openapi: 3.0.1
info:
  title: Beyond Identity Secure Access Applications API
  version: 1.7.0
  contact:
    email: support@beyondidentity.com
  description: "# Introduction\n\n**NOTE:** To determine if you are accessing the Secure Access Platform, check the URL of your Admin Console.\nIf it looks like one of the following, you are using the Secure Access Platform:\n- `https://console.beyondidentity.com` (Localized to your region)\n- `https://console-us.beyondidentity.com` (US region)\n- `https://console-eu.beyondidentity.com` (EU region)\n- `https://console.us1.beyondidentity-gov.com` (US FedRAMP)\n\nIf your Admin Console URL does not look like one of the above, you are using the Secure Workforce Platform. Please refer to the [Secure Workforce API documentation](https://docs.beyondidentity.com/api/v0). <br /><br />\n\nThe Beyond Identity Secure Access API defines methods for managing resources in the Beyond Identity Secure Access platform.<br /><br />\n\nAll of the functionality available in the Beyond Identity Admin Console is\nalso available through the API. <br /><br />\n\nThis API is currently in the early-access stage and is under active\ndevelopment. Feedback and suggestions are encouraged and should be directed\nto the\n[Beyond Identity Developer Slack Channel](https://join.slack.com/t/byndid/shared_invite/zt-1anns8n83-NQX4JvW7coi9dksADxgeBQ).\n\n# Base API URLs\n\nThe base API URLs is determined by the region your tenant is hosted in OR if you are a FedRAMP customer. <br><br>\n\n### US Region\n\nIf you are a US region customer, your base API URLs will be:\n- `https://api-us.beyondidentity.com`\n- `https://auth-us.beyondidentity.com`\n\n### EU Region\n\nIf you are a EU region customer, your base API URLs will be:\n- `https://api-eu.beyondidentity.com`\n- `https://auth-eu.beyondidentity.com`\n\n### US FedRAMP\n\n**NOTE**: The FedRAMP version of Secure Access is released approximately *two weeks* after the commercial version, so some API endpoints may not be available immediately. <br><br>\n\nIf you are a FedRAMP customer in the US region, your base API URLs will be:\n- `https://api.us1.beyondidentity-gov.com`\n- `https://auth.us1.beyondidentity-gov.com`\n\nFor all the examples in this document, we will use the US region API base URL. You can always replace `https://api-us.beyondidentity.com`\nand `https://auth-us.beyondidentity.com` in the examples to use the proper base URL for your tenant.\n\n# Authentication\n\nAll Beyond Identity API endpoints require authentication using an access\ntoken. The access token is generated through OAuth 2.0 or OIDC, using the\nauthorization code flow or the client credentials flow. <br /><br />\n\nThe simplest way to acquire an access token is through the Beyond Identity Admin Console. Under the \"Applications\" tab, select the \"Beyond Identity Management API\" application, navigate to the \"API Tokens\" tab, and then click on \"Create token\". <br /><br />\n\nAlternatively, an access token may also be generated directly via the API by\nrequesting a token for the \"Beyond Identity Management API\" Application. <br><br>\n\n```\ncurl https://auth-us.beyondidentity.com/v1/tenants/$TENANT_ID/realms/$REALM_ID/applications/$APPLICATION_ID/token \\\n  -X POST \\\n  -u \"$CLIENT_ID:$CLIENT_SECRET\" --basic \\\n  -H \"Content-Type: application/x-www-form-urlencoded\" \\\n  -d \"grant_type=client_credentials&scope=$SCOPES\"\n```\n\nThis will work for any application that you have configured to provide\naccess to the Beyond Identity Management API Resource Server. The \"Beyond\nIdentity Management API\" application is provided by default as part of the\ntenant onboarding process.\n\nThe access token must be provided in the `Authorization` header of the\nAPI request. <br><br>\n\n```\ncurl https://api-us.beyondidentity.com/v1/... \\\n  -X $HTTP_METHOD -H \"Authorization: Bearer $TOKEN\"\n```\n\n## Requests and Responses\n\nTo interact with the Beyond Identity API, all requests should be made over\nHTTPS. <br /><br />\n\nThe Beyond Identity API is generally structured as a resource-oriented API.\nResources are represented as JSON objects and are used as both inputs to\nand outputs from API methods. <br /><br />\n\nResource fields may be described as read-only and immutable. A read-only\nfield is only provided on the response. An immutable field is only assigned\nonce and may not be changed after. For example, system-generated IDs are\ndescribed as both read-only and immutable. <br /><br />\n\nTo create a new resource, requests should use the `POST` method. Create\nrequests include all of the necessary attributes to create a new resource.\nCreate operations return the created resource in the response. <br /><br />\n\nTo retrieve a single resource or a collection of resources, requests should\nuse the `GET` method. When retrieving a collection of resources, the\nresponse will include an array of JSON objects keyed on the plural name of\nthe requested resource. <br /><br />\n\nTo update an resource, requests should use the `PATCH` method. Update\noperations support partial updating so requests may specify only the\nattributes which should be updated. Update operations return the updated\nresource in the response. <br /><br />\n\nTo delete a resource, requests should use the `DELETE` method. Note that\ndelete operations return an empty response instead of returning the\nresource in the response. <br /><br />\n\n### Example Response for a Realm\n\n```\n{\n  \"id\": \"a448fe493e02fa9f\",\n  \"tenant_id\": \"000168dc50bdce49\",\n  \"display_name\": \"Test Realm\",\n  \"create_time\": \"2022-06-22T21:46:08.930278Z\",\n  \"update_time\": \"2022-06-22T21:46:08.930278Z\"\n}\n```\n\n### Example Response for a Collection of Realms\n\n```\n{\n  \"realms\": [\n    {\n      \"id\": \"a448fe493e02fa9f\",\n      \"tenant_id\": \"000168dc50bdce49\",\n      \"display_name\": \"Test Realm\",\n      \"create_time\": \"2022-06-22T21:46:08.930278Z\",\n      \"update_time\": \"2022-06-22T21:46:08.930278Z\"\n    }\n  ],\n  \"total_size\": 1\n}\n```\n\n## HTTP Statuses\n\nThe API returns standard HTTP statuses and error codes.\n\nStatuses in the 200 range indicate that the request was successfully\nfulfilled and there were no errors. <br><br>\n\nStatuses in the 400 range indicate that there was an issue with the request\nthat may be addressed by the client. For example, client errors may\nindicate that the request was missing proper authorization or that the\nrequest was malformed. <br><br>\n\nStatuses in the 500 range indicate that the server encountered an internal\nissue and was unable to fulfill the request. <br><br>\n\nAll error responses include a JSON object with a `code` field and a\n`message` field. `code` contains a human-readable name for the HTTP status\ncode and `message` contains a high-level description of the error. The\nerror object may also contain additional error details which may be used by\nthe client to determine the exact cause of the error. Refer to each API\nmethod's examples to determine the specific error detail types supported\nfor that method. <br><br>\n\n### Invalid Access Token Example\n\nIf the provided access token is invalid, you will receive a 401 error.\nThis error indicates that the token is not recognized and was not generated\nby Beyond Identity. <br><br>\n\n```\nHTTP/1.1 401 Unauthorized\n{\n  \"code\": \"unauthorized\",\n  \"message\": \"unauthorized\"\n}\n```\n\n### Permission Denied Example\n\nIf the provided access token does not have access to the requested resource,\nyou will receive a 403 error. Access tokens are scoped at a minimum to your\ntenant. Any request for resources outside of your tenant will result in this\nerror. <br><br>\n\n```\nHTTP/1.1 403 Forbidden\n{\n  \"code\": \"forbidden\",\n  \"message\": \"forbidden\"\n}\n```\n\n### Missing Resource Example\n\nIf the requested resource does not exist, you will receive a 404 error. The\nspecific API method may return additional details about the missing\nresource. <br><br>\n\n```\nHTTP/1.1 404 Not Found\n{\n  \"code\": \"not_found\",\n  \"message\": \"group not found\"\n  \"details\": [\n    {\n      \"type\": \"ResourceInfo\",\n      \"resource_type\": \"Group\",\n      \"id\": \"4822738be6b7f658\",\n      \"description\": \"group not found\"\n    }\n  ],\n}\n```\n\n### Invalid Parameters Example\n\nIf the request body contains invalid parameters, you will receive a 400\nerror. The specific API method may return additional details about the\ninvalid parameter. <br><br>\n\n```\nHTTP/1.1 400 Bad Request\n{\n  \"code\": \"bad_request\",\n  \"message\": \"invalid parameters\"\n  \"details\": [\n    {\n      \"type\": \"FieldViolations\"\n      \"field_violations\": [\n        {\n          \"description\": \"missing\",\n          \"field\": \"group.display_name\"\n        }\n      ],\n    }\n  ],\n}\n```\n"
servers:
- url: https://api-us.beyondidentity.com
  description: US region API base URL
- url: https://api-eu.beyondidentity.com
  description: EU region API base URL
- url: https://api.us1.beyondidentity-gov.com/
  description: US FedRAMP API base URL
security:
- BearerAuth: []
tags:
- name: Applications
  description: 'An application represents a client application that uses Beyond Identity for authentication. This could be a native app, a single-page application, regular web application, or machine-to-machine application credentials.

    '
paths:
  /v1/tenants/{tenant_id}/realms/{realm_id}/applications:
    post:
      operationId: CreateApplication
      tags:
      - Applications
      summary: Create a New Application
      description: 'To create an application, send a POST request to `/v1/tenants/$TENANT_ID/realms/$REALM_ID/applications`. Values in the request body for read-only fields will be ignored.

        At present, there are only two supported protocol types for applications, `oauth2` and `oidc`.

        '
      security:
      - BearerAuth:
        - applications:create
      parameters:
      - $ref: '#/components/parameters/tenant_id'
      - $ref: '#/components/parameters/realm_id'
      requestBody:
        content:
          application/json:
            schema:
              title: Create Application Request
              description: Request for CreateApplication.
              type: object
              properties:
                application:
                  $ref: '#/components/schemas/Application'
              required:
              - application
            examples:
              Create Application:
                value:
                  application:
                    display_name: Pet Application
                    resource_server_id: 84db69f5-48a8-4c11-8cda-1bae3a73f07e
                    protocol_config:
                      type: oidc
                      allowed_scopes:
                      - pets:read
                      - pets:write
                      confidentiality: confidential
                      token_endpoint_auth_method: client_secret_post
                      grant_type:
                      - authorization_code
                      redirect_uris:
                      - https://auth.mypetapp.com/callback
                      token_configuration:
                        subject_field: id
                        expires_after: 86400
                        token_signing_algorithm: RS256
                      pkce: disabled
                      token_format: self_contained
      responses:
        '200':
          description: 'The response will be a JSON object containing the standard attributes associated with an application.

            '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Application'
              examples:
                Success:
                  value:
                    id: 38833c36-6f47-4992-9329-ea0a00915137
                    realm_id: caf2ff640497591a
                    tenant_id: 00011f1183c67b69
                    resource_server_id: 84db69f5-48a8-4c11-8cda-1bae3a73f07e
                    display_name: Pet Application
                    is_managed: false
                    protocol_config:
                      type: oidc
                      allowed_scopes:
                      - pets:read
                      - pets:write
                      client_id: AYYNcuOSpfqIf33JeegCzDIT
                      client_secret: wWD4mPzdsjms1LPekQSo0v9scOHLWy5wmMtKAR2JNhJPAKXv
                      confidentiality: confidential
                      token_endpoint_auth_method: client_secret_post
                      grant_type:
                      - authorization_code
                      redirect_uris:
                      - https://auth.mypetapp.com/callback
                      token_configuration:
                        subject_field: id
                        expires_after: 86400
                        token_signing_algorithm: RS256
                      pkce: disabled
                      token_format: self_contained
        '400':
          description: Bad request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Malformed Request:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D/patch/responses/400/content/application~1json/examples/Malformed%20Request'
                Invalid Parameters:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1applications/get/responses/400/content/application~1json/examples/Invalid%20Parameters'
        '401':
          description: Unauthorized.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Missing Authorization:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D/get/responses/401/content/application~1json/examples/Missing%20Authorization'
        '403':
          description: Forbidden.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Insufficient Authorization:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D/get/responses/403/content/application~1json/examples/Insufficient%20Authorization'
        '404':
          description: The resource was not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Realm Not Found:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1applications/get/responses/404/content/application~1json/examples/Realm%20Not%20Found'
        '500':
          description: Server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Internal Error:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D/get/responses/500/content/application~1json/examples/Internal%20Error'
    get:
      operationId: ListApplications
      tags:
      - Applications
      summary: List Applications for a Realm
      description: 'To list all applications for a realm, send a GET request to

        `/v1/tenants/$TENANT_ID/realms/$REALM_ID/applications`.


        The response will contain at most 100 items and may contain a page token to

        query the remaining items. If page size is not specified, the response will

        contain 100 items. There is no defined ordering of the list of applications

        in the response.  Note that the maximum and default page sizes are subject

        to change.


        When paginating, the page size is maintained by the page token but may be

        overridden on subsequent requests. The skip is not maintained by the page

        token and must be specified on each subsequent request.


        Page tokens expire after one week. Requests which specify an expired page

        token will result in undefined behavior.

        '
      security:
      - BearerAuth:
        - applications:read
      parameters:
      - $ref: '#/components/parameters/tenant_id'
      - $ref: '#/components/parameters/realm_id'
      - $ref: '#/components/parameters/page_size'
      - $ref: '#/components/parameters/page_token'
      responses:
        '200':
          description: 'The response will be a JSON object with keys for `applications` and `total_size`. `applications` will be set to an array of application objects, each of which contains the standard application attributes. `total_size` will be set to the total number of items matched by the list request. If there are more items to be returned by the requested query, the response will also contain a key called `next_page_token`.

            '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListApplicationsResponse'
              examples:
                Success:
                  value:
                    applications:
                    - id: 38833c36-6f47-4992-9329-ea0a00915137
                      realm_id: caf2ff640497591a
                      tenant_id: 00011f1183c67b69
                      resource_server_id: 84db69f5-48a8-4c11-8cda-1bae3a73f07e
                      display_name: Pet Application
                      is_managed: false
                      protocol_config:
                        type: oidc
                        allowed_scopes:
                        - pets:read
                        - pets:write
                        client_id: AYYNcuOSpfqIf33JeegCzDIT
                        client_secret: wWD4mPzdsjms1LPekQSo0v9scOHLWy5wmMtKAR2JNhJPAKXv
                        confidentiality: confidential
                        token_endpoint_auth_method: client_secret_post
                        grant_type:
                        - authorization_code
                        redirect_uris:
                        - https://auth.mypetapp.com/callback
                        token_configuration:
                          subject_field: id
                          expires_after: 86400
                          token_signing_algorithm: RS256
                        pkce: disabled
                        token_format: self_contained
                    total_size: 1
        '400':
          description: Bad request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Invalid Parameters:
                  value:
                    code: bad_request
                    message: invalid parameters
        '401':
          description: Unauthorized.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Missing Authorization:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D/get/responses/401/content/application~1json/examples/Missing%20Authorization'
        '403':
          description: Forbidden.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Insufficient Authorization:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D/get/responses/403/content/application~1json/examples/Insufficient%20Authorization'
        '404':
          description: The resource was not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Realm Not Found:
                  value:
                    code: not_found
                    message: The requested resource was not found.
        '500':
          description: Server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Internal Error:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D/get/responses/500/content/application~1json/examples/Internal%20Error'
  /v1/tenants/{tenant_id}/realms/{realm_id}/applications/{application_id}:
    get:
      operationId: GetApplication
      tags:
      - Applications
      summary: Retrieve an Existing Application
      description: 'To retrieve an existing application, send a GET request to `/v1/tenants/$TENANT_ID/realms/$REALM_ID/applications/$APPLICATION_ID`.

        '
      security:
      - BearerAuth:
        - applications:read
      parameters:
      - $ref: '#/components/parameters/tenant_id'
      - $ref: '#/components/parameters/realm_id'
      - $ref: '#/components/parameters/application_id'
      responses:
        '200':
          description: 'The response will be a JSON object containing the standard attributes associated with an application.

            '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Application'
              examples:
                Success:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1applications/post/responses/200/content/application~1json/examples/Success'
        '401':
          description: Unauthorized.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Missing Authorization:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D/get/responses/401/content/application~1json/examples/Missing%20Authorization'
        '403':
          description: Forbidden.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Insufficient Authorization:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D/get/responses/403/content/application~1json/examples/Insufficient%20Authorization'
        '404':
          description: The resource was not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Application Not Found:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1applications/get/responses/404/content/application~1json/examples/Realm%20Not%20Found'
        '500':
          description: Server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Internal Error:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D/get/responses/500/content/application~1json/examples/Internal%20Error'
    patch:
      operationId: UpdateApplication
      tags:
      - Applications
      summary: Patch an Application
      description: 'To update only specific attributes of an existing application, send a PATCH request to `/v1/tenants/$TENANT_ID/realms/$REALM_ID/applications/$APPLICATION_ID`. Values in the request body for immutable or read-only fields will be ignored. Fields that are omitted from the request body will be left unchanged.

        '
      security:
      - BearerAuth:
        - applications:update
      parameters:
      - $ref: '#/components/parameters/tenant_id'
      - $ref: '#/components/parameters/realm_id'
      - $ref: '#/components/parameters/application_id'
      requestBody:
        content:
          application/json:
            schema:
              title: Update Application Request
              description: Request for UpdateApplication.
              type: object
              properties:
                application:
                  $ref: '#/components/schemas/Application'
              required:
              - application
            examples:
              Update Display Name:
                value:
                  application:
                    display_name: Pet Application
      responses:
        '200':
          description: 'The response will be a JSON object containing the standard attributes associated with an application.

            '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Application'
              examples:
                Success:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1applications/post/responses/200/content/application~1json/examples/Success'
        '400':
          description: Bad request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Malformed Request:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D/patch/responses/400/content/application~1json/examples/Malformed%20Request'
                Invalid Parameters:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1applications/get/responses/400/content/application~1json/examples/Invalid%20Parameters'
        '401':
          description: Unauthorized.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Missing Authorization:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D/get/responses/401/content/application~1json/examples/Missing%20Authorization'
        '403':
          description: Forbidden.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Insufficient Authorization:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D/get/responses/403/content/application~1json/examples/Insufficient%20Authorization'
        '404':
          description: The resource was not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Application Not Found:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1applications/get/responses/404/content/application~1json/examples/Realm%20Not%20Found'
        '500':
          description: Server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Internal Error:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D/get/responses/500/content/application~1json/examples/Internal%20Error'
    delete:
      operationId: DeleteApplication
      tags:
      - Applications
      summary: Delete an Application
      description: 'To delete an application, send a DELETE request to `/v1/tenants/$TENANT_ID/realms/$REALM_ID/applications/$APPLICATION_ID`.

        A successful request will receive a 200 status code with no body in the response. This indicates that the request was processed successfully.

        '
      security:
      - BearerAuth:
        - applications:delete
      parameters:
      - $ref: '#/components/parameters/tenant_id'
      - $ref: '#/components/parameters/realm_id'
      - $ref: '#/components/parameters/application_id'
      responses:
        '200':
          description: The action was successful and the response body is empty.
        '401':
          description: Unauthorized.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Missing Authorization:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D/get/responses/401/content/application~1json/examples/Missing%20Authorization'
        '403':
          description: Forbidden.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Insufficient Authorization:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D/get/responses/403/content/application~1json/examples/Insufficient%20Authorization'
        '404':
          description: The resource was not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Application Not Found:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1applications/get/responses/404/content/application~1json/examples/Realm%20Not%20Found'
        '500':
          description: Server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Internal Error:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D/get/responses/500/content/application~1json/examples/Internal%20Error'
components:
  schemas:
    SsoConfigPayload:
      oneOf:
      - $ref: '#/components/schemas/SsoConfigBookmark'
      - $ref: '#/components/schemas/SsoConfigEntraIdExternalAuthMethod'
      - $ref: '#/components/schemas/SsoConfigGenericOidc'
      - $ref: '#/components/schemas/SsoConfigOidcIdp'
      - type: object
        required:
        - type
        - acs_url
        - override_recipient_and_destination
        - audience_url
        - default_relay_state
        - name_format
        - authentication_context
        - subject_user_name_attribute
        - sign_envelope
        - sign_assertions
        - signature_algorithm
        - digest_algorithm
        - encrypt_assertions
        - assertion_validity_duration_seconds
        - sp_signature_certificates
        - enable_single_log_out
        - validate_signed_requests
        - additional_user_attributes
        - single_logout_sign_request_and_response
        properties:
          type:
            type: string
            enum:
            - saml
          acs_url:
            description: 'Location where the SAML Response is sent via HTTP-POST. Often referred to as the SAML Assertion Consumer Service (ACS) URL.

              '
            type: string
            example: https://example.com/saml/acs
          override_recipient_and_destination:
            description: 'When this is true, the `recipient_url` and the `destination_url` are used for SAML Response.

              When this is false, both the `recipient_url` and the `destination_url` are omitted and the `acs_url` is used instead.

              '
            type: boolean
            example: true
          recipient_url:
            description: 'If `override_recipient_and_destination` is set to `true`, this field is utilized for the SAML Response. If it is `false`, this field is unused.

              The location where the application may present the SAML assertion. This is usually the same location as the Single Sign-On URL.

              '
            type: string
            example: https://example.com/saml/recipient
          destination_url:
            description: 'If `override_recipient_and_destination` is set to `true`, this field is utilized for the SAML Response. If it is `false`, this field is unused.

              Identifies the location where the SAML response is intended to be sent inside of the SAML assertion.

              '
            type: string
            example: https://example.com/saml/destination
          audience_url:
            description: 'The intended audience of the SAML assertion. Often referred to as the service provider Entity ID.

              '
            type: string
            example: https://example.com/saml/audience
          default_relay_state:
            description: 'Identifies a specific application resource in an IDP initiated Single Sign-On scenario. In most instances this is blank.

              '
            type: string
            example: defaultRelayState
          name_format:
            description: 'Name format of the assertion''s subject statement. Processing rules and constraints can be applied based on selection. Default value is "unspecified" unless SP explicitly requires differently.

              '
            type: string
            enum:
            - unspecified
            - email_address
            - x509_subject_name
            - persistent
            - transient
            - entity
            - kerberos
            - windows_domain_qualified_name
            example: unspecified
          authentication_context:
            description: 'The SAML Authentication Context Class for the assertion''s authentication statement. Default value is "X509".

              '
            type: string
            enum:
            - x509
            - integrated_windows_federation
            - kerberos
            - password
            - password_protected_transport
            - tls_client
            - unspecified
            - refeds_mfa
            example: x509
          subject_user_name_attribute:
            description: 'Determines the default value for a user''s application username. The application username will be used for the assertion''s subject statement.

              '
            type: string
            enum:
            - user_name
            - email
            - email_prefix
            - external_id
            - display_name
            - custom
            - none
            example: user_name
          sign_envelope:
            description: 'Determines whether the SAML authentication response message is digitally signed by the IdP or not. A digital signature is required to ensure that only your IdP generated the response message.

              '
            type: boolean
            example: true
          sign_assertions:
            description: All of the assertions should be signed by the IdP.
            type: boolean
            example: true
          signature_algorithm:
            description: 'The algorithm used for signing the SAML assertions.

              '
            type: string
            enum:
            - rsa_sha256
            - rsa_sha1
            - rsa_sha384
            - rsa_sha512
            example: rsa_sha256
          digest_algorithm:
            description: 'The algorithm used to encrypt the SAML assertion.

              '
            type: string
            enum:
            - sha256
            - sha1
            - sha384
            - sha512
            example: sha256
          encrypt_assertions:
            description: 'This is the flag that determines if the SAML assertion is encrypted. If this flag is set to `true`, there **MUST** be a SAML encryption certificate uploaded.

              Encryption ensures that nobody but the sender and receiver can understand the assertion.

              '
            type: boolean
            example: false
          assertion_validity_duration_seconds:
            description: 'The amount of time SAML assertions are valid for in seconds.

              '
            type: integer
            format: int32
            example: 300
          assertion_encryption_algorithm:
            description: 'The algorithm used for the digest in SAML assertions.

              '
            type: string
            enum:
            - aes256_cbc
            - aes256_gcm
            - aes128_cbc
            - aes128_gcm
            example: aes256_cbc
          assertion_key_transport_algorithm:
            description: 'The algorithm used for key transport in SAML assertions.

              '
            type: string
            enum:
            - rsa_oaep
            - rsa1_5
            example: rsa_oaep
          assertion_encryption_public_key:
            description: 'The public key used to encrypt the SAML assertion. This is required if `encrypt_assertions` is true.

              '
            type: string
            example: '-----BEGIN PUBLIC KEY-----


              MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr3Q4ebLzciJlVf4QDQ2u

              0Y2CfX9z4rMdG6MQSDW2NFQF0kM16Zzsz0p2gMOnp7YOz8OZqkU2XgUN3kQ8zC1h

              q+um2mU5K45f9Idoq8gE7/kmlZG1zS1mrDS36lM5Sc+E5hVgXJkNw3kEJ7OnhHHu

              ZG0EvTlGjqntCGXxrpX5sS1a9z7HeemEos6Xlw8I8Q8txJTeHgkRmZkMy5ndRbWa

              sMyV8A1tk0Z5bLpoZBxn8Hh/M4v8HkV8O7lH91kB9D+4O+CZ4WcG4Fj8UOJW5m1M

              nsCfYvzpEzeLoB2xD3CEmonGzZC+Ij1ZhrWu5V6mnmx6dzUMjOZchRQtfnJZzQ1U

              2QIDAQAB

              -----END PUBLIC KEY-----

              '
          sp_signature_certificates:
            $ref: '#/components/schemas/SsoConfigSamlPartialUpdate/properties/sp_signature_certificates/items'
          enable_single_log_out:
            description: 'Enables single logout. Single Logout (SLO) is a feature that allows users to be logged out from multiple service providers (SPs) and the identity provider (IdP) with a single logout action.

              '
            type: boolean
            example: false
          single_log_out_url:
            description: 'The location where the single logout response will be sent.

              This is only enabled if `enable_single_log_out` is true.

              '
            type: string
            example: https://example.com/saml/logout
          single_log_out_issuer_url:
            description: 'The issuer ID for the service provider when handling a Single Logout.

              This is only enabled if `enable_single_log_out` is true.

              '
            type: string
            example: https://example.com/saml/issuer
          single_log_out_binding:
            description: 'The SAML binding used for SAML messages.

              '
            type: string
            enum:
            - post
            - redirect
            example: post
          single_logout_sign_request_and_response:
            description: 'If enabled, Single Logout requests must bbe signed and Single Logout responses will also be signed.

              '
            type: boolean
            example: false
          validate_signed_requests:
            description: 'Select this to validate all SAML requests using the SP Signature Certificate.

              '
            type: boolean
            example: true
          other_sso_urls:
            type: object
            description: 'For use with SP-initiated sign-in flows. Enter the ACS URLs for any other requestable SSO nodes used by your app integration. This option enables applications to choose where to send the SAML Response. Specify a URL and an index that uniquely identifies each ACS URL endpoint.

              Some SAML AuthnRequest messages don''t specify an index or URL. In these cases, the SAML Response is sent to the ACS specified in the Single sign on URL field.

              When you enable Signed Requests, Beyond Identity deletes any previously defined static SSO URLs and reads the SSO URLs from the signed SAML request instead. You can''t have both static SSO URLs and dynamic SSO URLs.

              This can only be set if `validate_signed_requests` is set to false.

              '
            required:
            - index
            - url
            properties:
              index:
                description: The index that this URL may be referenced by.
                type: integer
                format: int16
                example: 1
              url:
                description: 'This is a URL that may be used to replace the ACS URL.

                  '
                type: string
                example: https://example.com/saml/acs1
          additional_user_attributes:
            description: 'This structure describes additional attributes that can be attached to SAML assertion.

              '
            type: array
            items:
              type: object
              required:
              - name
              - name_format
              - value
              properties:
                name:
                  description: The SAML attribute name.
                  type: string
                  example: firstName
                name_format:
                  $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/name_format'
                value:
                  description: The value to attach to the SAML value.
                  $ref: '#/components/schemas/SsoConfigSamlPartialUpdate/properties/additional_user_attributes/items'
                custom_value:
                  description: 'The custom static string value when value is set to `custom_static_string`.

                    '
                  type: string
                  example: customString
          identity_provider_certs:
            description: 'The X509 certificates of the identity provider (Beyond Identity). These are the certificates that is in our IDP metadata, and that the upstream services use to validate our SAML assertion.

              '
            type: array
            readOnly: true
            items:
              type: object
              description: 'The BI Identity Provider Certificate for this SAML connection.

                '
              required:
              - id
              - created_at
              - expires_at
              - is_active
              - idp_public_certificate
              properties:
                id:
                  description: The id of the certificate.
                  type: string
                  example: 3cb717d1-88ff-440a-b5ee-86c00ce63dbf
                created_at:
                  description: Timestamp of when the certificate was created.
                  type: string
                  format: date-time
                  example: '2022-05-12T20:29:47.636Z'
                expires_at:
                  description: Timestamp of when the certificate expires.
                  type: string
                  format: date-time
                  example: '2022-05-12T20:29:47.636Z'
                is_active:
                  description: Indicates whether the certificate is active.
                  type: boolean
                  example: true
                idp_public_certificate:
                  description: 'Beyond Identity''s public signing key wrapped in a certificate.

                    Stored as a base64 encoded DER format.

                    '
                  type: string
                  example: '-----BEGIN CERTIFICATE-----


                    MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr3Q4ebLzciJlVf4QDQ2u

                    0Y2CfX9z4rMdG6MQSDW2NFQF0kM16Zzsz0p2gMOnp7YOz8OZqkU2XgUN3kQ8zC1h

                    q+um2mU5K45f9Idoq8gE7/kmlZG1zS1mrDS36lM5Sc+E5hVgXJkNw3kEJ7OnhHHu

                    ZG0EvTlGjqntCGXxrpX5sS1a9z7HeemEos6Xlw8I8Q8txJTeHgkRmZkMy5ndRbWa

                    sMyV8A1tk0Z5bLpoZBxn8Hh/M4v8HkV8O7lH91kB9D+4O+CZ4WcG4Fj8UOJW5m1M

                    nsCfYvzpEzeLoB2xD3CEmonGzZC+Ij1ZhrWu5V6mnmx6dzUMjOZchRQtfnJZzQ1U

                    2QIDAQAB

                    -----END CERTIFICATE-----

                    '
          use_short_url:
            default: false
            type: boolean
            description: Changes the EntityID in the SAML response to a shorter version. This is to support applications with URL restrictions.
      - type: object
        required:
        - type
        - client_id
        - identifying_claim_name
        - identity_attribute
        - okta_domain
        properties:
          type:
            $ref: '#/components/schemas/SsoConfigType'
          client_id:
            description: The client ID for the idp application.
            type: string
          client_secret:
            description: The client secret to authenticate as the idp application.
            type: string
            nullable: true
          pkce:
            default: null
            allOf:
            - $ref: '#/components/schemas/PkceConfig'
          id_token_scopes:
            default: null
            type: array
            items:
              type: string
          identifying_claim_name:
            type: string
          identity_attribute:
            $ref: '#/components/schemas/SubjectField'
          okta_domain:
            type: string
          inbound_scim:
            default: null
            type: object
      - $ref: '#/components/schemas/SsoConfigOktaBiIdp'
      - $ref: '#/components/schemas/SsoConfigRealityCheck'
      - $ref: '#/components/schemas/SsoConfigWsFed'
    SsoConfigSamlPartialUpdate:
      type: object
      required:
      - type
      properties:
        type:
          $ref: '#/components/schemas/SsoConfigType'
        acs_url:
          description: 'Location where the SAML Response is sent via HTTP-POST. Often referred

            to as the SAML Assertion Consumer Service (ACS) URL.

            '
          type: string
        override_recipient_and_destination:
          description: 'When this is true, the `recipient_url` and the `destination_url` are

            used for SAML Response.


            When this is false, both the `recipient_url` and the `destination_url`

            are omitted and the acs_url is used instead.

            '
          type: boolean
        recipient_url:
          description: 'If `override_recipient_and_destination` is set to true, this field is

            utilized for the SAML Response. If it is false, this field is unused.


            The location where the application can present the SAML assertion. This

            is usually the Single Sign-On (SSO) URL.

            '
          type: string
        destination_url:
          description: 'If `override_recipient_and_destination` is set to true, this field is

            utilized for the SAML Response. If it is false, this field is unused.


            The location to send the SAML Response, as defined in the SAML

            assertion.

            '
          type: string
        audience_url:
          description: 'The intended audience of the SAML assertion. Often referred to as the

            service provider Entity ID.

            '
          type: string
        default_relay_state:
          description: 'Identifies a specific application resource in an IDP initiated Single

            Sign-On scenario. In most instances this is blank.

            '
          type: string
        name_format:
          description: The format of the SAML NameID.
          $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/name_format'
        authentication_context:
          description: The context for SAML authentication.
          $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/authentication_context'
        subject_user_name_attribute:
          description: The attribute to use for the subject's username.
          $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/subject_user_name_attribute'
        sign_envelope:
          description: 'Determines whether the SAML authentication response message is digitally

            signed by the IdP or not. A digital signature is required to ensure that

            only your IdP generated the response message.

            '
          type: boolean
        sign_assertions:
          description: All of the assertions are signed by the IdP.
          type: boolean
        signature_algorithm:
          description: The algorithm used for signing the SAML assertions.
          $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/signature_algorithm'
        digest_algorithm:
          description: The algorithm used for the digest in SAML assertions.
          $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/digest_algorithm'
        encrypt_assertions:
          description: 'This is the flag that determines if the SAML assertion is encrypted.

            If this flag is set to `true`, there MUST be a SAML encryption certificate

            uploaded.


            Determines whether the SAML assertion is encrypted or not. Encryption

            ensures that nobody but the sender and receiver can understand the

            assertion.

            '
          type: boolean
        assertion_validity_duration_seconds:
          description: 'The amount of time assertions are valid for in seconds.

            '
          type: integer
          format: int32
        assertion_encryption_algorithm:
          description: The algorithm used to encrypt the SAML assertion.
          $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/assertion_encryption_algorithm'
        assertion_key_transport_algorithm:
          description: The algorithm used for key transport in SAML assertions.
          $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/assertion_key_transport_algorithm'
        assertion_encryption_public_key:
          description: 'The public key used to encrypt the SAML assertion. This is required

            if `encrypt_assertions` is true.

            '
          type: string
        sp_signature_certificates:
          description: 'The PEM encoded X509 key certificate of the Service Provider

            used to verify SAML AuthnRequests.

            '
          type: array
          items:
            description: 'The PEM encoded X509 key certificate of the Service Provider used to verify SAML AuthnRequests.

              '
            type: array
            items:
              type: object
              required:
              - sp_public_signing_key
              properties:
                sp_public_signing_key:
                  type: string
            example:
            - '-----BEGIN CERTIFICATE-----


              MIIDdzCCAl+gAwIBAgIEbF2LTTANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJV

              UzELMAkGA1UECBMCQ0ExFTATBgNVBAcTDFNhbiBGcmFuY2lzY28xEjAQBgNVBAoT

              CU9rdGEsIEluYy4xHzAdBgNVBAMTFm9rdGEuZXhhbXBsZS5jb20gQ0EgUm9vdDAe

              Fw0yMDA2MTkwMDAwMDBaFw0yMTA2MTkyMzU5NTlaMG0xCzAJBgNVBAYTAlVTMQsw

              CQYDVQQIEwJDQTEVMBMGA1UEBxMMU2FuIEZyYW5jaXNjbzESMBAGA1UEChMJb2t0

              Pbg6vGfJnxYYibTwLlXhgxl0tT+NMQFZ5GQslLh2sB3AWBzjZtFzFS7lDi0n4Fz5

              y9x6U1hUS54fScJmSVSTT9v/qAD0ccjvlPj3M6PENq2X7TwrOqSTgx5TPOpA5Myl

              MtwPbU3wn/pA5Cp9kWvlYbBfTS4Hx14FQyg3GAAkMrzrhKhpIfhz6iH0H8kDxFId

              6KjXy4TvoUM/tH7c6v2HS6D4TD7TfYOv/8A7E1Lj6WKwjtghTAh3Rb5tbyxRBcw

              gg==

              -----END CERTIFICATE-----

              '
        enable_single_log_out:
          description: Enable single logout.
          type: boolean
        single_log_out_url:
          description: 'The location where the logout response will be sent.

            Only enabled if `enable_single_log_out` is true.

            '
          type: string
        single_log_out_issuer_url:
          description: 'The issuer ID for the service provider. When handling a Single Log Out.


            Only enabled if `enable_single_log_out` is true.

            '
          type: string
        single_log_out_binding:
          description: The binding used for single logout messages.
          $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/single_log_out_binding'
        single_logout_sign_request_and_response:
          description: 'If we should expect the LogoutRequest to be signed and if we

            should sign the LogoutResponse.

            '
          type: boolean
        validate_signed_requests:
          description: 'Select this to validate all SAML requests using the Signature

            Certificate. The payload from the SAML request is validated, and Okta

            dynamically reads any single sign-on (SSO) URLs from the request. This

            checkbox appears after you upload a Signature Certificate.


            When Signed Requests is enabled, the SAML Request must include a

            NameIDPolicy.

            '
          type: boolean
        other_sso_urls:
          description: 'For use with SP-initiated sign-in flows. Enter the ACS URLs for any

            other requestable SSO nodes used by your app integration. This option

            enables applications to choose where to send the SAML Response. Specify

            a URL and an index that uniquely identifies each ACS URL endpoint.


            Some SAML AuthnRequest messages don''t specify an index or URL. In these

            cases, the SAML Response is sent to the ACS specified in the Single sign

            on URL field.


            When you enable Signed Requests, Okta deletes any previously defined

            static SSO URLs and reads the SSO URLs from the signed SAML request

            instead. You can''t have both static SSO URLs and dynamic SSO URLs.


            This can only be set if validate_signed_requests is set to false.

            '
          type: object
          required:
          - index
          - url
          properties:
            index:
              description: The index that this URL may be referenced by.
              type: integer
              format: int16
            url:
              description: 'This is a URL that may be used to replace the ACS URL.

                '
              type: string
        additional_user_attributes:
          description: Any additional attributes to attach to the SAML assertion.
          type: array
          items:
            description: 'The value of the SAML attribute. It will correspond to a directory attribute of the user.

              '
            type: string
            enum:
            - email
            - user_name
            - external_id
            - display_name
            - custom_static_string
            example: email
        icon:
          description: The URL or data URI of the icon representing the SSO configuration.
          type: string
        is_tile_visible:
          description: Indicates if the SSO configuration tile is visible to the user.
          type: boolean
        inbound_scim:
          default: null
          type: object
        use_short_url:
          default: false
          type: boolean
          description: Changes the EntityID in the SAML response to a shorter version. This is to support applications with URL restrictions.
    Application:
      title: Application
      type: object
      description: 'An application represents a client application that uses Beyond Identity for authentication. This could be a native app, a single-page application, regular web application, or machine-to-machine application credentials.

        '
      properties:
        id:
          type: string
          description: 'A unique identifier for an application. This is automatically generated on creation. This field is immutable and read-only. This field is unique within the realm.

            '
          readOnly: true
          example: 38833c36-6f47-4992-9329-ea0a00915137
        realm_id:
          type: string
          description: 'A unique identifier for the application''s realm. This is automatically set on creation. This field is immutable and read-only.

            '
          readOnly: true
          example: caf2ff640497591a
        tenant_id:
          type: string
          description: 'A unique identifier for the application''s tenant. This is automatically set on creation. This field is immutable and read-only.

            '
          readOnly: true
          example: 00011f1183c67b69
        resource_server_id:
          type: string
          description: 'A unique identifier for the application''s resource server. At present, the only available resource server is for the Beyond Identity Management API. Referencing this resource server from an application will allow that application to grant access to Beyond Identity''s APIs. When not present, this application may provide authentication (identity) but not authorization (access).

            '
          example: 84db69f5-48a8-4c11-8cda-1bae3a73f07e
        authenticator_config_id:
          type: string
          description: 'A unique identifier for the application''s authenticator configuration. This field is unused for `oidc` and `oauth2` applications when `grant_type=client_credentials`.

            '
          example: 73731b7f-eb76-4143-9b4b-81a720385f5a
        display_name:
          type: string
          description: 'A human-readable name for the application. This name is used for display purposes.

            '
          example: Pet Application
        is_managed:
          type: boolean
          description: 'A boolean indicating whether the application is managed by Beyond Identity. Managed applications may not be modified by the user. This is automatically set on creation. This field is immutable and read-only.

            '
          readOnly: true
          example: false
        protocol_config:
          description: Represents an application protocol configuration.
          oneOf:
          - title: OAuth 2.0
            description: OAuth2 protocol configuration.
            type: object
            required:
            - type
            properties:
              type:
                type: string
                enum:
                - oauth2
              allowed_scopes:
                type: array
                items:
                  type: string
                  example: pets:read
                description: 'Scopes to which this application can grant access. If this application references a resource server, this set of scopes must be a subset of the resource server''s available scopes. If this application does not reference a resource server, then this application can only be used for authentication and thereby `scopes` must necessarily be empty.

                  '
              client_id:
                type: string
                description: 'The client ID for this application. This is automatically set on creation. This field is output-only.

                  '
                readOnly: true
                example: AYYNcuOSpfqIf33JeegCzDIT
              client_secret:
                type: string
                description: 'The client secret to authenticate as this application; typically, as a Basic Authorization header. This is automatically set on creation. This field is output-only. This field is present only when confidentiality is `confidential`.

                  '
                readOnly: true
                example: wWD4mPzdsjms1LPekQSo0v9scOHLWy5wmMtKAR2JNhJPAKXv
              confidentiality:
                $ref: '#/components/schemas/Confidentiality'
              token_endpoint_auth_method:
                $ref: '#/components/schemas/TokenEndpointAuthMethod'
              grant_type:
                $ref: '#/components/schemas/GrantType'
              redirect_uris:
                type: array
                items:
                  type: string
                  example: https://auth.mypetapp.com/callback
                description: 'A list of valid URIs to redirect the resource owner''s user-agent to after completing its interaction with the authorization server. See https://datatracker.ietf.org/doc/html/rfc6749#section-3.1.2 for more information.

                  '
              token_configuration:
                $ref: '#/components/schemas/TokenConfiguration'
              pkce:
                $ref: '#/components/schemas/PkceConfig'
              token_format:
                description: "Allowed access token formats for this application.\ntoken type. Allowable values are:\n- `self_contained`: token in JWT format.\n- `referential`: Encoded token which requires /introspect\n   call in order to retrieve token claims.\n"
                type: string
                enum:
                - self_contained
                - referential
                example: self_contained
                default: self_contained
          - title: OIDC
            description: OIDC protocol configuration.
            type: object
            required:
            - type
            properties:
              type:
                type: string
                enum:
                - oidc
              allowed_scopes:
                type: array
                items:
                  type: string
                  example: pets:read
                description: 'Scopes to which this application can grant access. If this application references a resource server, this set of scopes must be a subset of the resource server''s available scopes. If this application does not reference a resource server, then this application can only be used for authentication and thereby `scopes` must necessarily be empty. Note that OIDC requests may accept OpenID Connect standard scopes as well as resource server scopes, but the OpenID Connect scopes should not be defined on the application itself. Currently, the only OpenID Connect supported scope is `openid`.

                  '
              client_id:
                type: string
                description: 'The client ID for this application. This is automatically set on creation. This field is output-only.

                  '
                readOnly: true
                example: AYYNcuOSpfqIf33JeegCzDIT
              client_secret:
                type: string
                description: 'The client secret to authenticate as this application; typically, as a Basic Authorization header. This is automatically set on creation. This field is output-only. This field is present only when confidentiality is `confidential`.

                  '
                readOnly: true
                example: wWD4mPzdsjms1LPekQSo0v9scOHLWy5wmMtKAR2JNhJPAKXv
              confidentiality:
                $ref: '#/components/schemas/Confidentiality'
              token_endpoint_auth_method:
                $ref: '#/components/schemas/TokenEndpointAuthMethod'
              grant_type:
                $ref: '#/components/schemas/GrantType'
              redirect_uris:
                type: array
                items:
                  type: string
                  example: https://auth.mypetapp.com/callback
                description: 'A list of valid URIs to redirect the resource owner''s user-agent to after completing its interaction with the authorization server. See https://datatracker.ietf.org/doc/html/rfc6749#section-3.1.2 for more information.

                  '
              token_configuration:
                $ref: '#/components/schemas/TokenConfiguration'
              pkce:
                $ref: '#/components/schemas/PkceConfig'
              token_format:
                $ref: '#/components/schemas/Application/properties/protocol_config/oneOf/0/properties/token_format'
          - $ref: '#/components/schemas/SsoConfigPayload/oneOf/4'
    ErrorDetail:
      title: Error Detail
      description: 'Additional details for errors designed to support client applications.

        '
      type: object
      discriminator:
        propertyName: type
      properties:
        type:
          type: string
          description: Type of the error detail.
      required:
      - type
    Error:
      type: object
      properties:
        code:
          type: string
          description: 'Human-readable HTTP status code name, stylized as lower snake case (e.g. bad_request).

            '
        message:
          type: string
          description: 'Human-readable message describing the error.

            '
        details:
          type: array
          items:
            $ref: '#/components/schemas/ErrorDetail'
      required:
      - code
      - message
    GrantType:
      type: array
      items:
        type: string
        enum:
        - authorization_code
        - client_credentials
        example: authorization_code
      description: "Grant types supported by this application's `token` endpoint. Allowable values\nare:\n- `authorization_code`: The authorization code grant type defined\n  in OAuth 2.0, Section 4.1. Namely, the client may authorize to the\n  `token` endpoint with a grant code which it obtains via the `authorize`\n  endpoint.\n- `client_credentials`: The client credentials grant type defined\n  in OAuth 2.0, Section 4.4. Namely, the client may authorize to the\n  `token` endpoint with a client credentials tuple of `client_id` and\n  `client_secret`.\n"
    PkceConfig:
      type: string
      enum:
      - disabled
      - plain
      - s256
      description: "PKCE code challenge methods supported for applications, as defined by\n[RFC-7636](https://datatracker.ietf.org/doc/html/rfc7636). Allowable values are:\n  - `disabled` : PKCE is disabled for this application. This is the default state if\n    the `pkce` field is left blank. Please note that public OIDC and OAuth2 configured\n    applications MUST enable PKCE support. Confidential clients can leave PKCE disabled\n    if they choose.\n  - `plain` : PKCE is enabled for this application. The server will correlate the `code_challenge` and\n    `code_verifier` between the `authorize` and `token` requests. In this configuration, those fields are\n    required to be identical. This is the lower security option for PKCE support and should only be used\n    by legacy clients, or clients that don't support `s256`.\n  - `s256` : PKCE is enabled for this application, and the server will correlate the `code_challenge` and\n    `code_verifier` between the `authorize` and `token` requests. In this configuration, those fields are\n    required to equate as follows: `code_challenge` = `base64url(sha256(ascii(code_verifier)))`. This is\n    the higher security option and should always be preferred if it is supported by the client.\n"
      example: s256
    TokenConfiguration:
      description: Properties of a token issued for an application.
      type: object
      required:
      - expires_after
      properties:
        expires_after:
          type: integer
          format: uint32
          description: 'Time after minting, in seconds, for which the token will be considered valid.

            '
          minimum: 0
          example: 86400
        token_signing_algorithm:
          type: string
          enum:
          - RS256
          description: 'Signing algorithm to use for an application token. The only allowable value at present is `RS256`.

            '
          default: RS256
          example: RS256
        subject_field:
          type: string
          enum:
          - id
          - email
          - username
          description: 'Property of a principal which is used to fill the subject of a token issued for this application.

            '
          default: id
          example: id
    ListApplicationsResponse:
      title: List Applications Response
      description: Response for ListApplications.
      type: object
      properties:
        applications:
          type: array
          items:
            $ref: '#/components/schemas/Application'
          maxItems: 100
          description: 'An unordered array of applications corresponding to the request.

            '
        total_size:
          type: integer
          format: uint32
          description: 'Total number of results returned by the operation. This value may be larger than the number of resources returned, such as when returning a single page where multiple pages are available.

            '
          example: 1000
        next_page_token:
          type: string
          description: 'Token used to fetch the next set of results. If this field is omitted, there are no subsequent pages.

            '
      required:
      - applications
      - total_size
    TokenEndpointAuthMethod:
      description: "Indicator of the requested authentication method for the token endpoint.\nAllowable values are: - `client_secret_post`: The client uses the HTTP POST\nparameters\n   as defined in OAuth 2.0, Section 2.3.1. Namely, `client_id`\n   and `client_secret` are sent in the body of the POST request.\n- `client_secret_basic`: The client uses HTTP Basic as defined in\n   OAuth 2.0, Section 2.3.1. Namely, `client_id` and `client_secret`\n   are sent in the Basic Authorization header.\n- `none`: The `client_secret` is not part of the request body and there is no\nauthorization header.\n   This endpoint authentication method is only allowed if the application has\n`confidentiality` set to `confidential`.\n\nDeprecation Notice: This field is deprecated. The API will ignore the value\nof this field in requests. In responses, confidential applications will\nalways have `client_secret_basic` and public applications will always have\n`none`. On authentication, confidential applications may use both\n`client_secret_post` and `client_secret_basic`. Public applications may only\nuse `none`. **This field is scheduled for removal on August 1, 2023**\n"
      type: string
      deprecated: true
      enum:
      - client_secret_basic
      - client_secret_post
      - none
      example: client_secret_basic
    Confidentiality:
      description: "The confidentiality of the client, as prescribed by OAuth 2.0 and\nOIDC. Confidentiality is based on a client's ability to authenticate\nsecurely with the authorization server (i.e., ability to\nmaintain the confidentiality of their client credentials). Allowable\nvalues are:\n- `confidential`: Clients capable of maintaining the confidentiality\n  of their credentials (e.g., client implemented on a secure server with\n  restricted access to the client credentials), or capable of secure\n  client authentication using other means.\n- `public`: Clients incapable of maintaining the confidentiality of their\n  credentials (e.g., clients executing on the device used by the\n  resource owner, such as an installed native application or a web\n  browser-based application), and incapable of secure client\n  authentication via any other means.\n"
      type: string
      enum:
      - confidential
      - public
      example: confidential
  parameters:
    realm_id:
      name: realm_id
      in: path
      description: A unique identifier for a realm.
      required: true
      schema:
        type: string
        example: 19a95130480dfa79
    page_size:
      name: page_size
      in: query
      description: 'Number of items returned per page. The response will include at most this many results but may include fewer. If this value is omitted, the response will return the default number of results allowed by the method.

        '
      schema:
        type: integer
        format: uint32
        minimum: 0
    page_token:
      name: page_token
      in: query
      description: 'Token to retrieve the subsequent page of the previous request. All other parameters to the list endpoint should match the original request that provided this token unless otherwise specified.

        '
      schema:
        type: string
    application_id:
      name: application_id
      in: path
      description: A unique identifier for an application.
      required: true
      schema:
        type: string
        example: 38833c36-6f47-4992-9329-ea0a00915137
    tenant_id:
      name: tenant_id
      in: path
      description: A unique identifier for a tenant.
      required: true
      schema:
        type: string
        example: 000176d94fd7b4d1
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: 'See the [Authentication](#section/Authentication) section for details.

        '