openapi: 3.0.1
info:
  title: Beyond Identity Secure Access Applications Credential Binding Jobs API
  version: 1.7.0
  contact:
    email: support@beyondidentity.com
  description: "# Introduction\n\n**NOTE:** To determine if you are accessing the Secure Access Platform, check the URL of your Admin Console.\nIf it looks like one of the following, you are using the Secure Access Platform:\n- `https://console.beyondidentity.com` (Localized to your region)\n- `https://console-us.beyondidentity.com` (US region)\n- `https://console-eu.beyondidentity.com` (EU region)\n- `https://console.us1.beyondidentity-gov.com` (US FedRAMP)\n\nIf your Admin Console URL does not look like one of the above, you are using the Secure Workforce Platform. Please refer to the [Secure Workforce API documentation](https://docs.beyondidentity.com/api/v0). <br /><br />\n\nThe Beyond Identity Secure Access API defines methods for managing resources in the Beyond Identity Secure Access platform.<br /><br />\n\nAll of the functionality available in the Beyond Identity Admin Console is\nalso available through the API. <br /><br />\n\nThis API is currently in the early-access stage and is under active\ndevelopment. Feedback and suggestions are encouraged and should be directed\nto the\n[Beyond Identity Developer Slack Channel](https://join.slack.com/t/byndid/shared_invite/zt-1anns8n83-NQX4JvW7coi9dksADxgeBQ).\n\n# Base API URLs\n\nThe base API URLs is determined by the region your tenant is hosted in OR if you are a FedRAMP customer. <br><br>\n\n### US Region\n\nIf you are a US region customer, your base API URLs will be:\n- `https://api-us.beyondidentity.com`\n- `https://auth-us.beyondidentity.com`\n\n### EU Region\n\nIf you are a EU region customer, your base API URLs will be:\n- `https://api-eu.beyondidentity.com`\n- `https://auth-eu.beyondidentity.com`\n\n### US FedRAMP\n\n**NOTE**: The FedRAMP version of Secure Access is released approximately *two weeks* after the commercial version, so some API endpoints may not be available immediately. <br><br>\n\nIf you are a FedRAMP customer in the US region, your base API URLs will be:\n- `https://api.us1.beyondidentity-gov.com`\n- `https://auth.us1.beyondidentity-gov.com`\n\nFor all the examples in this document, we will use the US region API base URL. You can always replace `https://api-us.beyondidentity.com`\nand `https://auth-us.beyondidentity.com` in the examples to use the proper base URL for your tenant.\n\n# Authentication\n\nAll Beyond Identity API endpoints require authentication using an access\ntoken. The access token is generated through OAuth 2.0 or OIDC, using the\nauthorization code flow or the client credentials flow. <br /><br />\n\nThe simplest way to acquire an access token is through the Beyond Identity Admin Console. Under the \"Applications\" tab, select the \"Beyond Identity Management API\" application, navigate to the \"API Tokens\" tab, and then click on \"Create token\". <br /><br />\n\nAlternatively, an access token may also be generated directly via the API by\nrequesting a token for the \"Beyond Identity Management API\" Application. <br><br>\n\n```\ncurl https://auth-us.beyondidentity.com/v1/tenants/$TENANT_ID/realms/$REALM_ID/applications/$APPLICATION_ID/token \\\n  -X POST \\\n  -u \"$CLIENT_ID:$CLIENT_SECRET\" --basic \\\n  -H \"Content-Type: application/x-www-form-urlencoded\" \\\n  -d \"grant_type=client_credentials&scope=$SCOPES\"\n```\n\nThis will work for any application that you have configured to provide\naccess to the Beyond Identity Management API Resource Server. The \"Beyond\nIdentity Management API\" application is provided by default as part of the\ntenant onboarding process.\n\nThe access token must be provided in the `Authorization` header of the\nAPI request. <br><br>\n\n```\ncurl https://api-us.beyondidentity.com/v1/... \\\n  -X $HTTP_METHOD -H \"Authorization: Bearer $TOKEN\"\n```\n\n## Requests and Responses\n\nTo interact with the Beyond Identity API, all requests should be made over\nHTTPS. <br /><br />\n\nThe Beyond Identity API is generally structured as a resource-oriented API.\nResources are represented as JSON objects and are used as both inputs to\nand outputs from API methods. <br /><br />\n\nResource fields may be described as read-only and immutable. A read-only\nfield is only provided on the response. An immutable field is only assigned\nonce and may not be changed after. For example, system-generated IDs are\ndescribed as both read-only and immutable. <br /><br />\n\nTo create a new resource, requests should use the `POST` method. Create\nrequests include all of the necessary attributes to create a new resource.\nCreate operations return the created resource in the response. <br /><br />\n\nTo retrieve a single resource or a collection of resources, requests should\nuse the `GET` method. When retrieving a collection of resources, the\nresponse will include an array of JSON objects keyed on the plural name of\nthe requested resource. <br /><br />\n\nTo update an resource, requests should use the `PATCH` method. Update\noperations support partial updating so requests may specify only the\nattributes which should be updated. Update operations return the updated\nresource in the response. <br /><br />\n\nTo delete a resource, requests should use the `DELETE` method. Note that\ndelete operations return an empty response instead of returning the\nresource in the response. <br /><br />\n\n### Example Response for a Realm\n\n```\n{\n  \"id\": \"a448fe493e02fa9f\",\n  \"tenant_id\": \"000168dc50bdce49\",\n  \"display_name\": \"Test Realm\",\n  \"create_time\": \"2022-06-22T21:46:08.930278Z\",\n  \"update_time\": \"2022-06-22T21:46:08.930278Z\"\n}\n```\n\n### Example Response for a Collection of Realms\n\n```\n{\n  \"realms\": [\n    {\n      \"id\": \"a448fe493e02fa9f\",\n      \"tenant_id\": \"000168dc50bdce49\",\n      \"display_name\": \"Test Realm\",\n      \"create_time\": \"2022-06-22T21:46:08.930278Z\",\n      \"update_time\": \"2022-06-22T21:46:08.930278Z\"\n    }\n  ],\n  \"total_size\": 1\n}\n```\n\n## HTTP Statuses\n\nThe API returns standard HTTP statuses and error codes.\n\nStatuses in the 200 range indicate that the request was successfully\nfulfilled and there were no errors. <br><br>\n\nStatuses in the 400 range indicate that there was an issue with the request\nthat may be addressed by the client. For example, client errors may\nindicate that the request was missing proper authorization or that the\nrequest was malformed. <br><br>\n\nStatuses in the 500 range indicate that the server encountered an internal\nissue and was unable to fulfill the request. <br><br>\n\nAll error responses include a JSON object with a `code` field and a\n`message` field. `code` contains a human-readable name for the HTTP status\ncode and `message` contains a high-level description of the error. The\nerror object may also contain additional error details which may be used by\nthe client to determine the exact cause of the error. Refer to each API\nmethod's examples to determine the specific error detail types supported\nfor that method. <br><br>\n\n### Invalid Access Token Example\n\nIf the provided access token is invalid, you will receive a 401 error.\nThis error indicates that the token is not recognized and was not generated\nby Beyond Identity. <br><br>\n\n```\nHTTP/1.1 401 Unauthorized\n{\n  \"code\": \"unauthorized\",\n  \"message\": \"unauthorized\"\n}\n```\n\n### Permission Denied Example\n\nIf the provided access token does not have access to the requested resource,\nyou will receive a 403 error. Access tokens are scoped at a minimum to your\ntenant. Any request for resources outside of your tenant will result in this\nerror. <br><br>\n\n```\nHTTP/1.1 403 Forbidden\n{\n  \"code\": \"forbidden\",\n  \"message\": \"forbidden\"\n}\n```\n\n### Missing Resource Example\n\nIf the requested resource does not exist, you will receive a 404 error. The\nspecific API method may return additional details about the missing\nresource. <br><br>\n\n```\nHTTP/1.1 404 Not Found\n{\n  \"code\": \"not_found\",\n  \"message\": \"group not found\"\n  \"details\": [\n    {\n      \"type\": \"ResourceInfo\",\n      \"resource_type\": \"Group\",\n      \"id\": \"4822738be6b7f658\",\n      \"description\": \"group not found\"\n    }\n  ],\n}\n```\n\n### Invalid Parameters Example\n\nIf the request body contains invalid parameters, you will receive a 400\nerror. The specific API method may return additional details about the\ninvalid parameter. <br><br>\n\n```\nHTTP/1.1 400 Bad Request\n{\n  \"code\": \"bad_request\",\n  \"message\": \"invalid parameters\"\n  \"details\": [\n    {\n      \"type\": \"FieldViolations\"\n      \"field_violations\": [\n        {\n          \"description\": \"missing\",\n          \"field\": \"group.display_name\"\n        }\n      ],\n    }\n  ],\n}\n```\n"
servers:
- url: https://api-us.beyondidentity.com
  description: US region API base URL
- url: https://api-eu.beyondidentity.com
  description: EU region API base URL
- url: https://api.us1.beyondidentity-gov.com/
  description: US FedRAMP API base URL
security:
- BearerAuth: []
tags:
- name: Credential Binding Jobs
  description: 'A credential binding job defines the state of binding a new credential to an identity. The state includes creation of the credential binding job to delivery of the credential binding method to completion of the credential binding.

    '
paths:
  /v1/tenants/{tenant_id}/realms/{realm_id}/identities/{identity_id}/credential-binding-jobs:
    post:
      tags:
      - Credential Binding Jobs
      operationId: CreateCredentialBindingJob
      summary: Create a New Credential Binding Job
      description: 'To create an identity, send a POST request to `/v1/tenants/$TENANT_ID/realms/$REALM_ID/identities/$IDENTITY_ID/credential-binding-jobs`. Values in the request body for read-only fields will be ignored.

        '
      security:
      - BearerAuth:
        - credential-binding-jobs:create
      parameters:
      - $ref: '#/components/parameters/tenant_id'
      - $ref: '#/components/parameters/realm_id'
      - $ref: '#/components/parameters/identity_id'
      requestBody:
        description: Credential binding job to be created.
        content:
          application/json:
            schema:
              title: Create credential binding job request
              description: Request for CreateCredentialBindingJob.
              type: object
              properties:
                job:
                  $ref: '#/components/schemas/CredentialBindingJob'
              required:
              - job
            examples:
              Create Credential Binding Job:
                value:
                  job:
                    delivery_method: RETURN
                    post_binding_redirect_uri: http://example.com/callback
                    authenticator_config_id: 67bb0acf12e5c899
      responses:
        '200':
          description: 'The response will be a JSON object with a key called `credential_binding_job`. The value of this will be an object containing the standard attributes associated with a credential binding job. If the `delivery_method` of the credential binding job is `RETURN`, the response will also contain a key called `credential_binding_link` that contains a link to facilitate the credential binding process.

            '
          content:
            application/json:
              schema:
                title: Create Credential Binding Job Response
                description: Response for CreateCredentialBindingJob.
                type: object
                properties:
                  credential_binding_job:
                    $ref: '#/components/schemas/CredentialBindingJob'
                  credential_binding_link:
                    type: string
                    description: 'A unique URL to be delivered to an identity to facilitate the credential binding process.  This field is only present if the credential binding job''s `delivery_method` is `RETURN`.

                      '
                required:
                - credential_binding_job
              examples:
                Delivery Method Return:
                  value:
                    credential_binding_job:
                      id: c4fc2d753ca22b14
                      realm_id: cdf4862dc4d49791
                      tenant_id: 000183a77dd50fa9
                      identity_id: 87fabad6956c6d4b
                      delivery_method: RETURN
                      state: LINK_SENT
                      post_binding_redirect_uri: http://example.com/callback
                      authenticator_config_id: 67bb0acf12e5c899
                      expire_time: '2022-03-21T03:42:52.905657Z'
                      create_time: '2022-03-14T03:42:52.905657Z'
                      update_time: '2022-03-15T05:55:23.823187Z'
                    credential_binding_link: http://example.com/v1/tenants/000183a77dd50fa9/realms/cdf4862dc4d49791/identities/87fabad6956c6d4b/credential-binding-jobs/c4fc2d753ca22b14:invokeAuthenticator?token=1St9IKIIrYyQ8sOSeuk5UkbLKnBJhuD4I7nWIqt-BNANDEFS-XVuOHxB7TFdZcRm
                Delivery Method Email:
                  value:
                    credential_binding_job:
                      id: c4fc2d753ca22b14
                      realm_id: cdf4862dc4d49791
                      tenant_id: 000183a77dd50fa9
                      identity_id: 87fabad6956c6d4b
                      delivery_method: EMAIL
                      state: LINK_SENT
                      post_binding_redirect_uri: http://example.com/callback
                      authenticator_config_id: 67bb0acf12e5c899
                      expire_time: '2022-03-21T03:42:52.905657Z'
                      create_time: '2022-03-14T03:42:52.905657Z'
                      update_time: '2022-03-15T05:55:23.823187Z'
        '400':
          description: Bad request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Malformed Request:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D/patch/responses/400/content/application~1json/examples/Malformed%20Request'
                Invalid Parameters:
                  value:
                    code: bad_request
                    message: invalid parameters
                    details:
                    - type: FieldViolations
                      field_violations:
                      - field: job.authenticator_config_id
                        description: empty string
        '401':
          description: Unauthorized.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Missing Authorization:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D/get/responses/401/content/application~1json/examples/Missing%20Authorization'
        '403':
          description: Forbidden.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Insufficient Authorization:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D/get/responses/403/content/application~1json/examples/Insufficient%20Authorization'
        '404':
          description: The resource was not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceInfo'
              examples:
                Identity Not Found:
                  value:
                    code: not_found
                    message: identity not found
                    details:
                    - type: ResourceInfo
                      resource_type: Identity
                      id: 51c3c2d2907d6b40
                      description: identity not found
        '422':
          description: Unprocessable entity.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Identity Missing Email Address:
                  value:
                    code: unprocessable_entity
                    message: Identity missing email address
                    details:
                    - type: ResourceInfo
                      resource_type: Identity
                      id: 69f4d38f840c13ab
                      description: Identity missing email address
        '500':
          description: Server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Internal Error:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D/get/responses/500/content/application~1json/examples/Internal%20Error'
        '503':
          description: Service unavailable.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    get:
      tags:
      - Credential Binding Jobs
      operationId: ListCredentialBindingJobs
      summary: List Credential Binding Jobs for an Identity
      description: 'To list all credential binding jobs for an identity, send a GET request to

        `/v1/tenants/$TENANT_ID/realms/$REALM_ID/identities/$IDENTITY_ID/credential-binding-jobs`.

        `$IDENTITY_ID` may be a wildcard (`-`) to request all credential binding

        jobs across all identities within the realm.


        The response will contain at most 200 items and may contain a page token to

        query the remaining items. If page size is not specified, the response will

        contain 20 items. There is no defined ordering of the list of credential

        binding jobs in the response. Note that the maximum and default page sizes

        are subject to change.


        When paginating, the page size is maintained by the page token but may be

        overridden on subsequent requests. The skip is not maintained by the page

        token and must be specified on each subsequent request.


        Page tokens expire after one week. Requests which specify an expired page

        token will result in undefined behavior.

        '
      security:
      - BearerAuth:
        - credential-binding-jobs:read
      parameters:
      - $ref: '#/components/parameters/tenant_id'
      - $ref: '#/components/parameters/realm_id'
      - $ref: '#/components/parameters/identity_id'
      - $ref: '#/components/parameters/page_size'
      - $ref: '#/components/parameters/page_token'
      - $ref: '#/components/parameters/skip'
      responses:
        '200':
          description: 'The response will be a JSON object with keys for `credential_binding_jobs` and `total_size`. `credential_binding_jobs` will be set to an array of credential binding job objects, each of which contains the standard credential binding job attributes. `total_size` will be set to the total number of items matched by the list request. If there are more items to be returned by the requested query, the response will also contain a key called `next_page_token`.

            '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListCredentialBindingJobsResponse'
              examples:
                Success:
                  value:
                    credential_binding_jobs:
                    - id: 81490afab171aef0
                      identity_id: e85de356dc78843a
                      realm_id: 7df92e4a38ba0993
                      tenant_id: 0001b42d80372976
                      credential_id: 9802966246819b35
                      delivery_method: EMAIL
                      state: COMPLETE
                      post_binding_redirect_uri: http://example.com/callback
                      authenticator_config_id: 67bb0acf12e5c899
                      expire_time: '2022-03-21T03:42:52.905657Z'
                      create_time: '2022-03-14T03:42:52.905657Z'
                      update_time: '2022-03-15T05:55:23.823187Z'
                    total_size: 1
        '400':
          description: Bad request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Invalid Parameters:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms/get/responses/400/content/application~1json/examples/Invalid%20Parameters'
        '401':
          description: Unauthorized.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Missing Authorization:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D/get/responses/401/content/application~1json/examples/Missing%20Authorization'
        '403':
          description: Forbidden.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Insufficient Authorization:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D/get/responses/403/content/application~1json/examples/Insufficient%20Authorization'
        '500':
          description: Server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Internal Error:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D/get/responses/500/content/application~1json/examples/Internal%20Error'
  /v1/tenants/{tenant_id}/realms/{realm_id}/identities/{identity_id}/credential-binding-jobs/{credential_binding_job_id}:
    get:
      tags:
      - Credential Binding Jobs
      operationId: GetCredentialBindingJob
      summary: Retrieve an Existing Credential Binding Job
      description: 'To retrieve an existing credential binding job, send a GET request to `/v1/tenants/$TENANT_ID/realms/$REALM_ID/identities/$IDENTITY_ID/credential-binding-jobs/$CREDENTIAL_BINDING_JOB_ID`.

        '
      security:
      - BearerAuth:
        - credential-binding-jobs:read
      parameters:
      - $ref: '#/components/parameters/tenant_id'
      - $ref: '#/components/parameters/realm_id'
      - $ref: '#/components/parameters/identity_id'
      - $ref: '#/components/parameters/credential_binding_job_id'
      - name: filter
        in: query
        description: 'Filter to constrain the response. The response will only include resources matching this filter. Filters follow the SCIM grammar from [RFC-7644 Section 3.4.2.2](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2). Supported filters attributes:

          `state`: the state of the credential binding job.

          `delivery_method`: the delivery method used for the credential binding job.

          '
        schema:
          type: string
      responses:
        '200':
          description: 'The response will be a JSON object containing the standard attributes associated with a credential binding job.

            '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CredentialBindingJob'
              examples:
                Success:
                  value:
                    id: 81490afab171aef0
                    identity_id: e85de356dc78843a
                    realm_id: 7df92e4a38ba0993
                    tenant_id: 0001b42d80372976
                    credential_id: 9802966246819b35
                    delivery_method: EMAIL
                    state: COMPLETE
                    post_binding_redirect_uri: http://example.com/callback
                    authenticator_config_id: 67bb0acf12e5c899
                    expire_time: '2022-03-21T03:42:52.905657Z'
                    create_time: '2022-03-14T03:42:52.905657Z'
                    update_time: '2022-03-15T05:55:23.823187Z'
        '401':
          description: Unauthorized.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Missing Authorization:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D/get/responses/401/content/application~1json/examples/Missing%20Authorization'
        '403':
          description: Forbidden.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Insufficient Authorization:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D/get/responses/403/content/application~1json/examples/Insufficient%20Authorization'
        '404':
          description: The resource was not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Credential Binding Job Not Found:
                  value:
                    code: not_found
                    message: credential binding job not found
                    details:
                    - type: ResourceInfo
                      resource_type: CredentialBindingJob
                      id: 3103ba9a652b755e
                      description: credential binding job not found
        '500':
          description: Server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Internal Error:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D/get/responses/500/content/application~1json/examples/Internal%20Error'
  ? /v1/tenants/{tenant_id}/realms/{realm_id}/identities/{identity_id}/credential-binding-jobs/{credential_binding_job_id}:revoke
  : post:
      tags:
      - Credential Binding Jobs
      operationId: SetCredentialBindingJobRevoked
      summary: Revocation of an active credential binding job.
      description: 'To revoke an active credential binding job, send a POST request to `/v1/tenants/$TENANT_ID/realms/$REALM_ID/identities/$IDENTITY_ID/credential-binding-jobs/$CREDENTIAL_BINDING_JOB_ID:revoke`.

        This endpoint invalidates a pending credential binding job, preventing a credential from being enrolled for the associated identity. If the specified job has already been completed, the revocation attempt will fail.

        '
      security:
      - CredentialAuth:
        - credential-binding-jobs:revoke
      parameters:
      - $ref: '#/components/parameters/tenant_id'
      - $ref: '#/components/parameters/realm_id'
      - $ref: '#/components/parameters/identity_id'
      - $ref: '#/components/parameters/credential_binding_job_id'
      requestBody:
        content:
          application/json:
            schema:
              title: Bind Credential Request
              description: 'Request for `SetCredentialBindingJobRevoked`. This request body is empty.

                '
              type: object
      responses:
        '200':
          description: Credential binding job was successfully revoked.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CredentialBindingJob'
        '400':
          description: 'Bad request. If the request failed due to invalid fields, the error details will include a FieldViolations.

            '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: 'Permission denied. The error details will include a ResourceInfo describing the authorization failure.

            '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: 'Not found. The error details will include a ResourceInfo describing the required resource that was not found.

            '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '409':
          description: 'Conflict. The error details will include a ResourceInfo describing the required resource that is conflicting.

            '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /v1/tenants/{tenant_id}/realms/{realm_id}/batch-credential-binding-jobs:
    post:
      tags:
      - Credential Binding Jobs
      operationId: CreateBatchCredentialBindingJob
      summary: Create a New Batch Credential Binding Job
      description: 'To create a new batch credential binding job, send a POST request to `/v1/tenants/$TENANT_ID/realms/$REALM_ID/batch-credential-binding-jobs`.

        Values in the request body for read-only fields will be ignored.

        A maximum of 1000 credential binding jobs can be created in a single batch.

        Each realm can have up to 1000 credential binding jobs in the batch queue at any given time.

        '
      security:
      - BearerAuth:
        - credential-binding-jobs:create
      parameters:
      - $ref: '#/components/parameters/tenant_id'
      - $ref: '#/components/parameters/realm_id'
      requestBody:
        description: Batch credential binding job to be created.
        content:
          application/json:
            schema:
              title: Create Batch Credential Binding Job Request
              description: Request for CreateBatchCredentialBindingJob.
              type: object
              properties:
                batch_credential_binding_job:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1batch-credential-binding-jobs/post/responses/200/content/application~1json/schema'
              required:
              - batch_credential_binding_job
            examples:
              Create Batch Credential Binding Job:
                value:
                  batch_credential_binding_job:
                    identity_ids:
                    - 3d227b0d5949969d
                    - a3f28b7c9e6d1234
                    - 5c90d2af18e47b0e
                    job_template:
                      authenticator_config_id: 67bb0acf12e5c899
                      post_binding_redirect_uri: http://example.com/callback
      responses:
        '200':
          description: 'The response will be a JSON object containing the standard attributes associated with a credential binding job.

            '
          content:
            application/json:
              schema:
                title: BatchCredentialBindingJob
                description: 'A batch credential binding job manages the binding of credentials for multiple identities in a batch operation.

                  '
                type: object
                required:
                - identity_ids
                - job_template
                properties:
                  id:
                    type: string
                    description: 'ID of the batch credential binding job. This is automatically generated on creation. This field is immutable and output-only.

                      '
                    readOnly: true
                  tenant_id:
                    type: string
                    description: 'ID of the tenant associated with the batch credential binding job. This is automatically set on creation. This field is immutable and output-only.

                      '
                    minLength: 1
                    readOnly: true
                  realm_id:
                    type: string
                    description: 'ID of the realm associated with the batch credential binding job. This is automatically set on creation. This field is immutable and output-only.

                      '
                    minLength: 1
                    readOnly: true
                  identity_ids:
                    type: array
                    description: 'The list of identities associated with the batch credential binding job.

                      '
                    items:
                      type: string
                      minLength: 1
                    minItems: 1
                    maxItems: 1000
                  state:
                    type: string
                    description: 'The current state of the batch credential binding job.


                      `RUNNING` indicates that the batch credential binding job is currently running.


                      `FAILED` indicates that the batch credential binding job has failed.


                      `PARTIAL_SUCCESS` indicates that the batch credential binding job has completed with some failures.


                      `SUCCESS` indicates that the batch credential binding job has completed successfully.


                      This field is immutable and output-only.

                      '
                    readOnly: true
                  state_commentary:
                    title: BatchStateCommentary
                    type: object
                    description: 'Commentary on the current state of the batch credential binding job. This field provides error information for each identity for which a credential binding job was attempted.

                      This field is immutable and output-only.

                      '
                    readOnly: true
                    properties:
                      errors:
                        type: object
                        description: 'Per-identity error information. This contains a mapping of identity ID to error context. It will contain any errors encountered while creating an enrollment job for an entity. This field is immutable and output-only.

                          '
                        additionalProperties:
                          type: object
                          required:
                          - last_error
                          properties:
                            last_error:
                              type: string
                              description: 'The most recent error encountered while creating a credential binding job for the associated identity.

                                '
                            failed_permanently:
                              type: boolean
                              description: 'Indicates whether attempts to create a credential binding job for this identity have reached the maximum retry limit and permanently failed.

                                '
                  create_time:
                    type: string
                    format: date-time
                    description: 'Timestamp of when the batch credential binding job was created. This field is immutable and output-only.

                      '
                    readOnly: true
                  update_time:
                    type: string
                    format: date-time
                    description: 'Timestamp of when the batch credential binding job was updated. This field is immutable and output-only.

                      '
                    readOnly: true
                  job_template:
                    title: BatchCredentialBindingJobTemplate
                    description: 'A batch credential binding job template provides a template for the credential binding jobs created via a batch.

                      '
                    type: object
                    properties:
                      post_binding_redirect_uri:
                        type: string
                        description: 'The URI to which the caller will be redirected after successfully binding a credential to an identity. This field is optional. If not specified, the authenticator will not attempt to redirect to a new location after binding.

                          '
                        example: http://example.com/callback
                      authenticator_config:
                        type: object
                        description: 'Representation of an authenticator configuration. This prescribes how an identity may authenticate themselves with Beyond Identity.

                          '
                        properties:
                          config:
                            description: 'An object specifying the settings for the supported authenticator type.

                              The Hosted Web authenticator configuration is not supported in this field. It must be created separately and then referenced by its ID in the `authenticator_config_id` field.

                              '
                            oneOf:
                            - $ref: '#/components/schemas/AuthenticatorConfig/properties/config/oneOf/0'
                            - $ref: '#/components/schemas/AuthenticatorConfig/properties/config/oneOf/2'
                      authenticator_config_id:
                        type: string
                        description: 'The ID of the authenticator configuration to be used to build the credential binding job. This field is immutable.

                          '
                        example: 76e9eab521a8b734
                      expire_time:
                        type: string
                        format: date-time
                        description: 'A timestamp that represents when the credential binding link associated with the credential binding job will expire. This field is immutable and read-only.

                          '
                        readOnly: true
                        example: '2022-05-12T20:29:47.636497Z'
              examples:
                Success:
                  value:
                    id: 81490afab171aef0
                    realm_id: 7df92e4a38ba0993
                    tenant_id: 0001b42d80372976
                    identity_ids:
                    - 3d227b0d5949969d
                    - a3f28b7c9e6d1234
                    - 5c90d2af18e47b0e
                    state: RUNNING
                    state_commentary:
                      errors:
                        a3f28b7c9e6d1234:
                          last_error: Identity missing email address
                          failed_permanently: false
                    job_template:
                      authenticator_config_id: 67bb0acf12e5c899
                      post_binding_redirect_uri: http://example.com/callback
                    create_time: '2022-03-14T03:42:52.905657Z'
                    update_time: '2022-03-15T05:55:23.823187Z'
        '401':
          description: Unauthorized.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Missing Authorization:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D/get/responses/401/content/application~1json/examples/Missing%20Authorization'
        '403':
          description: Forbidden.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Insufficient Authorization:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D/get/responses/403/content/application~1json/examples/Insufficient%20Authorization'
        '429':
          description: 'Too many requests. The error details will include the current total number of enrollments in the batch, the maximum allowed queue size, and the amount by which the limit was exceeded.

            '
          headers:
            RateLimit-Limit:
              schema:
                type: string
                example: 1000
              description: 'Request limit (see https://www.ietf.org/archive/id/draft-polli-ratelimit-headers-02.html#section-toc.1-1.3.2.1.1).

                Note: This request limit is not based on a time window, but on the number of active requests in the batch queue. It defines the maximum number of credential binding jobs allowed in the queue.

                '
            RateLimit-Remaining:
              schema:
                type: string
                example: 200
              description: 'Request limit remaining (see https://www.ietf.org/archive/id/draft-polli-ratelimit-headers-02.html#section-toc.1-1.3.2.1.1).

                The number of additional credential binding job requests that can be submitted in a batch before reaching the maximum queue size. This value reflects the remaining capacity in the batch queue, not a time-based rate limit.

                '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Too Many Requests:
                  value:
                    code: too_many_requests
                    message: 'Maximum queue sized reached. Maximum: 1000 Current Total: 800 Overage: 100'
        '500':
          description: Server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Internal Error:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D/get/responses/500/content/application~1json/examples/Internal%20Error'
  /v1/tenants/{tenant_id}/realms/{realm_id}/batch-credential-binding-jobs/{batch_credential_binding_job_id}:
    get:
      tags:
      - Credential Binding Jobs
      operationId: GetBatchCredentialBindingJob
      summary: Retrieve an Existing Batch Credential Binding Job
      description: 'To retrieve an existing batch credential binding job, send a GET request to `/v1/tenants/$TENANT_ID/realms/$REALM_ID/identities/$IDENTITY_ID/credential-binding-jobs/batch/$BATCH_CREDENTIAL_BINDING_JOB_ID`.

        '
      security:
      - BearerAuth:
        - credential-binding-jobs:read
      parameters:
      - $ref: '#/components/parameters/tenant_id'
      - $ref: '#/components/parameters/realm_id'
      - $ref: '#/components/parameters/batch_credential_binding_job_id'
      responses:
        '200':
          description: 'The response will be a JSON object containing the standard attributes associated with the batch credential binding job.

            '
          content:
            application/json:
              schema:
                $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1batch-credential-binding-jobs/post/responses/200/content/application~1json/schema'
              examples:
                Success:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1batch-credential-binding-jobs/post/responses/200/content/application~1json/examples/Success'
        '401':
          description: Unauthorized.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Missing Authorization:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D/get/responses/401/content/application~1json/examples/Missing%20Authorization'
        '403':
          description: Forbidden.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Insufficient Authorization:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D/get/responses/403/content/application~1json/examples/Insufficient%20Authorization'
        '404':
          description: The resource was not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Batch Credential Binding Job Not Found:
                  value:
                    code: not_found
                    message: batch credential binding job not found
                    details:
                    - type: ResourceInfo
                      resource_type: BatchCredentialBindingJob
                      id: ea453099-e207-47d1-b24c-b3165a54037a
                      description: batch credential binding job not found
        '500':
          description: Server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Internal Error:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D/get/responses/500/content/application~1json/examples/Internal%20Error'
  /v1/tenants/{tenant_id}/realms/{realm_id}/batch-credential-binding-jobs/{batch_credential_binding_job_id}:listResults:
    get:
      tags:
      - Credential Binding Jobs
      operationId: ListBatchCredentialBindingJobResults
      summary: List Results of a Batch Credential Binding Job
      description: 'To list the results of a batch credential binding job, send a GET request to `/v1/tenants/$TENANT_ID/realms/$REALM_ID/batch-credential-binding-jobs/$BATCH_CREDENTIAL_BINDING_JOB_ID:listResults`.

        '
      security:
      - BearerAuth:
        - credential-binding-jobs:read
      parameters:
      - $ref: '#/components/parameters/tenant_id'
      - $ref: '#/components/parameters/realm_id'
      - $ref: '#/components/parameters/batch_credential_binding_job_id'
      responses:
        '200':
          description: 'The response will be a JSON object containing the standard attributes associated with the results of the batch credential binding job.

            '
          content:
            application/json:
              schema:
                title: ListBatchCredentialBindingJobResultsResponse
                description: 'A response containing the results of a batch credential binding job.

                  '
                type: object
                properties:
                  job_results:
                    type: array
                    items:
                      $ref: '#/components/schemas/CredentialBindingJob'
                    maxItems: 200
                    description: 'An unordered array of credential binding jobs corresponding to the batch credential binding job.

                      '
                  total_success_count:
                    type: integer
                    format: uint32
                    description: 'Total number of successful results.

                      '
                  total_failure_count:
                    type: integer
                    format: uint32
                    description: 'Total number of failed results.

                      '
                  total_pending_count:
                    type: integer
                    format: uint32
                    description: 'Total number of pending results.

                      '
                  total_size:
                    type: integer
                    format: uint32
                    description: 'Total number of results for the request. This value may be used to determine subsequent requests to query the remaining results.

                      '
                  next_page_token:
                    type: string
                    description: 'Token used to fetch the next set of results. If this field is omitted, there are no subsequent pages.

                      '
                required:
                - job_results
                - total_size
                - total_success_count
                - total_failure_count
                - total_pending_count
              examples:
                Success:
                  value:
                    job_results:
                    - id: 81490afab171aef0
                      identity_id: a3f28b7c9e6d1234
                      realm_id: 7df92e4a38ba0993
                      tenant_id: 0001b42d80372976
                      delivery_method: EMAIL
                      state: COMPLETE
                      post_binding_redirect_uri: http://example.com/callback
                      authenticator_config_id: 67bb0acf12e5c899
                      expire_time: '2022-03-21T03:42:52.905657Z'
                      create_time: '2022-03-14T03:42:52.905657Z'
                      update_time: '2022-03-15T05:55:23.823187Z'
                    - id: 81490afab171aef0
                      identity_id: 5c90d2af18e47b0e
                      realm_id: 7df92e4a38ba0993
                      tenant_id: 0001b42d80372976
                      delivery_method: EMAIL
                      state: LINK_OPENED
                      post_binding_redirect_uri: http://example.com/callback
                      authenticator_config_id: 67bb0acf12e5c899
                      expire_time: '2022-03-21T03:42:52.905657Z'
                      create_time: '2022-03-14T03:42:52.905657Z'
                      update_time: '2022-03-15T05:55:23.823187Z'
                    - id: 81490afab171aef0
                      identity_id: e85de356dc78843a
                      realm_id: 7df92e4a38ba0993
                      tenant_id: 0001b42d80372976
                      delivery_method: EMAIL
                      state: REVOKED
                      post_binding_redirect_uri: http://example.com/callback
                      authenticator_config_id: 67bb0acf12e5c899
                      expire_time: '2022-03-21T03:42:52.905657Z'
                      create_time: '2022-03-14T03:42:52.905657Z'
                      update_time: '2022-03-15T05:55:23.823187Z'
                    total_success_count: 1
                    total_failure_count: 1
                    total_pending_count: 1
                    total_size: 3
        '401':
          description: Unauthorized.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Missing Authorization:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D/get/responses/401/content/application~1json/examples/Missing%20Authorization'
        '403':
          description: Forbidden.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Insufficient Authorization:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D/get/responses/403/content/application~1json/examples/Insufficient%20Authorization'
        '404':
          description: The resource was not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Batch Credential Binding Job Not Found:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1batch-credential-binding-jobs~1%7Bbatch_credential_binding_job_id%7D/get/responses/404/content/application~1json/examples/Batch%20Credential%20Binding%20Job%20Not%20Found'
        '500':
          description: Server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                Internal Error:
                  $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D/get/responses/500/content/application~1json/examples/Internal%20Error'
components:
  parameters:
    skip:
      name: skip
      in: query
      description: 'Number of items to skip. This is the zero-based index of the first result.

        '
      schema:
        type: integer
        format: uint32
        minimum: 0
        default: 0
    realm_id:
      name: realm_id
      in: path
      description: A unique identifier for a realm.
      required: true
      schema:
        type: string
        example: 19a95130480dfa79
    page_size:
      name: page_size
      in: query
      description: 'Number of items returned per page. The response will include at most this many results but may include fewer. If this value is omitted, the response will return the default number of results allowed by the method.

        '
      schema:
        type: integer
        format: uint32
        minimum: 0
    credential_binding_job_id:
      name: credential_binding_job_id
      in: path
      description: A unique identifier for a credential binding job.
      required: true
      schema:
        type: string
        example: 5c4137af5e70413a
    tenant_id:
      name: tenant_id
      in: path
      description: A unique identifier for a tenant.
      required: true
      schema:
        type: string
        example: 000176d94fd7b4d1
    identity_id:
      name: identity_id
      in: path
      description: A unique identifier for an identity.
      required: true
      schema:
        type: string
        example: e372db224c06e850
    batch_credential_binding_job_id:
      name: batch_credential_binding_job_id
      in: path
      description: A unique identifier for a batch credential binding job.
      required: true
      schema:
        type: string
        example: c15e004f-a7bc-459b-b035-cec40e07f537
    page_token:
      name: page_token
      in: query
      description: 'Token to retrieve the subsequent page of the previous request. All other parameters to the list endpoint should match the original request that provided this token unless otherwise specified.

        '
      schema:
        type: string
  schemas:
    ListCredentialBindingJobsResponse:
      title: List Credential Binding Jobs Response
      description: Response for ListCredentialBindingJobs.
      type: object
      properties:
        credential_binding_jobs:
          type: array
          items:
            $ref: '#/components/schemas/CredentialBindingJob'
          maxItems: 200
          description: 'An unordered array of credential binding jobs corresponding to the request.

            '
        total_size:
          type: integer
          format: uint32
          description: 'Total number of results returned by the operation. This value may be larger than the number of resources returned, such as when returning a single page where multiple pages are available.

            '
          example: 1000
        next_page_token:
          type: string
          description: 'Token used to fetch the next set of results. If this field is omitted, there are no subsequent pages.

            '
      required:
      - credential_binding_jobs
      - total_size
    CredentialBindingJob:
      title: CredentialBindingJob
      description: 'A credential binding job defines the state of binding a new credential to an identity. The state includes creation of the credential binding job to delivery of the credential binding method to completion of the credential binding.

        '
      type: object
      properties:
        id:
          type: string
          description: 'A unique identifier for a credential binding job. This is automatically generated on creation. This field is immutable and read-only. This field is unique within the realm.

            '
          readOnly: true
          example: 86b4f51481f09321
        identity_id:
          type: string
          description: 'A unique identifier for the credential binding job''s identity. This is automatically set on creation. This field is immutable and read-only.

            '
          readOnly: true
          example: 3d227b0d5949969d
        realm_id:
          type: string
          description: 'A unique identifier for the credential binding job''s realm. This is automatically set on creation. This field is immutable and read-only.

            '
          readOnly: true
          example: 9602e246c2ead9b2
        tenant_id:
          type: string
          description: 'A unique identifier for the credential binding job''s tenant. This is automatically set on creation. This field is immutable and read-only.

            '
          readOnly: true
          example: ce5ace5fc7e14d6a
        credential_id:
          type: string
          description: 'A unique identifier for the credential that was bound via the credential binding job. This field will only be populated if the credential binding job has successfully been used to bind a credential to an identity.

            '
          example: 9802966246819b35
        batch_id:
          type: string
          description: 'A unique identifier for the batch that this credential binding job is associated with. This field is immutable and read-only. This field will only be populated if the credential binding job was created as part of a batch.

            '
          readOnly: true
          example: 9802966246819b35
        delivery_method:
          type: string
          enum:
          - RETURN
          - EMAIL
          description: 'The method by which a credential binding link is delivered to the target

            authenticator or identity.


            The value `RETURN` indicates that a credential binding link will be

            returned to the caller upon creation of the credential binding job.


            The value `EMAIL` indicates that a credential binding link will be sent

            to the email address associated with the identity.

            '
        state:
          type: string
          enum:
          - LINK_SENT
          - LINK_OPENED
          - REQUEST_DELIVERED
          - COMPLETE
          - EXPIRED
          - FAILED_TO_SEND
          - REVOKED
          description: 'The current state of the credential binding job.


            `LINK_SENT` indicates that the credential binding link associated with the job was sent to its target authenticator or identity.


            `LINK_OPENED` indicates that the credential binding link associated with the job was opened by its target identity.


            `REQUEST_DELIVERED` indicates that the credential binding request has been successfully delivered to its target authenticator.


            `COMPLETE` indicates that a credential was successfully bound to an identity.


            `EXPIRED` indicates that the credential binding job has expired.


            `FAILED_TO_SEND` indicates that the credential binding request failed to send via email.


            `REVOKED` indicates that the credential binding job has been revoked.

            '
          readOnly: true
          example: COMPLETE
        post_binding_redirect_uri:
          type: string
          description: 'The URI to which the caller will be redirected after successfully binding a credential to an identity. This field is optional. If not specified, the authenticator will not attempt to redirect to a new location after binding.

            '
          example: http://example.com/callback
        authenticator_config:
          type: object
          description: 'Representation of an authenticator configuration. This prescribes how an identity may authenticate themselves with Beyond Identity.

            '
          properties:
            config:
              description: 'An object specifying the settings for the supported authenticator type.

                The Hosted Web authenticator configuration is not supported in this field. It must be created separately and then referenced by its ID in the `authenticator_config_id` field.

                '
              oneOf:
              - $ref: '#/components/schemas/AuthenticatorConfig/properties/config/oneOf/0'
              - $ref: '#/components/schemas/AuthenticatorConfig/properties/config/oneOf/2'
        authenticator_config_id:
          type: string
          description: 'The ID of the authenticator configuration to be used to build the credential binding job. This field is immutable.

            '
          example: 76e9eab521a8b734
        expire_time:
          type: string
          format: date-time
          description: 'A timestamp that represents when the credential binding link associated with the credential binding job will expire. This field is immutable and read-only.

            '
          readOnly: true
          example: '2022-05-12T20:29:47.636497Z'
        create_time:
          type: string
          format: date-time
          description: 'A time value given in ISO8601 combined date and time format that represents when the credential binding job was created. This is automatically generated on creation. This field is read-only.

            '
          readOnly: true
          example: '2022-05-12T20:29:47.636497Z'
        update_time:
          type: string
          format: date-time
          description: 'A time value given in ISO8601 combined date and time format that represents when the credential binding job was last updated. This is automatically updated when the credential binding job is updated. This field is read-only.

            '
          readOnly: true
          example: '2022-05-12T20:29:47.636497Z'
    ResourceInfo:
      title: Resource Information
      description: Resource information.
      allOf:
      - $ref: '#/components/schemas/ErrorDetail'
      - type: object
        properties:
          resource_type:
            type: string
            description: The type of the resource.
          id:
            type: string
            description: The ID of the resource.
          description:
            type: string
            description: 'A description of the failure as it relates to this resource. For example, this may indicate that the resource is not found or that a precondition failed.

              '
        required:
        - resource_type
        - id
        - description
    AuthenticatorConfig:
      title: Authenticator Configuration
      type: object
      description: 'Representation of an authenticator configuration. This prescribes how an identity may authenticate themselves with Beyond Identity.

        '
      properties:
        id:
          type: string
          description: 'A unique identifier for an authenticator configuration. This is automatically generated on creation. This field is immutable and read-only. This field is unique within the realm.

            '
          readOnly: true
          example: 73731b7f-eb76-4143-9b4b-81a720385f5a
        realm_id:
          type: string
          description: 'A unique identifier for the authenticator configuration''s realm. This is automatically set on creation. This field is immutable and read-only.

            '
          readOnly: true
          example: caf2ff640497591a
        tenant_id:
          type: string
          description: 'A unique identifier for the authenticator configuration''s tenant. This is automatically set on creation. This field is immutable and read-only.

            '
          readOnly: true
          example: 00011f1183c67b69
        display_name:
          type: string
          description: 'A human-readable name for the authenticator configuration. This name is used for display purposes.

            '
          example: Pet Authenticator Configuration
        config:
          description: 'An object specifying the settings for the supported authenticator type.

            '
          oneOf:
          - title: Embedded SDK Authenticator
            description: Configuration options for the embedded SDK authenticator.
            type: object
            required:
            - type
            - invoke_url
            - trusted_origins
            properties:
              invocation_type:
                default: automatic
                description: 'The method used to invoke the `invoke_url` in the embedded authenticator

                  config type. The two methods available are:


                  The value `automatic` indicates that this invocation type automatically

                  redirects you to your native or web app using the Invoke URL with a

                  challenge that your app will need to sign.


                  The value `manual` indicates that this invocation type will cause the

                  challenge to be returned to you as part of a JSON response. It will then

                  be up to you to get it to your native/web app any way you see fit. This is

                  useful for flows where you require a lot more control when redirecting to

                  your native/web app. Since the challenge is packaged as part of a URL,

                  following the URL will result in the same behavior as if an Invocation

                  Type of "automatic" were selected.

                  '
                enum:
                - automatic
                - manual
                type: string
              invoke_url:
                description: URL to invoke during the authentication flow.
                example: http://localhost:8092
                type: string
              trusted_origins:
                description: 'Trusted origins are URLs that will be allowed to make requests from a browser to the Beyond Identity API. This is used with Cross-Origin Resource Sharing (CORS). These may be in the form of `<scheme> "://" <host> [ ":" <port> ]`, such as `https://auth.your-domain.com` or `http://localhost:3000`.

                  '
                items:
                  example: http://localhost:8092
                  type: string
                type: array
              type:
                enum:
                - embedded
                type: string
              authentication_methods:
                items:
                  properties:
                    type:
                      description: 'Within our hosted web product, an array of values determines the

                        client-side authentication workflows:


                        The value `webauthn_passkey` triggers a workflow that generates a hardware

                        key within your device''s trusted execution environment (TEE). If webauthn

                        passkeys are not supported in the browser, specifying one of the other two

                        authentication methods will result in a fallback to that mechanism.


                        The value `software_passkey` activates a workflow where a passkey is

                        securely created within the browser''s context.


                        The value `email_one_time_password` enables a workflow that verifies

                        identity via an email of a one-time password.

                        '
                      enum:
                      - email_one_time_password
                      - software_passkey
                      - webauthn_passkey
                      type: string
                  required:
                  - type
                  title: AuthenticationMethod
                  type: object
                type: array
          - title: Hosted Web Authenticator
            description: 'Configuration options for the hosted web experience. This authenticator is maintained by Beyond Identity and allows the caller to customize authentication methods.

              '
            type: object
            required:
            - type
            - authentication_methods
            - trusted_origins
            properties:
              authentication_methods:
                items:
                  $ref: '#/components/schemas/AuthenticatorConfig/properties/config/oneOf/0/properties/authentication_methods/items'
                type: array
              trusted_origins:
                description: 'Trusted origins are URLs that will be allowed to make requests from a browser to the Beyond Identity API. This is used with Cross-Origin Resource Sharing (CORS). These may be in the form of `<scheme> "://" <host> [ ":" <port> ]`, such as `https://auth.your-domain.com` or `http://localhost:3000`.

                  '
                items:
                  example: http://localhost:8092
                  type: string
                type: array
              type:
                enum:
                - hosted_web
                type: string
          - title: Console Authenticator
            description: 'Configuration options for credential enrollment, enabling an identity to access the Beyond Identity Console. These options support both IDP-authorized flows and non-verified enrollment pathways.

              '
            type: object
            required:
            - type
            - onboarding_configuration
            properties:
              type:
                enum:
                - console
                type: string
              onboarding_configuration:
                title: Console Onboarding Configuration
                description: Configuration options for the console onboarding experience.
                type: object
                required:
                - verification_method
                properties:
                  verification_method:
                    oneOf:
                    - title: Console Verification Method IDP
                      description: Configures IDP verification for identities onboarding.
                      type: object
                      required:
                      - type
                      - idp_id
                      properties:
                        type:
                          description: 'The type of verification method to be used for credential onboarding. Currently only `idp` or `none` are supported options.

                            If set to `none` there will be no verification step performed for the identity selected for credential onboarding.'
                          type: string
                          enum:
                          - idp
                        idp_id:
                          description: The id of the IDP to use to verify the identity during the onboarding process.
                          type: string
                          format: uuid
                    - title: Console Verification Method None
                      description: An onboarding configuration with no verification configured. Identities will not be verified during the onboarding operation.
                      type: object
                      required:
                      - type
                      properties:
                        type:
                          description: 'The type of verification method to be used for credential onboarding. Currently only `idp` or `none` are supported options.

                            If set to `none` there will be no verification step performed for the identity selected for credential onboard.'
                          type: string
                          enum:
                          - none
          - title: Platform Authenticator
            description: Configuration options for the platform authenticator.
            type: object
            required:
            - type
            properties:
              type:
                type: string
                enum:
                - platform
              trusted_origins:
                description: Trusted origins are URLs that will be allowed to make requests from a browser to the Beyond Identity API. This is used with Cross-Origin Resource Sharing (CORS). These may be in the form of `<scheme> "://" <host> [ ":" <port> ],` such as `https://auth.your-domain.com` or `http://localhost:3000`.
                type: array
                items:
                  type: string
                nullable: true
              roaming_auth_config:
                description: The roaming_auth_config offers advanced configuration options for the roaming auth feature.
                title: RoamingAuthConfig
                type: object
                required:
                - enabled
                - allow_unknow_user
                properties:
                  enabled:
                    description: If false, roaming auth is never offered as an available flow during authentication on this Authenticator Config.
                    type: boolean
                  allow_unknown_user:
                    description: If a login_hint is not provided or the login_hint does not match for exactly one user in the directory, the user will be considered "unknown" and the value of allow_unknown_user will be used to determine whether or not to offer roaming auth.
                    type: boolean
                  allowed_source_ips:
                    description: If allowed_source_ips is not null and not empty, roaming auth will only be offered to users who begin the authentication from a specified IP address or range.
                    type: array
                    items:
                      type: string
                  allowed_user_group_ids:
                    description: If allowed_user_group_ids is not nil and not empty, roaming auth will only be offered to users if they are part of one of those user groups. Note that the user is determined _before_ authentication using a best effort lookup by login_hint, if provided. If a login_hint is not provided or the login_hint does not match for exactly one user in the directory, the user will be considered \"unknown\" and the value of allow_unknown_user will be used to determine whether or not to offer roaming auth.
                    type: array
                    items:
                      type: string
                  allowed_user_ids:
                    description: If allowed_user_ids is not nil and not empty, roaming auth will only be offered to specified users. Note that the user is determined _before_ authentication using a best effort lookup by login_hint, if provided. If a login_hint is not provided or the login_hint does not match for exactly one user in the directory, the user will be considered \"unknown\" and the value of allow_unknown_user will be used to determine whether or not to offer roaming auth.
                    type: array
                    items:
                      type: string
    ErrorDetail:
      title: Error Detail
      description: 'Additional details for errors designed to support client applications.

        '
      type: object
      discriminator:
        propertyName: type
      properties:
        type:
          type: string
          description: Type of the error detail.
      required:
      - type
    Error:
      type: object
      properties:
        code:
          type: string
          description: 'Human-readable HTTP status code name, stylized as lower snake case (e.g. bad_request).

            '
        message:
          type: string
          description: 'Human-readable message describing the error.

            '
        details:
          type: array
          items:
            $ref: '#/components/schemas/ErrorDetail'
      required:
      - code
      - message
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: 'See the [Authentication](#section/Authentication) section for details.

        '