`. Allows unentitled access to an existing configuration.\n - Disallow action for internal organization.\n\n\n_Allows consumer organization access_\n" externalDocs: description: Managing Identity Providers url: https://docs.axway.com/bundle/platform-management/page/docs/management_guide/configuring_and_managing_identity_providers/index.html tags: - idp operationId: org_idpRemove x-publishes: - platform.org.idp.remove - platform.org.idp.domain.remove responses: '204': description: No Content '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/Error' examples: NOT_FOUND: value: $ref: '#/components/examples/NOT_FOUND/value' FORBIDDEN: value: $ref: '#/components/examples/FORBIDDEN/value' IDP_REQUIRED: value: $ref: '#/components/examples/IDP_REQUIRED/value' USER_NOT_ADMIN: value: $ref: '#/components/examples/USER_NOT_ADMIN/value' LOGIN_REQUIRED: value: $ref: '#/components/examples/LOGIN_REQUIRED/value' PARAM_INVALID: value: $ref: '#/components/examples/PARAM_INVALID/value' PARAM_REQUIRED: value: $ref: '#/components/examples/PARAM_REQUIRED/value' security: - BearerClient: [] - SessionCookie: [] - BearerUser: [] parameters: - in: path name: idp_id required: true schema: type: string description: ID of the Identity Provider example: 507f1f77bcf86cd799439011 - in: path name: org_id required: true schema: type: string description: '`guid` or `org_id` of the organization' example: 507f1f77bcf86cd799439011 x-microcks-operation: delay: 0 dispatcher: FALLBACK put: summary: Axway Update Organizations Custom IdP description: "Update the custom IdP for an organization\n\n___Auth Requirement___\n - _All of_\n - `administrator` access to the organization.\n - The organization entitlements allow `idp`.\n - Disallow action for internal organization.\n\n\n_Allows consumer organization access_\n" externalDocs: description: Managing Identity Providers url: https://docs.axway.com/bundle/platform-management/page/docs/management_guide/configuring_and_managing_identity_providers/index.html tags: - idp operationId: org_idpUpdate x-publishes: - platform.org.idp.update responses: '200': description: Response content: application/json: schema: allOf: - $ref: '#/components/schemas/Response' - properties: result: type: object required: - guid - name - protocol unevaluatedProperties: false allOf: - $ref: '#/components/schemas/DefaultFields' properties: _id: type: string description: Document ID of the Identity Provider. deprecated: true description: type: string description: Description of the Identity Provider. guid: type: string format: uuid description: '`guid` of the Identity Provider.' name: type: string description: Name of Identity Provider protocol: type: string description: Protocol the Identity Provider uses. enum: - oidc - saml provider_guid: type: string examples: OrgIdpupdate200Example: summary: Default org_idpUpdate 200 response x-microcks-default: true value: example_value '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/Error' examples: IDP_MIXED_MAPPERS: value: success: false description: Cannot configure mappers with the same value in both Friendly and Attribute Names. code: 400 FORBIDDEN: value: $ref: '#/components/examples/FORBIDDEN/value' NOT_FOUND: value: $ref: '#/components/examples/NOT_FOUND/value' IDP_REQUIRED: value: $ref: '#/components/examples/IDP_REQUIRED/value' USER_NOT_ADMIN: value: $ref: '#/components/examples/USER_NOT_ADMIN/value' LOGIN_REQUIRED: value: $ref: '#/components/examples/LOGIN_REQUIRED/value' PARAM_INVALID: value: $ref: '#/components/examples/PARAM_INVALID/value' PARAM_REQUIRED: value: $ref: '#/components/examples/PARAM_REQUIRED/value' security: - BearerClient: [] - SessionCookie: [] - BearerUser: [] parameters: - $ref: '#/components/parameters/fields' example: example_value - $ref: '#/components/parameters/exclude_fields' example: example_value - in: path name: idp_id required: true schema: type: string description: ID of the Identity Provider example: 507f1f77bcf86cd799439011 - in: path name: org_id required: true schema: type: string description: '`guid` or `org_id` of the organization' example: 507f1f77bcf86cd799439011 requestBody: content: '*/*': schema: properties: allowedClockSkew: type: integer description: Clock skew in seconds that is tolerated when validating identity provider tokens default: 0 attributeConsumingServiceIndex: type: integer description: Index of the Attribute Consuming Service profile to request during authentication default: 0 attributeConsumingServiceName: type: string description: Name of the Attribute Consuming Service profile to advertise in the SP metadata authorizationUrl: type: string description: Authorization URL backchannelSupported: type: boolean description: Whether the IdP supports backchannel logout caseInsensitiveMappedRoles: $ref: '#/components/schemas/IdentityProvider/properties/orgs/items/properties/case_insensitive_mapped_roles' clientAssertionAudience: type: string description: The audience to use for the client assertion. The default value is the Identity Provider's token endpoint URL clientAssertionSigningAlg: type: string description: 'Signature algorithm to create JWT assertion as client authentication. In the case of JWT signed with private key or JWT signed with client secret, it is required. If no algorithm is specified, the following algorithm is adapted: `RS256` is adapted in the case of JWT signed with private key, `HS256` is adapted in the case of JWT signed with client secret' enum: - algorithmNotSpecified - ES256 - ES384 - ES512 - HS256 - HS384 - HS512 - PS256 - PS384 - PS512 - RS256 - RS384 - RS512 default: algorithmNotSpecified clientAuthMethod: type: string description: The client authentication method. In case of JWT signed with private key, Axway's private key is used enum: - client_secret_post - client_secret_basic - client_secret_jwt - private_key_jwt clientId: type: string description: The client identifier registered within the IdP clientSecret: type: string description: The client secret registered within the IdP defaultRoles: $ref: '#/components/schemas/IdentityProvider/properties/orgs/items/properties/default_roles' defaultScope: type: string description: The scopes to be sent when asking for authorization. It can be a space-separated list of scopes defaultTeams: $ref: '#/components/schemas/IdentityProvider/properties/orgs/items/properties/default_teams' description: type: string description: Description of Identity Provider encryptionAlgorithm: type: string description: Encryption algorithm which is used by the SAML Identity Provider for encryption of SAML documents, assertions or IDs. The corresponding decryption key for decrypt SAML document parts will be chosen based on this configured algorithm and is provided by Axway for the encryption (ENC) usage. If algorithm is not configured, then any supported algorithm is allowed and decryption key will be chosen based on the algorithm configured in SAML document itself. enum: - RSA-OAEP enforceMappedRoles: $ref: '#/components/schemas/IdentityProvider/properties/orgs/items/properties/enforce_mapped_roles' enforceMappedTeams: $ref: '#/components/schemas/IdentityProvider/properties/orgs/items/properties/enforce_mapped_teams' entityId: type: string description: The Entity ID that will be used to uniquely identify this SAML Service Provider forceAuthn: type: boolean description: Whether the IdP must authenticate the presenter directly rather than rely on a previous security context idpEntityId: type: string description: The Entity ID used to validate the Issuer for received SAML assertions. If empty, no Issuer validation is performed issuer: type: string description: The issuer identifier for the issuer of the response. If not provided, no validation will be performed. jwksUrl: type: string description: URL where identity provider keys in JWK format are stored jwtX509HeadersEnabled: type: boolean description: If enabled, the `x5t` (X.509 Certificate SHA-1 Thumbprint) header will be added to the JWT to reference the certificate used to sign it. Otherwise, the `kid` (Key ID) header will be used instead loginHint: type: boolean description: Whether to pass login_hint to the IdP default: true logoutUrl: type: string description: End session endpoint to use to logout user from the external IdP mappedRoles: $ref: '#/components/schemas/IdentityProvider/properties/orgs/items/properties/mapped_roles' mappedTeams: $ref: '#/components/schemas/IdentityProvider/properties/orgs/items/properties/mapped_teams' mapperAttrCountry: type: string description: Attribute to map to a user's country mapperAttrEmail: type: string description: Attribute to map to a user's email mapperAttrFirstname: type: string description: Attribute to map to a user's first name mapperAttrLastname: type: string description: Attribute to map to a user's last name mapperAttrPhone: type: string description: Attribute to map to a user's phone number mapperFriendlyCountry: type: string description: Friendly name of the attribute to map to a user's country mapperFriendlyEmail: type: string description: Friendly name of the attribute to map to a user's email mapperFriendlyFirstname: type: string description: Friendly name of the attribute to map to a user's first name mapperFriendlyLastname: type: string description: Friendly name of the attribute to map to a user's last name mapperFriendlyPhone: type: string description: Friendly name of the attribute to map to a user's phone number metadataDescriptorUrl: type: string description: External URL where the Identity Provider publishes the SAML Descriptor metadata information to source the X509 certificates used to validate signatures name: type: string description: Name of Identity Provider nameIDPolicyFormat: type: string description: Specifies the URI reference corresponding to a name identifier format enum: - urn:oasis:names:tc:SAML:2.0:nameid-format:persistent - urn:oasis:names:tc:SAML:2.0:nameid-format:transient - urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress - urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos - urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName - urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName - urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified pkceEnabled: type: boolean description: Use PKCE (Proof of Key-code exchange) for Identity Provider Brokering pkceMethod: type: string description: PKCE Method to use enum: - plain - S256 postBindingAuthnRequest: type: boolean description: Indicates whether the AuthnRequest must be sent using HTTP-POST binding postBindingLogout: type: boolean description: Indicates whether to respond to requests using HTTP-POST binding postBindingResponse: type: boolean description: Indicates whether to respond to requests using HTTP-POST binding providerId: type: string description: The protocol of the IdP enum: - oidc - saml provisionAdHoc: type: boolean description: Whether to automatically register users who authenticate using the Identity Provider that are not on an associated claimed email domain as members of the organization default: false publicKeySignatureVerifier: type: string description: The public key in PEM format that must be used to verify IdP signatures publicKeySignatureVerifierKeyId: type: string description: Explicit ID of the supplied validating public key restrictDomainUsers: type: boolean description: Whether to automatically restrict users provisioned via domain association to authenticate using the Identity Provider. sendClientIdOnLogout: type: boolean description: If the `client_id` parameter should be sent in logout requests sendIdTokenOnLogout: type: boolean description: If the `id_token_hint` parameter should be sent in logout requests signatureAlgorithm: type: string description: The signature algorithm to use to sign documents enum: - RSA_SHA256 - RSA_SHA256_MGF1 - RSA_SHA512 - RSA_SHA512_MGF1 signingCertificate: type: string description: The certificate in PEM format that must be used to check for signatures. Multiple certificates can be entered, separated by comma signSpMetadata: type: boolean description: Enable/disable signature of the provider SAML metadata singleLogoutServiceUrl: type: string description: The Url that must be used to send logout requests singleSignOnServiceUrl: type: string description: The Url that must be used to send authentication requests tokenUrl: type: string description: Token URL useJwksUrl: type: boolean description: If enabled, then identity provider public keys will be downloaded from given JWKS URL useMetadataDescriptorUrl: type: boolean description: Whether to use a configured Metadata Descriptor URL to source the X509 certificates used to validate signatures validateSignature: type: boolean description: Enable/disable signature validation of IdP signatures wantAssertionsEncrypted: type: boolean description: Whether to expect an encrypted assertion wantAssertionsSigned: type: boolean description: Whether to expect a signed assertion wantAuthnRequestsSigned: type: boolean description: Indicates whether the IdP expects a signed AuthnRequest xmlSigKeyInfoKeyNameTransformer: type: string description: Signing key to use in KeyName element enum: - NONE - KEY_ID - CERT_SUBJECT required: - providerId x-microcks-operation: delay: 0 dispatcher: FALLBACK /org/{org_id}/idp: parameters: [] get: summary: Axway Get All Organization IdPs description: "Returns all external IdPs configured for organization\n\n___Auth Requirement___\n - _All of_\n - `administrator`, or `auditor` access to the organization.\n - The organization entitlements allow `idp`. Allows unentitled access to an existing configuration.\n\n\n_Allows consumer organization access_\n" externalDocs: description: Managing Identity Providers url: https://docs.axway.com/bundle/platform-management/page/docs/management_guide/configuring_and_managing_identity_providers/index.html tags: - idp operationId: org_idpFind responses: '200': description: Response content: application/json: schema: allOf: - $ref: '#/components/schemas/Response' - properties: result: $ref: '#/components/schemas/IdentityProviderList' examples: OrgIdpfind200Example: summary: Default org_idpFind 200 response x-microcks-default: true value: example_value '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/Error' examples: FORBIDDEN: value: $ref: '#/components/examples/FORBIDDEN/value' NOT_FOUND: value: $ref: '#/components/examples/NOT_FOUND/value' IDP_REQUIRED: value: $ref: '#/components/examples/IDP_REQUIRED/value' USER_NOT_ADMIN: value: $ref: '#/components/examples/USER_NOT_ADMIN/value' LOGIN_REQUIRED: value: $ref: '#/components/examples/LOGIN_REQUIRED/value' PARAM_INVALID: value: $ref: '#/components/examples/PARAM_INVALID/value' PARAM_REQUIRED: value: $ref: '#/components/examples/PARAM_REQUIRED/value' security: - BearerClient: [] - SessionCookie: [] - BearerUser: [] parameters: - $ref: '#/components/parameters/fields' example: example_value - $ref: '#/components/parameters/exclude_fields' example: example_value - in: path name: org_id required: true schema: type: string description: '`guid` or `org_id` of the organization' example: 507f1f77bcf86cd799439011 x-microcks-operation: delay: 0 dispatcher: FALLBACK components: schemas: Response: type: object properties: success: type: boolean description: Whether the request was successful. example: true IdentityProvider: type: object required: - guid - name - protocol unevaluatedProperties: false allOf: - $ref: '#/components/schemas/DefaultFields' properties: _id: type: string description: Document ID of the Identity Provider. deprecated: true example: 507f1f77bcf86cd799439011 description: type: string description: Description of the Identity Provider. example: An example description guid: type: string format: uuid description: '`guid` of the Identity Provider.' example: example_value name: type: string description: Name of Identity Provider example: Example Name orgs: type: array description: Organizations associated to this Identity Provider and their user associations. default: [] items: type: object required: - guid - default_roles - default_teams - mapped_roles - mapped_teams additionalProperties: false properties: case_insensitive_mapped_roles: type: boolean description: Whether to match returned mapped attribute values to expected attribute values without letter case sensitivity. default_roles: type: array description: Array of role identifiers that are assigned to newly provisioned users in the Organization. items: type: string enum: - administrator - developer - auditor - consumer - usage_reporter - api_central_admin default_teams: type: array description: Array of teams to assign newly provisioned users in the Organization. default: [] items: type: object required: - guid - roles additionalProperties: false properties: guid: type: string format: uuid description: '`guid` of the team within the Organization the assign newly provisioned users.' roles: type: array description: Array of role identifiers that are assigned to newly provisioned users in the team. items: type: string enum: - consumer - subscription_admin - developer - catalog_manager - subscription_approver - api_access - insights - administrator - marketplace_admin enforce_mapped_roles: type: boolean description: Whether to restrict organization role management solely to mapped IdP attributes. Any organization role(s) that a user has that does not match to an associated mapper (or the Default Organization Roles) will be removed on subsequent sign in. enforce_mapped_teams: type: boolean description: Whether to restrict team membership and role management solely to mapped IdP attributes. Any team memberships or roles that a user has that does not match to an associated mapper will be removed on subsequent sign in. guid: type: string format: uuid description: '`guid` of the Organization the Identity Provider is associated to.' mapped_roles: type: array description: Array of role identifiers to assign users in the Organization based on attributes defined by the Identity Provider. default: [] items: type: object required: - value - roles additionalProperties: false properties: friendly: type: string description: Friendly name of the attribute provided by the SAML Identity Provider. name: type: string description: Name of the attribute provided by the Identity Provider. roles: type: array description: Array of role identifiers to be assigned to matching users in the Organization. items: type: string enum: - administrator - developer - auditor - consumer - usage_reporter - api_central_admin value: type: string description: Value of the named attribute to determine whether to apply the role. mapped_teams: type: array description: Array of teams to assign users in the Organization based on attributes defined by the Identity Provider. default: [] items: type: object required: - team_guid - value - roles additionalProperties: false properties: friendly: type: string description: Friendly name of the attribute provided by the SAML Identity Provider. name: type: string description: Name of the attribute provided by the Identity Provider. roles: type: array description: Array of role identifiers to be assigned to matching users in the team. items: type: string enum: - consumer - subscription_admin - developer - catalog_manager - subscription_approver - api_access - insights - administrator - marketplace_admin team_guid: type: string format: uuid description: '`guid` of the team within the Organization the assign matching users.' value: type: string description: Value of the named attribute to determine whether to apply the team association. provision_adhoc: type: boolean description: Whether to automatically register users who authenticate using the Identity Provider that are not on an associated claimed email domain as members of the organization. default: false restrict_domain_users: type: boolean description: Whether to automatically restrict users provisioned via domain association to authenticate using the Identity Provider. default: false example: - case_insensitive_mapped_roles: true default_roles: - administrator default_teams: - guid: example_value roles: - consumer enforce_mapped_roles: true enforce_mapped_teams: true guid: example_value mapped_roles: - friendly: example_value name: Example Name roles: - administrator value: example_value mapped_teams: - friendly: example_value name: Example Name roles: - consumer team_guid: example_value value: example_value provision_adhoc: true restrict_domain_users: true protocol: type: string description: Protocol the Identity Provider uses. enum: - oidc - saml example: oidc provider_guid: type: string example: example_value Error: type: object allOf: - $ref: '#/components/schemas/Response' - type: object properties: code: type: number description: HTTP status code. description: type: string description: A message describing the error. internalCode: type: number description: Internal code. DefaultFields: type: object unevaluatedProperties: false properties: created: type: string format: date-time description: Date created. readOnly: true example: '2026-04-21T00:00:00Z' created_by: type: object description: Creator user or client. readOnly: true properties: guid: type: string description: '`guid` of the creator.' type: type: string description: Type of the creator. enum: - user - client example: guid: example_value type: user updated: type: string format: date-time description: Date last updated. readOnly: true example: '2026-04-21T00:00:00Z' Provider: properties: guid: type: string description: Identifier of the provider marketplace instance. example: example_value IdentityProviderList: title: IdentityProviderList type: array description: A list of IdentityProvider objects. items: $ref: '#/components/schemas/IdentityProvider' examples: USER_NOT_ADMIN: value: success: false description: You are not authorized to perform this action. Please contact your organization administrator. code: 403 NOT_FOUND: value: success: false description: Resource Not Found code: 404 FORBIDDEN: value: success: false description: You do not have access privileges to view this content. code: 403 LOGIN_REQUIRED: value: success: false description: Sign-in Required code: 401 IDP_REQUIRED: value: success: false description: You must sign in using the Identity Provider configured by your organization's administrators to access this organization. code: 401 internalCode: 235 PARAM_REQUIRED: value: success: false description: '"%s" is a required parameter.' code: 400 internalCode: 77 PARAM_INVALID: value: success: false description: '"%s" contained an invalid value.' code: 400 internalCode: 74 parameters: fields: name: fields in: query description: A list of fields to include in the response. schema: type: array items: type: string exclude_fields: name: exclude_fields in: query description: A list of fields to exclude from the response. schema: type: array items: type: string securitySchemes: AuthToken: description: Auth token for internal services type: apiKey in: header name: x-auth-token BearerClient: description: Service account access token type: http scheme: bearer bearerFormat: jwt BearerService: description: Service account access token for an internal client type: http scheme: bearer bearerFormat: jwt BearerUser: description: AxwayID user session access token type: http scheme: bearer bearerFormat: jwt MFA: description: Multi-factor authentication code type: apiKey in: header name: x-auth-code OAuth2: type: oauth2 flows: clientCredentials: tokenUrl: https://login.axway.com/auth/realms/Broker/protocol/openid-connect/token scopes: {} authorizationCode: authorizationUrl: https://login.axway.com/auth/realms/Broker/openid-connect/auth tokenUrl: https://login.axway.com/auth/realms/Broker/openid-connect/token scopes: {} implicit: authorizationUrl: https://login.axway.com/auth/realms/Broker/openid-connect/auth scopes: {} Password: description: User password type: apiKey in: header name: x-auth-password SessionCookie: description: Platform session cookie type: apiKey in: cookie name: connect.sid