openapi: 3.0.1 info: title: Beyond Identity Secure Access Applications SSO Configs API version: 1.7.0 contact: email: support@beyondidentity.com description: "# Introduction\n\n**NOTE:** To determine if you are accessing the Secure Access Platform, check the URL of your Admin Console.\nIf it looks like one of the following, you are using the Secure Access Platform:\n- `https://console.beyondidentity.com` (Localized to your region)\n- `https://console-us.beyondidentity.com` (US region)\n- `https://console-eu.beyondidentity.com` (EU region)\n- `https://console.us1.beyondidentity-gov.com` (US FedRAMP)\n\nIf your Admin Console URL does not look like one of the above, you are using the Secure Workforce Platform. Please refer to the [Secure Workforce API documentation](https://docs.beyondidentity.com/api/v0).

\n\nThe Beyond Identity Secure Access API defines methods for managing resources in the Beyond Identity Secure Access platform.

\n\nAll of the functionality available in the Beyond Identity Admin Console is\nalso available through the API.

\n\nThis API is currently in the early-access stage and is under active\ndevelopment. Feedback and suggestions are encouraged and should be directed\nto the\n[Beyond Identity Developer Slack Channel](https://join.slack.com/t/byndid/shared_invite/zt-1anns8n83-NQX4JvW7coi9dksADxgeBQ).\n\n# Base API URLs\n\nThe base API URLs is determined by the region your tenant is hosted in OR if you are a FedRAMP customer.

\n\n### US Region\n\nIf you are a US region customer, your base API URLs will be:\n- `https://api-us.beyondidentity.com`\n- `https://auth-us.beyondidentity.com`\n\n### EU Region\n\nIf you are a EU region customer, your base API URLs will be:\n- `https://api-eu.beyondidentity.com`\n- `https://auth-eu.beyondidentity.com`\n\n### US FedRAMP\n\n**NOTE**: The FedRAMP version of Secure Access is released approximately *two weeks* after the commercial version, so some API endpoints may not be available immediately.

\n\nIf you are a FedRAMP customer in the US region, your base API URLs will be:\n- `https://api.us1.beyondidentity-gov.com`\n- `https://auth.us1.beyondidentity-gov.com`\n\nFor all the examples in this document, we will use the US region API base URL. You can always replace `https://api-us.beyondidentity.com`\nand `https://auth-us.beyondidentity.com` in the examples to use the proper base URL for your tenant.\n\n# Authentication\n\nAll Beyond Identity API endpoints require authentication using an access\ntoken. The access token is generated through OAuth 2.0 or OIDC, using the\nauthorization code flow or the client credentials flow.

\n\nThe simplest way to acquire an access token is through the Beyond Identity Admin Console. Under the \"Applications\" tab, select the \"Beyond Identity Management API\" application, navigate to the \"API Tokens\" tab, and then click on \"Create token\".

\n\nAlternatively, an access token may also be generated directly via the API by\nrequesting a token for the \"Beyond Identity Management API\" Application.

\n\n```\ncurl https://auth-us.beyondidentity.com/v1/tenants/$TENANT_ID/realms/$REALM_ID/applications/$APPLICATION_ID/token \\\n -X POST \\\n -u \"$CLIENT_ID:$CLIENT_SECRET\" --basic \\\n -H \"Content-Type: application/x-www-form-urlencoded\" \\\n -d \"grant_type=client_credentials&scope=$SCOPES\"\n```\n\nThis will work for any application that you have configured to provide\naccess to the Beyond Identity Management API Resource Server. The \"Beyond\nIdentity Management API\" application is provided by default as part of the\ntenant onboarding process.\n\nThe access token must be provided in the `Authorization` header of the\nAPI request.

\n\n```\ncurl https://api-us.beyondidentity.com/v1/... \\\n -X $HTTP_METHOD -H \"Authorization: Bearer $TOKEN\"\n```\n\n## Requests and Responses\n\nTo interact with the Beyond Identity API, all requests should be made over\nHTTPS.

\n\nThe Beyond Identity API is generally structured as a resource-oriented API.\nResources are represented as JSON objects and are used as both inputs to\nand outputs from API methods.

\n\nResource fields may be described as read-only and immutable. A read-only\nfield is only provided on the response. An immutable field is only assigned\nonce and may not be changed after. For example, system-generated IDs are\ndescribed as both read-only and immutable.

\n\nTo create a new resource, requests should use the `POST` method. Create\nrequests include all of the necessary attributes to create a new resource.\nCreate operations return the created resource in the response.

\n\nTo retrieve a single resource or a collection of resources, requests should\nuse the `GET` method. When retrieving a collection of resources, the\nresponse will include an array of JSON objects keyed on the plural name of\nthe requested resource.

\n\nTo update an resource, requests should use the `PATCH` method. Update\noperations support partial updating so requests may specify only the\nattributes which should be updated. Update operations return the updated\nresource in the response.

\n\nTo delete a resource, requests should use the `DELETE` method. Note that\ndelete operations return an empty response instead of returning the\nresource in the response.

\n\n### Example Response for a Realm\n\n```\n{\n \"id\": \"a448fe493e02fa9f\",\n \"tenant_id\": \"000168dc50bdce49\",\n \"display_name\": \"Test Realm\",\n \"create_time\": \"2022-06-22T21:46:08.930278Z\",\n \"update_time\": \"2022-06-22T21:46:08.930278Z\"\n}\n```\n\n### Example Response for a Collection of Realms\n\n```\n{\n \"realms\": [\n {\n \"id\": \"a448fe493e02fa9f\",\n \"tenant_id\": \"000168dc50bdce49\",\n \"display_name\": \"Test Realm\",\n \"create_time\": \"2022-06-22T21:46:08.930278Z\",\n \"update_time\": \"2022-06-22T21:46:08.930278Z\"\n }\n ],\n \"total_size\": 1\n}\n```\n\n## HTTP Statuses\n\nThe API returns standard HTTP statuses and error codes.\n\nStatuses in the 200 range indicate that the request was successfully\nfulfilled and there were no errors.

\n\nStatuses in the 400 range indicate that there was an issue with the request\nthat may be addressed by the client. For example, client errors may\nindicate that the request was missing proper authorization or that the\nrequest was malformed.

\n\nStatuses in the 500 range indicate that the server encountered an internal\nissue and was unable to fulfill the request.

\n\nAll error responses include a JSON object with a `code` field and a\n`message` field. `code` contains a human-readable name for the HTTP status\ncode and `message` contains a high-level description of the error. The\nerror object may also contain additional error details which may be used by\nthe client to determine the exact cause of the error. Refer to each API\nmethod's examples to determine the specific error detail types supported\nfor that method.

\n\n### Invalid Access Token Example\n\nIf the provided access token is invalid, you will receive a 401 error.\nThis error indicates that the token is not recognized and was not generated\nby Beyond Identity.

\n\n```\nHTTP/1.1 401 Unauthorized\n{\n \"code\": \"unauthorized\",\n \"message\": \"unauthorized\"\n}\n```\n\n### Permission Denied Example\n\nIf the provided access token does not have access to the requested resource,\nyou will receive a 403 error. Access tokens are scoped at a minimum to your\ntenant. Any request for resources outside of your tenant will result in this\nerror.

\n\n```\nHTTP/1.1 403 Forbidden\n{\n \"code\": \"forbidden\",\n \"message\": \"forbidden\"\n}\n```\n\n### Missing Resource Example\n\nIf the requested resource does not exist, you will receive a 404 error. The\nspecific API method may return additional details about the missing\nresource.

\n\n```\nHTTP/1.1 404 Not Found\n{\n \"code\": \"not_found\",\n \"message\": \"group not found\"\n \"details\": [\n {\n \"type\": \"ResourceInfo\",\n \"resource_type\": \"Group\",\n \"id\": \"4822738be6b7f658\",\n \"description\": \"group not found\"\n }\n ],\n}\n```\n\n### Invalid Parameters Example\n\nIf the request body contains invalid parameters, you will receive a 400\nerror. The specific API method may return additional details about the\ninvalid parameter.

\n\n```\nHTTP/1.1 400 Bad Request\n{\n \"code\": \"bad_request\",\n \"message\": \"invalid parameters\"\n \"details\": [\n {\n \"type\": \"FieldViolations\"\n \"field_violations\": [\n {\n \"description\": \"missing\",\n \"field\": \"group.display_name\"\n }\n ],\n }\n ],\n}\n```\n" servers: - url: https://api-us.beyondidentity.com description: US region API base URL - url: https://api-eu.beyondidentity.com description: EU region API base URL - url: https://api.us1.beyondidentity-gov.com/ description: US FedRAMP API base URL security: - BearerAuth: [] tags: - name: SSO Configs description: 'An SSO configuration defines how end users interact with supported SSO protocols and related services. Each configuration type represents a protocol or integration (e.g., SAML, WS-Federation, OIDC, SCIM) supported by Beyond Identity. An SSO configuration provides a flexible framework for managing authentication, provisioning, and other integrations. It abstracts application protocols, inbound and outbound provisioning, and supports named integrations. Additionally, it includes features like user or group assignments, visual tiles in the SSO interface, and compatibility with multiple authentication and provisioning standards. This makes SSO configurations versatile for both authentication and non-authentication use cases. ' paths: /v1/tenants/{tenant_id}/realms/{realm_id}/sso-configs: post: summary: Create a new SSO Config. description: 'To create a new SSO Config, send a POST request to `/v1/tenants/$TENANT_ID/realms/$REALM_ID/sso-configs`. ' tags: - SSO Configs operationId: CreateSsoConfig parameters: - $ref: '#/components/parameters/correlation_id' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/parameters/1' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/parameters/2' security: - BearerAuth: - sso-configs:create requestBody: content: application/json: schema: $ref: '#/components/schemas/SsoConfigEnvelope' responses: '200': description: The sso config has been created. headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' content: application/json: schema: description: Represents an SSO config as a response body. type: object required: - id - display_name - payload properties: id: description: A unique identifier for an SSO config. This is automatically generated on creation. This field is immutable and read-only. This field is unique within the realm. type: string format: uuid display_name: description: A human-readable name for the SSO config. This name is used for display purposes. type: string payload: oneOf: - type: object required: - type - login_link properties: type: $ref: '#/components/schemas/SsoConfigType' login_link: type: string icon: type: string is_tile_visible: type: boolean application_tile_id: type: string - type: object required: - type - redirect_uris - application_id - authenticator_config_id - resource_server_id - oidc_configuration - client_id - discover_endpoint properties: type: $ref: '#/components/schemas/SsoConfigType' redirect_uris: type: array items: type: string oidc_configuration: type: object required: - grant_types_supported - introspect_endpoint - issuer - jwks_uri - response_types_supported - token_endpoint - token_endpoint_auth_methods_supported properties: issuer: type: string authorization_endpoint: type: string nullable: true token_endpoint: type: string userinfo_endpoint: type: string nullable: true jwks_uri: type: string response_types_supported: type: array items: type: string enum: - code - id_token token_endpoint_auth_methods_supported: type: array items: $ref: '#/components/schemas/TokenEndpointAuthMethod' client_id: description: The client ID for the idp application. type: string inbound_scim: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/post/responses/200/content/application~1json/schema/properties/payload/oneOf/8/allOf/0' application_id: type: string authenticator_config_id: type: string resource_server_id: type: string discover_endpoint: $ref: '#/components/schemas/SsoConfigEntraIdExternalAuthMethod/properties/discover_endpoint' - type: object required: - type - redirect_uris - scopes - trusted_origins - confidentiality - pkce - application_id - authenticator_config_id - resource_server_id - oidc_configuration - client_id properties: type: $ref: '#/components/schemas/SsoConfigType' redirect_uris: type: array items: type: string scopes: type: array items: type: string trusted_origins: type: array items: type: string login_link: type: string icon: type: string is_tile_visible: type: boolean confidentiality: $ref: '#/components/schemas/Confidentiality' pkce: $ref: '#/components/schemas/PkceConfig' oidc_configuration: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/post/responses/200/content/application~1json/schema/properties/payload/oneOf/1/properties/oidc_configuration' client_id: description: The client ID for the idp application. type: string client_secret: description: The client secret to authenticate as the idp application. type: string inbound_scim: $ref: '#/components/schemas/SsoConfigType' application_id: type: string authenticator_config_id: type: string resource_server_id: type: string application_tile_id: type: string - type: object required: - type - client_id - pkce - identifying_claim_name - identity_attribute - authorization_endpoint - token_endpoint - jwks_endpoint - redirect_uri - identity_provider_id properties: type: $ref: '#/components/schemas/SsoConfigType' client_id: description: The client ID for the idp application. type: string client_secret: description: The client secret to authenticate as the idp application. type: string pkce: $ref: '#/components/schemas/PkceConfig' id_token_scopes: type: array items: type: string identifying_claim_name: type: string identity_attribute: $ref: '#/components/schemas/SubjectField' authorization_endpoint: type: string nullable: true token_endpoint: type: string jwks_endpoint: type: string redirect_uri: type: string identity_provider_id: type: string - type: object properties: type: $ref: '#/components/schemas/SsoConfigType' acs_url: type: string description: The Assertion Consumer Service (ACS) URL where the SAML assertions are sent. override_recipient_and_destination: type: boolean description: Flag to override the recipient and destination URLs in the SAML response. recipient_url: type: string description: The recipient URL for the SAML response. destination_url: type: string description: The destination URL for the SAML response. audience_url: type: string description: The URL that identifies the intended audience for the SAML assertion. default_relay_state: type: string description: The default relay state parameter for the SAML response. name_format: $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/name_format' description: The format of the NameID in the SAML assertion. authentication_context: $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/authentication_context' description: The authentication context for the SAML assertion. subject_user_name_attribute: $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/subject_user_name_attribute' description: The attribute used for the subject's username in the SAML assertion. sign_envelope: type: boolean description: Flag indicating whether to sign the SAML envelope. sign_assertions: type: boolean description: Flag indicating whether to sign the SAML assertions. signature_algorithm: $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/signature_algorithm' description: The algorithm used for signing the SAML assertions. digest_algorithm: $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/digest_algorithm' description: The algorithm used for the digest of the SAML assertions. encrypt_assertions: type: boolean description: Flag indicating whether to encrypt the SAML assertions. assertion_validity_duration_seconds: type: integer format: int32 description: The duration (in seconds) for which the SAML assertion is valid. assertion_encryption_algorithm: $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/assertion_encryption_algorithm' description: The algorithm used for encrypting the SAML assertions. assertion_key_transport_algorithm: $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/assertion_key_transport_algorithm' description: The algorithm used for key transport when encrypting SAML assertions. assertion_encryption_public_key: type: string description: The public key used for encrypting the SAML assertions. sp_signature_certificates: type: array items: $ref: '#/components/schemas/SsoConfigSamlPartialUpdate/properties/sp_signature_certificates/items' description: The certificates used for signing the SAML assertions. enable_single_log_out: type: boolean description: Flag indicating whether to enable single logout (SLO) functionality. single_log_out_url: type: string description: The URL for single logout (SLO). single_log_out_issuer_url: type: string description: The issuer URL for single logout (SLO). single_log_out_binding: $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/single_log_out_binding' description: The binding method for single logout (SLO) requests. single_logout_sign_request_and_response: type: boolean description: Flag indicating whether to sign the single logout (SLO) requests and responses. validate_signed_requests: type: boolean description: Flag indicating whether to validate signed SAML requests. other_sso_urls: $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/other_sso_urls' description: Other SSO URLs associated with the configuration. additional_user_attributes: description: Additional user attributes to include in the SAML assertions. type: array items: $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/additional_user_attributes' icon: type: string description: The icon associated with the SSO configuration. is_tile_visible: type: boolean description: Flag indicating whether the configuration tile is visible. application_id: type: string description: The application ID associated with the SSO configuration. authenticator_config_id: type: string description: The authenticator configuration ID. application_tile_id: type: string description: The application tile ID. idp_initiated_url: type: string description: The URL for IdP-initiated SSO. sp_initiated_url: type: string description: The URL for SP-initiated SSO. inbound_scim: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/post/responses/200/content/application~1json/schema/properties/payload/oneOf/8/allOf/0' use_short_url: default: false type: boolean description: Changes the EntityID in the SAML response to a shorter version. This is to support applications with URL restrictions. short_sp_initiated_url: type: string description: This is the shortened URL that will be used to initiate a SAML login from the service provider side. Generated and provided by Beyond Identity. This should only be displayed when `use_short_urls` is true. short_entity_id_url: type: string description: This is the shortened URL that we will use as our issuer inside of a SAML response. - type: object required: - type - client_id - pkce - identifying_claim_name - identity_attribute - okta_domain - authorization_endpoint - token_endpoint - jwks_endpoint - redirect_uri - identity_provider_id properties: type: $ref: '#/components/schemas/SsoConfigType' client_id: description: The client ID for the idp application. type: string client_secret: description: The client secret to authenticate as the idp application. type: string pkce: allOf: - $ref: '#/components/schemas/PkceConfig' id_token_scopes: type: array items: type: string identifying_claim_name: type: string identity_attribute: $ref: '#/components/schemas/SubjectField' okta_domain: type: string authorization_endpoint: type: string nullable: true token_endpoint: type: string jwks_endpoint: type: string redirect_uri: type: string identity_provider_id: type: string inbound_scim: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/post/responses/200/content/application~1json/schema/properties/payload/oneOf/8/allOf/0' - type: object required: - type - pkce - oidc_configuration - client_id - client_secret - application_id - authenticator_config_id - okta_registration properties: type: $ref: '#/components/schemas/SsoConfigType' pkce: allOf: - $ref: '#/components/schemas/PkceConfig' oidc_configuration: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/post/responses/200/content/application~1json/schema/properties/payload/oneOf/1/properties/oidc_configuration' client_id: description: The client ID for the idp application. type: string client_secret: description: The client secret to authenticate as the idp application. type: string okta_registration: $ref: '#/components/schemas/SsoConfigOktaBiIdp/properties/okta_registration' inbound_scim: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/post/responses/200/content/application~1json/schema/properties/payload/oneOf/8/allOf/0' application_id: type: string authenticator_config_id: type: string - type: object required: - type - company_identifier properties: type: $ref: '#/components/schemas/SsoConfigType' company_identifier: type: string - type: object required: - type - application_id - client_id - client_secret - scim_url - token_endpoint properties: type: $ref: '#/components/schemas/SsoConfigType' allOf: - type: object required: - application_id - client_id - client_secret - scim_url - token_endpoint properties: application_id: type: string client_id: description: The client ID for the scim application. type: string client_secret: description: The client secret for the scim application. type: string scim_url: description: Beyond Identity Scim server endpoint type: string token_endpoint: type: string - type: object required: - type - acs_url - override_recipient_and_destination - audience_url - default_relay_state - name_format - authentication_context - subject_user_name_attribute - sign_envelope - sign_assertions - signature_algorithm - digest_algorithm - encrypt_assertions - assertion_validity_duration_seconds - sp_signature_certificates - enable_single_log_out - validate_signed_requests - additional_user_attributes - application_id - authenticator_config_id - idp_initiated_url - sp_initiated_url properties: type: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/post/responses/200/content/application~1json/schema/properties/payload/oneOf/8/allOf/0' description: The type of SSO configuration. acs_url: type: string expiration_time_seconds: type: integer format: int32 audience_url: type: string digest_algorithm: $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/digest_algorithm' signature_algorithm: $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/signature_algorithm' name_format: $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/name_format' subject_user_name_attribute: $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/subject_user_name_attribute' authentication_context: $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/authentication_context' additional_user_attributes: type: array items: $ref: '#/components/schemas/SsoConfigWsFed/properties/additional_user_attributes/items' icon: type: string description: The icon associated with the SSO configuration. is_tile_visible: type: boolean description: Flag indicating whether the configuration tile is visible. application_id: type: string description: The application ID associated with the SSO configuration. authenticator_config_id: type: string description: The authenticator configuration ID. application_tile_id: type: string description: The application tile ID. idp_sso_url: type: string idp_issuer_url: type: string metadata_url: type: string inbound_scim: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/post/responses/200/content/application~1json/schema/properties/payload/oneOf/8/allOf/0' '400': description: The request is malformed. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '401': description: An invalid Authorization token has been supplied. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '403': description: The supplied authorization token doesn't allow the requested operation. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '500': description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' get: summary: List SSO Configs for a Realm. description: 'To list SSO Configs for a Realm, send a GET request to `/v1/tenants/$TENANT_ID/realms/$REALM_ID/sso-configs`. The response will contain at most 200 items and may contain a page token to query the remaining items. If page size is not specified, the response will contain 20 items. There is no defined ordering of the list of identities in the response. Note that the maximum and default page sizes are subject to change. When paginating, the page size is maintained by the page token but may be overridden on subsequent requests. Page tokens expire after one week. Requests which specify an expired page token will result in undefined behavior. ' tags: - SSO Configs operationId: listSsoConfigs parameters: - $ref: '#/components/parameters/correlation_id' - name: tenant_id in: path description: A unique identifier for a tenant. required: true schema: type: string example: 000176d94fd7b4d1 - name: realm_id in: path description: A unique identifier for a realm. required: true schema: type: string example: 19a95130480dfa79 - $ref: '#/components/parameters/page_size' - $ref: '#/components/parameters/page_token' - name: type in: query required: false description: The type of sso config to filter by. You may query with multiple types for example "/sso-configs?type=generic_oidc&type=generic_oid_idp" schema: type: array items: $ref: '#/components/schemas/SsoConfigType' - name: is_migrated in: query required: false schema: type: boolean - name: order_by in: query required: false schema: type: string security: - BearerAuth: - sso-configs:read responses: '200': description: Successful response. content: application/json: schema: description: Represents a list of sso configs as a response body. type: object required: - sso_configs - total_size properties: sso_configs: description: The sso configs which are part of the response. type: array items: description: Represents an SSO config as a response body. type: object required: - id - display_name - payload properties: id: description: A unique identifier for an SSO config. This is automatically generated on creation. This field is immutable and read-only. This field is unique within the realm. type: string format: uuid display_name: description: A human-readable name for the SSO config. This name is used for display purposes. type: string payload: oneOf: - type: object required: - type - login_link properties: type: $ref: '#/components/schemas/SsoConfigType' login_link: type: string icon: type: string is_tile_visible: type: boolean - type: object required: - type - redirect_uris - discover_endpoint properties: type: $ref: '#/components/schemas/SsoConfigType' redirect_uris: type: array items: type: string discover_endpoint: $ref: '#/components/schemas/SsoConfigEntraIdExternalAuthMethod/properties/discover_endpoint' - type: object required: - type - redirect_uris properties: type: $ref: '#/components/schemas/SsoConfigType' redirect_uris: type: array items: type: string login_link: type: string icon: type: string is_tile_visible: type: boolean - type: object required: - type properties: type: $ref: '#/components/schemas/SsoConfigType' - type: object required: - type properties: type: description: The type of the SSO configuration. $ref: '#/components/schemas/SsoConfigType' icon: description: The URL or data URI of the icon representing the SSO configuration. type: string is_tile_visible: description: Indicates if the SSO configuration tile is visible to the user. type: boolean - type: object required: - type properties: type: $ref: '#/components/schemas/SsoConfigType' - type: object required: - type properties: type: $ref: '#/components/schemas/SsoConfigType' - type: object required: - type - company_identifier properties: type: $ref: '#/components/schemas/SsoConfigType' company_identifier: type: string - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/post/responses/200/content/application~1json/schema/properties/payload/oneOf/8' - type: object required: - type properties: type: description: The type of the SSO configuration. $ref: '#/components/schemas/SsoConfigType' icon: description: The URL or data URI of the icon representing the SSO configuration. type: string is_tile_visible: description: Indicates if the SSO configuration tile is visible to the user. type: boolean total_size: description: The total number of sso configs contained by the Realm. type: integer format: uint minimum: 0 next_page_token: description: The value to be passed as the page_token parameter to retrieve the next page. type: string nullable: true headers: x-correlation-id: description: Correlation ID. If supplied with the request, the response must contain the same value. If not supplied with the request, it is generated by the server and returned in the response. required: true schema: type: string '400': description: The request is malformed. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '401': description: An invalid Authorization token has been supplied. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '403': description: The supplied authorization token doesn't allow the requested operation. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '500': description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' /v1/tenants/{tenant_id}/realms/{realm_id}/sso-configs/{sso_config_id}: get: summary: Retrieves an existing SSO Config. description: 'To retrieve an existing SSO Config, send a GET request to `/v1/tenants/$TENANT_ID/realms/$REALM_ID/sso-configs/$SSO_CONFIG_ID`. ' tags: - SSO Configs operationId: GetSsoConfig security: - BearerAuth: - sso-configs:read parameters: - $ref: '#/components/parameters/correlation_id' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/parameters/1' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/parameters/2' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1identity-providers/get/parameters/3' responses: '200': description: The sso config has been found. headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' content: application/json: schema: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/post/responses/200/content/application~1json/schema' '400': description: The request is malformed. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '401': description: An invalid Authorization token has been supplied. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '403': description: The supplied authorization token doesn't allow the requested operation. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '404': description: sso config not found. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '500': description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' patch: summary: Updates an SSO Config by its ID. description: Updates an SSO Config by its ID. tags: - SSO Configs operationId: UpdateSsoConfig security: - BearerAuth: - sso-configs:update parameters: - $ref: '#/components/parameters/correlation_id' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/parameters/1' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/parameters/2' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1identity-providers/get/parameters/3' requestBody: content: application/json: schema: $ref: '#/components/schemas/SsoConfigPartialUpdate' required: true responses: '200': description: Successful response. content: application/json: schema: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/post/responses/200/content/application~1json/schema' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '400': description: The request is malformed. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '401': description: An invalid Authorization token has been supplied. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '403': description: The supplied authorization token doesn't allow the requested operation. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '404': description: SSO Config not found. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '500': description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' delete: summary: Deletes an SSO Config by its ID. description: Deletes an SSO Config by its ID. tags: - SSO Configs operationId: DeleteSsoConfig security: - BearerAuth: - sso-configs:delete parameters: - $ref: '#/components/parameters/correlation_id' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/parameters/1' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/parameters/2' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1identity-providers/get/parameters/3' responses: '200': description: The action was successful and the response body is empty. '400': description: The request is malformed. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '401': description: An invalid Authorization token has been supplied. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '403': description: The supplied authorization token doesn't allow the requested operation. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '404': description: SSO Config not found. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '500': description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' /v1/tenants/{tenant_id}/realms/{realm_id}/sso-configs/{sso_config_id}:addIdentities: post: tags: - SSO Configs operationId: AddIdentitiesToSsoConfig summary: Associate Identities with an SSO Config description: 'To associate identities to an sso config. The request must contain at least one and no more than 1000 identity IDs. ' security: - BearerAuth: - sso-configs:update parameters: - $ref: '#/components/parameters/correlation_id' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/parameters/1' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/parameters/2' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1identity-providers/get/parameters/3' requestBody: content: application/json: schema: $ref: '#/components/schemas/SsoConfigAddIdentities' responses: '200': description: The action was successful and the response body is empty. '400': description: The request is malformed. content: application/json: schema: $ref: '#/components/schemas/Error' examples: schema: value: code: bad_request message: invalid parameters details: - type: FieldViolations field_violations: - field: identity_ids description: array exceeds 1000 elements headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '401': description: An invalid Authorization token has been supplied. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '403': description: The supplied authorization token doesn't allow the requested operation. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '404': description: Resource server not found. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '500': description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' /v1/tenants/{tenant_id}/realms/{realm_id}/sso-configs/{sso_config_id}:deleteIdentities: post: tags: - SSO Configs operationId: DeleteIdentitiesFromSsoConfig summary: Delete Identities from an SSO Config description: 'To delete identities from an sso config. The request must contain at least one and no more than 1000 identities IDs. ' security: - BearerAuth: - sso-configs:update parameters: - $ref: '#/components/parameters/correlation_id' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/parameters/1' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/parameters/2' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1identity-providers/get/parameters/3' requestBody: content: application/json: schema: title: Delete Identities from SSO Config description: Request for DeleteIdentitiesFromSsoConfig. type: object properties: identity_ids: description: IDs of the identities to be removed from the sso config. type: array items: type: string minItems: 1 maxItems: 1000 required: - identity_ids examples: Remove Identities: value: identity_ids: - e372db224c06e850 - 3a28d4f28b57cc93 responses: '200': description: The action was successful and the response body is empty. '400': description: The request is malformed. content: application/json: schema: $ref: '#/components/schemas/Error' examples: Invalid Parameters: value: code: bad_request message: invalid parameters details: - type: FieldViolations field_violations: - field: identities_ids description: array exceeds 1000 elements headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '401': description: An invalid Authorization token has been supplied. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '403': description: The supplied authorization token doesn't allow the requested operation. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '404': description: Resource server not found. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '500': description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' /v1/tenants/{tenant_id}/realms/{realm_id}/sso-configs/{sso_config_id}:listIdentityAssociations: get: tags: - SSO Configs operationId: ListIdentitiesForSsoConfig summary: List Identities Directly and Indirectly Associated With an SSO Config. description: 'To list identities belonging to an sso config. Note that there may be duplicate identities or an empty array in the response, but as long as there is a `page_token` then pagination should continue. ' security: - BearerAuth: - sso-configs:read - identities:read - groups:read parameters: - $ref: '#/components/parameters/correlation_id' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/parameters/1' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/parameters/2' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1identity-providers/get/parameters/3' - $ref: '#/components/parameters/page_size' - $ref: '#/components/parameters/page_token' responses: '200': description: 'The response will be a JSON object with keys for `identities`. `identities` will be set to an array of identity objects. If there are more items to be returned by the requested query, the response will also contain a key called `next_page_token`. ' content: application/json: schema: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1identities~1%7Bidentity_id%7D~1sso-configs/get/responses/200/content/application~1json/schema' examples: Success: value: identities: - id: e372db224c06e850 realm_id: 8f5bec58229e6f29 tenant_id: 0001f1f460b1ace6 group_id: 923935b2912304 group_display_name: Test Group display_name: Test Identity create_time: '2022-04-12T05:53:07.119Z' update_time: '2022-06-16T14:31:03.770Z' traits: type: traits_v0 username: test primary_email_address: test@example.com '400': description: The request is malformed. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '401': description: An invalid Authorization token has been supplied. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '403': description: The supplied authorization token doesn't allow the requested operation. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '500': description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' /v1/tenants/{tenant_id}/realms/{realm_id}/identities/{identity_id}/sso-configs/{sso_config_id}/is-identity-assigned: get: summary: Returns if an identity is assigned to the SSO config id. description: 'To check if an identity is assigned to the SSO config id, send a GET request to `/v1/tenants/$TENANT_ID/realms/$REALM_ID/identities/$IDENTITY_ID/sso-configs/$SSO_CONFIG_ID/is-identity-assigned`. ' tags: - SSO Configs operationId: IdentityToSSOConfigCheck parameters: - $ref: '#/components/parameters/correlation_id' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/parameters/1' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/parameters/2' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1identity-providers/get/parameters/3' security: - BearerAuth: - sso-configs:read responses: '200': description: Successful response. content: application/json: schema: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs~1%7Bsso_config_id%7D~1is-group-assigned/post/responses/200/content/application~1json/schema' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '400': description: The request is malformed. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '401': description: An invalid Authorization token has been supplied. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '403': description: The supplied authorization token doesn't allow the requested operation. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '500': description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' /v1/tenants/{tenant_id}/realms/{realm_id}/identities/{identity_id}/sso-configs: get: tags: - SSO Configs operationId: ListSsoConfigsForIdentity summary: List SSO configs directly and indirectly associated with an identity. description: 'To list sso configs associated with an identity. This will return all SSO configs that have an association with the specified identity ID. Note that there may be duplicate SSO configs or an empty array in the response, but as long as there is a `page_token` pagination should continue. ' security: - BearerAuth: - sso-configs:read parameters: - $ref: '#/components/parameters/correlation_id' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/parameters/1' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/parameters/2' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1identity-providers/get/parameters/3' - $ref: '#/components/parameters/page_size' - $ref: '#/components/parameters/page_token' - $ref: '#/components/parameters/identity_id' responses: '200': description: 'The response will be a JSON object with keys for `sso_configs` and `total_size`. `total_size` will be set to the total number of items matched by the list request. If there are more items to be returned by the requested query, the response will also contain a key called `next_page_token`. ' content: application/json: schema: title: List Identities directly and indirectly associated with an SSO config. description: List Identities Directly and Indirectly Associated With an SSO Config. type: object properties: identities: type: array items: allOf: - $ref: '#/components/schemas/Identity' - properties: group_id: description: If the association is through a group, the group ID will be added to the response object. type: string group_display_name: description: If the association is through a group, the group display name will be added to the response object. type: string maxItems: 200 description: An unordered array of identities corresponding to the request. next_page_token: type: string description: 'Token used to fetch the next set of results. If this field is omitted, there are no subsequent pages. ' required: - identities - total_size '400': description: The request is malformed. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '401': description: An invalid Authorization token has been supplied. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '403': description: The supplied authorization token doesn't allow the requested operation. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '500': description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' /v1/tenants/{tenant_id}/realms/{realm_id}/sso-configs/{sso_config_id}:addGroups: post: tags: - SSO Configs operationId: AddGroupsToSsoConfig summary: Associate Groups with an SSOConfig description: 'To associate groups to an sso config. The request must contain at least one and no more than 1000 group IDs. ' security: - BearerAuth: - sso-configs:update parameters: - $ref: '#/components/parameters/correlation_id' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/parameters/1' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/parameters/2' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1identity-providers/get/parameters/3' requestBody: content: application/json: schema: title: Associate Groups with SSO Config description: Request for AddGroupsToSsoConfig. type: object properties: group_ids: description: IDs of the groups to be added to the sso config. type: array items: type: string minItems: 1 maxItems: 1000 required: - group_ids examples: Add Members: value: group_ids: - e372db224c06e850 - 3a28d4f28b57cc93 responses: '200': description: The action was successful and the response body is empty. '400': description: The request is malformed. content: application/json: schema: $ref: '#/components/schemas/Error' examples: Invalid Parameters: value: code: bad_request message: invalid parameters details: - type: FieldViolations field_violations: - field: group_ids description: array exceeds 1000 elements headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '401': description: An invalid Authorization token has been supplied. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '403': description: The supplied authorization token doesn't allow the requested operation. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '404': description: Resource server not found. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '500': description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' /v1/tenants/{tenant_id}/realms/{realm_id}/sso-configs/{sso_config_id}:deleteGroups: post: tags: - SSO Configs operationId: DeleteGroupsFromSsoConfig summary: Delete Groups from an SSO Config description: 'To delete groups from an sso config. The request must contain at least one and no more than 1000 group IDs. ' security: - BearerAuth: - sso-configs:update parameters: - $ref: '#/components/parameters/correlation_id' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/parameters/1' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/parameters/2' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1identity-providers/get/parameters/3' requestBody: content: application/json: schema: $ref: '#/components/schemas/SsoConfigDeleteGroup' examples: Remove Members: value: group_ids: - e372db224c06e850 - 3a28d4f28b57cc93 responses: '200': description: The action was successful and the response body is empty. '400': description: The request is malformed. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '401': description: An invalid Authorization token has been supplied. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '403': description: The supplied authorization token doesn't allow the requested operation. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '404': description: Resource server not found. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '500': description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' /v1/tenants/{tenant_id}/realms/{realm_id}/sso-configs/{sso_config_id}:listGroupAssociations: get: tags: - SSO Configs operationId: ListGroupsForSSOConfig summary: List Groups associated with an SSO config. description: 'To list groups associated with an SSO config, send a GET request to `/v1/tenants/$TENANT_ID/realms/$REALM_ID/sso-configs/$SSO_CONFIG_ID/groups`. ' security: - BearerAuth: - sso-configs:read - groups:read parameters: - $ref: '#/components/parameters/correlation_id' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/parameters/1' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/parameters/2' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1identity-providers/get/parameters/3' responses: '200': description: 'The response will be a JSON object with keys for `groups` and `total_size`. `groups` will be set to an array of group objects. `total_size` will be set to the total number of items matched by the list request. If there are more items to be returned by the requested query, the response will also contain a key called `next_page_token`. ' content: application/json: schema: $ref: '#/components/schemas/SsoConfigListGroups' examples: Success: value: code: bad_request message: invalid parameters details: - type: FieldViolations field_violations: - field: identity_ids description: array exceeds 1000 elements '400': description: The request is malformed. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '401': description: An invalid Authorization token has been supplied. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '403': description: The supplied authorization token doesn't allow the requested operation. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '500': description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' /v1/tenants/{tenant_id}/realms/{realm_id}/groups/{group_id}/sso-configs: get: tags: - SSO Configs operationId: ListSsoConfigsForGroup summary: List SSO Configs associated with a Group. description: 'To list sso configs associated with a group. This will return all SSO configs that have an association with the specified group ID. ' security: - BearerAuth: - sso-configs:read parameters: - $ref: '#/components/parameters/correlation_id' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/parameters/1' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/parameters/2' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1identity-providers/get/parameters/3' - $ref: '#/components/parameters/page_size' - $ref: '#/components/parameters/page_token' - $ref: '#/components/parameters/group_id' responses: '200': description: 'The response will be a JSON object with keys for `sso_configs` and `total_size`. `total_size` will be set to the total number of items matched by the list request. If there are more items to be returned by the requested query, the response will also contain a key called `next_page_token`. ' content: application/json: schema: title: List SSO configs directly and indirectly associated with an identity. description: List SSO configs directly and indirectly associated with an identity. type: object properties: sso_configs: type: array items: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/content/application~1json/schema/properties/sso_configs/items' total_size: type: integer format: uint32 description: 'Total number of results returned by the operation. This value may be larger than the number of resources returned, such as when returning a single page where multiple pages are available. ' example: 1000 next_page_token: type: string description: 'Token used to fetch the next set of results. If this field is omitted, there are no subsequent pages. ' required: - sso_configs - total_size '400': description: The request is malformed. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '401': description: An invalid Authorization token has been supplied. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '403': description: The supplied authorization token doesn't allow the requested operation. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '500': description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' /v1/tenants/{tenant_id}/realms/{realm_id}/sso-configs/{sso_config_id}/is-group-assigned: post: summary: Check if any of the groups provided are associated with the SSO Config ID. description: Check if any of the groups provided are associated with the SSO Config ID. tags: - SSO Configs operationId: SSOIsGroupAssigned parameters: - $ref: '#/components/parameters/correlation_id' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/parameters/1' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/parameters/2' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1identity-providers/get/parameters/3' requestBody: content: application/json: schema: type: object description: 'A collection of group ids. ' properties: group_ids: type: array items: type: string description: A group id. required: true security: - BearerAuth: - sso-configs:read responses: '200': description: Successful response. content: application/json: schema: type: object description: 'Used to indicate if the result of a request is associated with an SSO Config. This could be through an Identity or a group depending on the endpoint used. ' required: - is_assigned_to_sso_config headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '400': description: The request is malformed. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '401': description: An invalid Authorization token has been supplied. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '403': description: The supplied authorization token doesn't allow the requested operation. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '500': description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' /v1/tenants/{tenant_id}/realms/{realm_id}/applications/{application_id}/sso-configs-id: get: summary: Returns the ID of the SSO Config associated with the Application. description: Returns the ID of the SSO Config associated with the application. tags: - SSO Configs operationId: ApplicationIdToSSOConfigId parameters: - $ref: '#/components/parameters/correlation_id' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/parameters/1' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/parameters/2' - $ref: '#/components/parameters/application_id' security: - BearerAuth: - sso-configs:read responses: '200': description: Successful response. content: application/json: schema: $ref: '#/components/schemas/ApplicationSsoResponse' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '400': description: The request is malformed. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '401': description: An invalid Authorization token has been supplied. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '403': description: The supplied authorization token doesn't allow the requested operation. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' '500': description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/Error' headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' /v1/tenants/{tenant_id}/realms/{realm_id}/sso-configs/{sso_config_id}/test: post: summary: Tests an SSO Config. description: Tests an SSO Config. tags: - SSO Configs operationId: TestSsoConfig parameters: - $ref: '#/components/parameters/correlation_id' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/parameters/1' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/parameters/2' - $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1identity-providers/get/parameters/3' security: - BearerAuth: - sso-configs:read responses: '200': description: The sso config has been tested. headers: x-correlation-id: $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id' content: application/json: schema: description: Represents an SSO config test response body. type: object required: - identity_providers - oidc_applications properties: identity_providers: type: array items: $ref: '#/components/schemas/IdentityProviderTestResponse' oidc_applications: type: array items: description: Represents an SSO config test response body. type: object required: - application_id - display_name - is_success - status_code properties: application_id: type: string display_name: type: string is_success: type: boolean status_code: type: string error_context: type: string example: identity_providers: - identity_provider_id: '123' display_name: Okta IDP is_successful: true status_code: 200 - identity_provider_id: '456' display_name: Ping IDP is_successful: false status_code: 500 error_context: "\n\n\n \n \n \n\n zeropw-rolling - Bad Request\n\n \n\n \n \n\n \n \n\n\n\n \n\n\n
\n
\n
\n
\n \"zeropw-rolling\"\n
\n
\n \n
400
\n \n
\n
\n

Bad Request

\n

Your request resulted in an error. The 'redirect_uri' parameter must be a Login redirect URI in the client app settings: https://zeropw-rolling-admin.oktapreview.com/admin/app/oidc_client/instance/0oa24fkg4hed8IxFK0h8#tab-general

\n Go to Homepage\n\n
\n \n Technical Details\n ▾\n

Identity Provider: Unknown, Error Code: invalid_request

\n
\n
\n
\n
\n\nEND_USER_APP\n\n
\n

\n Error: The 'redirect_uri' parameter must be a Login redirect URI in the client app settings: https://zeropw-rolling-admin.oktapreview.com/admin/app/oidc_client/instance/0oa24fkg4hed8IxFK0h8#tab-general

\n 
\n    
\n"
        '400':
          description: The request is malformed.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          headers:
            x-correlation-id:
              $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id'
        '401':
          description: An invalid Authorization token has been supplied.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          headers:
            x-correlation-id:
              $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id'
        '403':
          description: The supplied authorization token doesn't allow the requested operation.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          headers:
            x-correlation-id:
              $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id'
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          headers:
            x-correlation-id:
              $ref: '#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/responses/200/headers/x-correlation-id'
components:
  schemas:
    SubjectField:
      description: 'Defines which field should be used to populate the subject field of an id token.

        - `id` - The user ID is used.

        - `email` - The user email is used.

        - `username` - The username is used.

        '
      type: string
      enum:
      - id
      - email
      - username
      - external_id
    SsoConfigWsFed:
      type: object
      required:
      - type
      - acs_url
      - audience_url
      - expiration_time_seconds
      - digest_algorithm
      - signature_algorithm
      - name_format
      - subject_user_name_attribute
      - authentication_context
      - additional_user_attributes
      properties:
        type:
          description: The type of the SSO configuration.
          $ref: '#/components/schemas/SsoConfigType'
        acs_url:
          description: 'This is where to redirect to. This is also known as the SP SSO url.

            '
          type: string
        audience_url:
          description: The Recipient/Audience of the RSTR.
          type: string
        expiration_time_seconds:
          description: The amount of time in seconds that the RSTR should be valid for.
          type: integer
          format: int32
        digest_algorithm:
          description: The algorithm used to create a digest inside of the token within the RSTR.
          $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/digest_algorithm'
        signature_algorithm:
          description: The algorithm used to create a signature inside of the token within the RSTR.
          $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/signature_algorithm'
        name_format:
          description: The format that should be used to identify the user that is logging into the system.
          $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/name_format'
        subject_user_name_attribute:
          description: 'The attribute on the identity that''s used to uniquely identify the user.

            This is also the source for the user name inside of the RSTR.

            '
          $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/subject_user_name_attribute'
        authentication_context:
          description: 'The SAML Authentication Context Class for the assertion''s authentication statement.

            Default value is "X509".

            '
          $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/authentication_context'
        additional_user_attributes:
          description: Any additional attributes to attach to the assertion.
          type: array
          items:
            description: 'This structure describes additional attributes that can be

              attached to SAML assertion inside of WS-Fed token.

              '
            type: object
            required:
            - name
            - name_format
            - value
            properties:
              name:
                description: The SAML attribute name.
                type: string
              name_format:
                description: The format that the attribute has.
                $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/name_format'
              value:
                description: The value to attach to the SAML value.
                $ref: '#/components/schemas/SsoConfigSamlPartialUpdate/properties/additional_user_attributes/items'
              namespace:
                type: string
                description: 'This is an XML namespace that is applied the attribute and all of

                  its children.

                  '
        icon:
          description: The URL or data URI of the icon representing the SSO configuration.
          type: string
        is_tile_visible:
          description: Indicates if the SSO configuration tile is visible to the user.
          type: boolean
        inbound_scim:
          default: null
          type: object
    SsoConfigRealityCheckPartialUpdate:
      type: object
      required:
      - type
      properties:
        type:
          $ref: '#/components/schemas/SsoConfigType'
        company_identifier:
          default: null
          type: string
    SsoConfigBookmark:
      type: object
      required:
      - type
      - login_link
      properties:
        type:
          $ref: '#/components/schemas/SsoConfigType'
        login_link:
          type: string
        icon:
          type: string
        is_tile_visible:
          type: boolean
    SsoConfigPayload:
      oneOf:
      - $ref: '#/components/schemas/SsoConfigBookmark'
      - $ref: '#/components/schemas/SsoConfigEntraIdExternalAuthMethod'
      - $ref: '#/components/schemas/SsoConfigGenericOidc'
      - $ref: '#/components/schemas/SsoConfigOidcIdp'
      - type: object
        required:
        - type
        - acs_url
        - override_recipient_and_destination
        - audience_url
        - default_relay_state
        - name_format
        - authentication_context
        - subject_user_name_attribute
        - sign_envelope
        - sign_assertions
        - signature_algorithm
        - digest_algorithm
        - encrypt_assertions
        - assertion_validity_duration_seconds
        - sp_signature_certificates
        - enable_single_log_out
        - validate_signed_requests
        - additional_user_attributes
        - single_logout_sign_request_and_response
        properties:
          type:
            type: string
            enum:
            - saml
          acs_url:
            description: 'Location where the SAML Response is sent via HTTP-POST. Often referred to as the SAML Assertion Consumer Service (ACS) URL.

              '
            type: string
            example: https://example.com/saml/acs
          override_recipient_and_destination:
            description: 'When this is true, the `recipient_url` and the `destination_url` are used for SAML Response.

              When this is false, both the `recipient_url` and the `destination_url` are omitted and the `acs_url` is used instead.

              '
            type: boolean
            example: true
          recipient_url:
            description: 'If `override_recipient_and_destination` is set to `true`, this field is utilized for the SAML Response. If it is `false`, this field is unused.

              The location where the application may present the SAML assertion. This is usually the same location as the Single Sign-On URL.

              '
            type: string
            example: https://example.com/saml/recipient
          destination_url:
            description: 'If `override_recipient_and_destination` is set to `true`, this field is utilized for the SAML Response. If it is `false`, this field is unused.

              Identifies the location where the SAML response is intended to be sent inside of the SAML assertion.

              '
            type: string
            example: https://example.com/saml/destination
          audience_url:
            description: 'The intended audience of the SAML assertion. Often referred to as the service provider Entity ID.

              '
            type: string
            example: https://example.com/saml/audience
          default_relay_state:
            description: 'Identifies a specific application resource in an IDP initiated Single Sign-On scenario. In most instances this is blank.

              '
            type: string
            example: defaultRelayState
          name_format:
            description: 'Name format of the assertion''s subject statement. Processing rules and constraints can be applied based on selection. Default value is "unspecified" unless SP explicitly requires differently.

              '
            type: string
            enum:
            - unspecified
            - email_address
            - x509_subject_name
            - persistent
            - transient
            - entity
            - kerberos
            - windows_domain_qualified_name
            example: unspecified
          authentication_context:
            description: 'The SAML Authentication Context Class for the assertion''s authentication statement. Default value is "X509".

              '
            type: string
            enum:
            - x509
            - integrated_windows_federation
            - kerberos
            - password
            - password_protected_transport
            - tls_client
            - unspecified
            - refeds_mfa
            example: x509
          subject_user_name_attribute:
            description: 'Determines the default value for a user''s application username. The application username will be used for the assertion''s subject statement.

              '
            type: string
            enum:
            - user_name
            - email
            - email_prefix
            - external_id
            - display_name
            - custom
            - none
            example: user_name
          sign_envelope:
            description: 'Determines whether the SAML authentication response message is digitally signed by the IdP or not. A digital signature is required to ensure that only your IdP generated the response message.

              '
            type: boolean
            example: true
          sign_assertions:
            description: All of the assertions should be signed by the IdP.
            type: boolean
            example: true
          signature_algorithm:
            description: 'The algorithm used for signing the SAML assertions.

              '
            type: string
            enum:
            - rsa_sha256
            - rsa_sha1
            - rsa_sha384
            - rsa_sha512
            example: rsa_sha256
          digest_algorithm:
            description: 'The algorithm used to encrypt the SAML assertion.

              '
            type: string
            enum:
            - sha256
            - sha1
            - sha384
            - sha512
            example: sha256
          encrypt_assertions:
            description: 'This is the flag that determines if the SAML assertion is encrypted. If this flag is set to `true`, there **MUST** be a SAML encryption certificate uploaded.

              Encryption ensures that nobody but the sender and receiver can understand the assertion.

              '
            type: boolean
            example: false
          assertion_validity_duration_seconds:
            description: 'The amount of time SAML assertions are valid for in seconds.

              '
            type: integer
            format: int32
            example: 300
          assertion_encryption_algorithm:
            description: 'The algorithm used for the digest in SAML assertions.

              '
            type: string
            enum:
            - aes256_cbc
            - aes256_gcm
            - aes128_cbc
            - aes128_gcm
            example: aes256_cbc
          assertion_key_transport_algorithm:
            description: 'The algorithm used for key transport in SAML assertions.

              '
            type: string
            enum:
            - rsa_oaep
            - rsa1_5
            example: rsa_oaep
          assertion_encryption_public_key:
            description: 'The public key used to encrypt the SAML assertion. This is required if `encrypt_assertions` is true.

              '
            type: string
            example: '-----BEGIN PUBLIC KEY-----


              MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr3Q4ebLzciJlVf4QDQ2u

              0Y2CfX9z4rMdG6MQSDW2NFQF0kM16Zzsz0p2gMOnp7YOz8OZqkU2XgUN3kQ8zC1h

              q+um2mU5K45f9Idoq8gE7/kmlZG1zS1mrDS36lM5Sc+E5hVgXJkNw3kEJ7OnhHHu

              ZG0EvTlGjqntCGXxrpX5sS1a9z7HeemEos6Xlw8I8Q8txJTeHgkRmZkMy5ndRbWa

              sMyV8A1tk0Z5bLpoZBxn8Hh/M4v8HkV8O7lH91kB9D+4O+CZ4WcG4Fj8UOJW5m1M

              nsCfYvzpEzeLoB2xD3CEmonGzZC+Ij1ZhrWu5V6mnmx6dzUMjOZchRQtfnJZzQ1U

              2QIDAQAB

              -----END PUBLIC KEY-----

              '
          sp_signature_certificates:
            $ref: '#/components/schemas/SsoConfigSamlPartialUpdate/properties/sp_signature_certificates/items'
          enable_single_log_out:
            description: 'Enables single logout. Single Logout (SLO) is a feature that allows users to be logged out from multiple service providers (SPs) and the identity provider (IdP) with a single logout action.

              '
            type: boolean
            example: false
          single_log_out_url:
            description: 'The location where the single logout response will be sent.

              This is only enabled if `enable_single_log_out` is true.

              '
            type: string
            example: https://example.com/saml/logout
          single_log_out_issuer_url:
            description: 'The issuer ID for the service provider when handling a Single Logout.

              This is only enabled if `enable_single_log_out` is true.

              '
            type: string
            example: https://example.com/saml/issuer
          single_log_out_binding:
            description: 'The SAML binding used for SAML messages.

              '
            type: string
            enum:
            - post
            - redirect
            example: post
          single_logout_sign_request_and_response:
            description: 'If enabled, Single Logout requests must bbe signed and Single Logout responses will also be signed.

              '
            type: boolean
            example: false
          validate_signed_requests:
            description: 'Select this to validate all SAML requests using the SP Signature Certificate.

              '
            type: boolean
            example: true
          other_sso_urls:
            type: object
            description: 'For use with SP-initiated sign-in flows. Enter the ACS URLs for any other requestable SSO nodes used by your app integration. This option enables applications to choose where to send the SAML Response. Specify a URL and an index that uniquely identifies each ACS URL endpoint.

              Some SAML AuthnRequest messages don''t specify an index or URL. In these cases, the SAML Response is sent to the ACS specified in the Single sign on URL field.

              When you enable Signed Requests, Beyond Identity deletes any previously defined static SSO URLs and reads the SSO URLs from the signed SAML request instead. You can''t have both static SSO URLs and dynamic SSO URLs.

              This can only be set if `validate_signed_requests` is set to false.

              '
            required:
            - index
            - url
            properties:
              index:
                description: The index that this URL may be referenced by.
                type: integer
                format: int16
                example: 1
              url:
                description: 'This is a URL that may be used to replace the ACS URL.

                  '
                type: string
                example: https://example.com/saml/acs1
          additional_user_attributes:
            description: 'This structure describes additional attributes that can be attached to SAML assertion.

              '
            type: array
            items:
              type: object
              required:
              - name
              - name_format
              - value
              properties:
                name:
                  description: The SAML attribute name.
                  type: string
                  example: firstName
                name_format:
                  $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/name_format'
                value:
                  description: The value to attach to the SAML value.
                  $ref: '#/components/schemas/SsoConfigSamlPartialUpdate/properties/additional_user_attributes/items'
                custom_value:
                  description: 'The custom static string value when value is set to `custom_static_string`.

                    '
                  type: string
                  example: customString
          identity_provider_certs:
            description: 'The X509 certificates of the identity provider (Beyond Identity). These are the certificates that is in our IDP metadata, and that the upstream services use to validate our SAML assertion.

              '
            type: array
            readOnly: true
            items:
              type: object
              description: 'The BI Identity Provider Certificate for this SAML connection.

                '
              required:
              - id
              - created_at
              - expires_at
              - is_active
              - idp_public_certificate
              properties:
                id:
                  description: The id of the certificate.
                  type: string
                  example: 3cb717d1-88ff-440a-b5ee-86c00ce63dbf
                created_at:
                  description: Timestamp of when the certificate was created.
                  type: string
                  format: date-time
                  example: '2022-05-12T20:29:47.636Z'
                expires_at:
                  description: Timestamp of when the certificate expires.
                  type: string
                  format: date-time
                  example: '2022-05-12T20:29:47.636Z'
                is_active:
                  description: Indicates whether the certificate is active.
                  type: boolean
                  example: true
                idp_public_certificate:
                  description: 'Beyond Identity''s public signing key wrapped in a certificate.

                    Stored as a base64 encoded DER format.

                    '
                  type: string
                  example: '-----BEGIN CERTIFICATE-----


                    MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr3Q4ebLzciJlVf4QDQ2u

                    0Y2CfX9z4rMdG6MQSDW2NFQF0kM16Zzsz0p2gMOnp7YOz8OZqkU2XgUN3kQ8zC1h

                    q+um2mU5K45f9Idoq8gE7/kmlZG1zS1mrDS36lM5Sc+E5hVgXJkNw3kEJ7OnhHHu

                    ZG0EvTlGjqntCGXxrpX5sS1a9z7HeemEos6Xlw8I8Q8txJTeHgkRmZkMy5ndRbWa

                    sMyV8A1tk0Z5bLpoZBxn8Hh/M4v8HkV8O7lH91kB9D+4O+CZ4WcG4Fj8UOJW5m1M

                    nsCfYvzpEzeLoB2xD3CEmonGzZC+Ij1ZhrWu5V6mnmx6dzUMjOZchRQtfnJZzQ1U

                    2QIDAQAB

                    -----END CERTIFICATE-----

                    '
          use_short_url:
            default: false
            type: boolean
            description: Changes the EntityID in the SAML response to a shorter version. This is to support applications with URL restrictions.
      - type: object
        required:
        - type
        - client_id
        - identifying_claim_name
        - identity_attribute
        - okta_domain
        properties:
          type:
            $ref: '#/components/schemas/SsoConfigType'
          client_id:
            description: The client ID for the idp application.
            type: string
          client_secret:
            description: The client secret to authenticate as the idp application.
            type: string
            nullable: true
          pkce:
            default: null
            allOf:
            - $ref: '#/components/schemas/PkceConfig'
          id_token_scopes:
            default: null
            type: array
            items:
              type: string
          identifying_claim_name:
            type: string
          identity_attribute:
            $ref: '#/components/schemas/SubjectField'
          okta_domain:
            type: string
          inbound_scim:
            default: null
            type: object
      - $ref: '#/components/schemas/SsoConfigOktaBiIdp'
      - $ref: '#/components/schemas/SsoConfigRealityCheck'
      - $ref: '#/components/schemas/SsoConfigWsFed'
    SsoConfigOktaBiIdpPartialUpdate:
      type: object
      required:
      - type
      properties:
        type:
          $ref: '#/components/schemas/SsoConfigType'
        pkce:
          default: null
          allOf:
          - $ref: '#/components/schemas/PkceConfig'
        okta_registration:
          description: Represents a list of Resource Servers as a response body.
          type: object
          properties:
            domain:
              description: The domain Url inside of Okta.
              type: string
            okta_token:
              description: An okta token used for accessing the okta API.
              type: string
            attribute_name:
              description: 'The name of the attribute within okta that we are going to set to

                true.'
              type: string
            is_enabled:
              description: If the integration is enabled.
              type: boolean
        inbound_scim:
          default: null
          type: object
    SsoConfigListGroups:
      title: List Groups associated with an SSO config.
      description: List Groups associated with an SSO config.
      type: object
      properties:
        groups:
          type: array
          items:
            $ref: '#/components/schemas/SsoGroupWithMemberCount'
    SsoGroupWithMemberCount:
      title: Group with count of members
      type: object
      description: 'A group is a logical collection of identities. Groups are commonly used as a predicate in a policy rule.

        '
      properties:
        id:
          type: string
          description: 'A unique identifier for a group. This is automatically generated on creation. This field is immutable and read-only. This field is unique within the realm.

            '
          readOnly: true
          example: 81490afab171aef0
        realm_id:
          type: string
          description: 'A unique identifier for the group''s realm. This is automatically set on creation. This field is immutable and read-only.

            '
          readOnly: true
          example: 7df92e4a38ba0993
        tenant_id:
          type: string
          description: 'A unique identifier for the group''s tenant. This is automatically set on creation. This field is immutable and read-only.

            '
          readOnly: true
          example: 0001b42d80372976
        display_name:
          type: string
          minLength: 1
          maxLength: 64
          pattern: ^[^{}[\]<>;:?\\/|*^%$#=~`!]*$
          description: 'A human-readable name for the group. This name is used for display purposes.

            '
          example: Realm Administrators
        description:
          type: string
          maxLength: 300
          pattern: ^[^{}[\]<>;:?\\/|*^%$#=~`!]*$
          description: 'A free-form text field to describe a group.

            '
          example: A group of realm administrators.
        create_time:
          type: string
          format: date-time
          description: 'A time value given in ISO8601 combined date and time format that represents when the group was created. This is automatically generated on creation. This field is read-only.

            '
          readOnly: true
          example: '2022-03-14T03:42:52.905Z'
        update_time:
          type: string
          format: date-time
          description: 'A time value given in ISO8601 combined date and time format that represents when the group was last updated. This is automatically updated when the group is updated. This field is read-only.

            '
          readOnly: true
          example: '2022-06-14T05:55:23.823Z'
        member_count:
          type: integer
          format: uint32
          description: 'Total number of members of this group.

            '
          example: 1000
    SsoConfigSamlPartialUpdate:
      type: object
      required:
      - type
      properties:
        type:
          $ref: '#/components/schemas/SsoConfigType'
        acs_url:
          description: 'Location where the SAML Response is sent via HTTP-POST. Often referred

            to as the SAML Assertion Consumer Service (ACS) URL.

            '
          type: string
        override_recipient_and_destination:
          description: 'When this is true, the `recipient_url` and the `destination_url` are

            used for SAML Response.


            When this is false, both the `recipient_url` and the `destination_url`

            are omitted and the acs_url is used instead.

            '
          type: boolean
        recipient_url:
          description: 'If `override_recipient_and_destination` is set to true, this field is

            utilized for the SAML Response. If it is false, this field is unused.


            The location where the application can present the SAML assertion. This

            is usually the Single Sign-On (SSO) URL.

            '
          type: string
        destination_url:
          description: 'If `override_recipient_and_destination` is set to true, this field is

            utilized for the SAML Response. If it is false, this field is unused.


            The location to send the SAML Response, as defined in the SAML

            assertion.

            '
          type: string
        audience_url:
          description: 'The intended audience of the SAML assertion. Often referred to as the

            service provider Entity ID.

            '
          type: string
        default_relay_state:
          description: 'Identifies a specific application resource in an IDP initiated Single

            Sign-On scenario. In most instances this is blank.

            '
          type: string
        name_format:
          description: The format of the SAML NameID.
          $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/name_format'
        authentication_context:
          description: The context for SAML authentication.
          $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/authentication_context'
        subject_user_name_attribute:
          description: The attribute to use for the subject's username.
          $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/subject_user_name_attribute'
        sign_envelope:
          description: 'Determines whether the SAML authentication response message is digitally

            signed by the IdP or not. A digital signature is required to ensure that

            only your IdP generated the response message.

            '
          type: boolean
        sign_assertions:
          description: All of the assertions are signed by the IdP.
          type: boolean
        signature_algorithm:
          description: The algorithm used for signing the SAML assertions.
          $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/signature_algorithm'
        digest_algorithm:
          description: The algorithm used for the digest in SAML assertions.
          $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/digest_algorithm'
        encrypt_assertions:
          description: 'This is the flag that determines if the SAML assertion is encrypted.

            If this flag is set to `true`, there MUST be a SAML encryption certificate

            uploaded.


            Determines whether the SAML assertion is encrypted or not. Encryption

            ensures that nobody but the sender and receiver can understand the

            assertion.

            '
          type: boolean
        assertion_validity_duration_seconds:
          description: 'The amount of time assertions are valid for in seconds.

            '
          type: integer
          format: int32
        assertion_encryption_algorithm:
          description: The algorithm used to encrypt the SAML assertion.
          $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/assertion_encryption_algorithm'
        assertion_key_transport_algorithm:
          description: The algorithm used for key transport in SAML assertions.
          $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/assertion_key_transport_algorithm'
        assertion_encryption_public_key:
          description: 'The public key used to encrypt the SAML assertion. This is required

            if `encrypt_assertions` is true.

            '
          type: string
        sp_signature_certificates:
          description: 'The PEM encoded X509 key certificate of the Service Provider

            used to verify SAML AuthnRequests.

            '
          type: array
          items:
            description: 'The PEM encoded X509 key certificate of the Service Provider used to verify SAML AuthnRequests.

              '
            type: array
            items:
              type: object
              required:
              - sp_public_signing_key
              properties:
                sp_public_signing_key:
                  type: string
            example:
            - '-----BEGIN CERTIFICATE-----


              MIIDdzCCAl+gAwIBAgIEbF2LTTANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJV

              UzELMAkGA1UECBMCQ0ExFTATBgNVBAcTDFNhbiBGcmFuY2lzY28xEjAQBgNVBAoT

              CU9rdGEsIEluYy4xHzAdBgNVBAMTFm9rdGEuZXhhbXBsZS5jb20gQ0EgUm9vdDAe

              Fw0yMDA2MTkwMDAwMDBaFw0yMTA2MTkyMzU5NTlaMG0xCzAJBgNVBAYTAlVTMQsw

              CQYDVQQIEwJDQTEVMBMGA1UEBxMMU2FuIEZyYW5jaXNjbzESMBAGA1UEChMJb2t0

              Pbg6vGfJnxYYibTwLlXhgxl0tT+NMQFZ5GQslLh2sB3AWBzjZtFzFS7lDi0n4Fz5

              y9x6U1hUS54fScJmSVSTT9v/qAD0ccjvlPj3M6PENq2X7TwrOqSTgx5TPOpA5Myl

              MtwPbU3wn/pA5Cp9kWvlYbBfTS4Hx14FQyg3GAAkMrzrhKhpIfhz6iH0H8kDxFId

              6KjXy4TvoUM/tH7c6v2HS6D4TD7TfYOv/8A7E1Lj6WKwjtghTAh3Rb5tbyxRBcw

              gg==

              -----END CERTIFICATE-----

              '
        enable_single_log_out:
          description: Enable single logout.
          type: boolean
        single_log_out_url:
          description: 'The location where the logout response will be sent.

            Only enabled if `enable_single_log_out` is true.

            '
          type: string
        single_log_out_issuer_url:
          description: 'The issuer ID for the service provider. When handling a Single Log Out.


            Only enabled if `enable_single_log_out` is true.

            '
          type: string
        single_log_out_binding:
          description: The binding used for single logout messages.
          $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/single_log_out_binding'
        single_logout_sign_request_and_response:
          description: 'If we should expect the LogoutRequest to be signed and if we

            should sign the LogoutResponse.

            '
          type: boolean
        validate_signed_requests:
          description: 'Select this to validate all SAML requests using the Signature

            Certificate. The payload from the SAML request is validated, and Okta

            dynamically reads any single sign-on (SSO) URLs from the request. This

            checkbox appears after you upload a Signature Certificate.


            When Signed Requests is enabled, the SAML Request must include a

            NameIDPolicy.

            '
          type: boolean
        other_sso_urls:
          description: 'For use with SP-initiated sign-in flows. Enter the ACS URLs for any

            other requestable SSO nodes used by your app integration. This option

            enables applications to choose where to send the SAML Response. Specify

            a URL and an index that uniquely identifies each ACS URL endpoint.


            Some SAML AuthnRequest messages don''t specify an index or URL. In these

            cases, the SAML Response is sent to the ACS specified in the Single sign

            on URL field.


            When you enable Signed Requests, Okta deletes any previously defined

            static SSO URLs and reads the SSO URLs from the signed SAML request

            instead. You can''t have both static SSO URLs and dynamic SSO URLs.


            This can only be set if validate_signed_requests is set to false.

            '
          type: object
          required:
          - index
          - url
          properties:
            index:
              description: The index that this URL may be referenced by.
              type: integer
              format: int16
            url:
              description: 'This is a URL that may be used to replace the ACS URL.

                '
              type: string
        additional_user_attributes:
          description: Any additional attributes to attach to the SAML assertion.
          type: array
          items:
            description: 'The value of the SAML attribute. It will correspond to a directory attribute of the user.

              '
            type: string
            enum:
            - email
            - user_name
            - external_id
            - display_name
            - custom_static_string
            example: email
        icon:
          description: The URL or data URI of the icon representing the SSO configuration.
          type: string
        is_tile_visible:
          description: Indicates if the SSO configuration tile is visible to the user.
          type: boolean
        inbound_scim:
          default: null
          type: object
        use_short_url:
          default: false
          type: boolean
          description: Changes the EntityID in the SAML response to a shorter version. This is to support applications with URL restrictions.
    SsoConfigOidcIdp:
      type: object
      required:
      - type
      - client_id
      - identifying_claim_name
      - identity_attribute
      - authorization_endpoint
      - token_endpoint
      - jwks_endpoint
      properties:
        type:
          $ref: '#/components/schemas/SsoConfigType'
        client_id:
          description: The client ID for the idp application.
          type: string
        identifying_claim_name:
          type: string
        identity_attribute:
          $ref: '#/components/schemas/SubjectField'
        authorization_endpoint:
          type: string
          nullable: true
        token_endpoint:
          type: string
        jwks_endpoint:
          type: string
    SsoConfigWsFedPartialUpdate:
      type: object
      required:
      - type
      properties:
        type:
          $ref: '#/components/schemas/SsoConfigType'
        acs_url:
          description: 'This is where to redirect too. This is also known as the SP SSO url.

            '
          type: string
        audience_url:
          description: The Recipient/Audience of the RSTR.
          type: string
        expiration_time_seconds:
          description: The amount of time in seconds that the RSTR should be valid for.
          type: integer
          format: int32
        digest_algorithm:
          description: The algorithm used to create a digest inside of the token within the RSTR.
          $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/digest_algorithm'
        signature_algorithm:
          description: The algorithm used to create a signature inside of the token within the RSTR.
          $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/signature_algorithm'
        name_format:
          description: The format that should be used to identify the user that is logging into the system.
          $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/name_format'
        subject_user_name_attribute:
          description: 'The attribute on the identity that''s used to uniquely identify the user.

            This is also the source for the user name inside of the RSTR.

            '
          $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/subject_user_name_attribute'
        authentication_context:
          description: 'The SAML Authentication Context Class for the assertion''s authentication statement.

            Default value is "X509".

            '
          $ref: '#/components/schemas/SsoConfigPayload/oneOf/4/properties/authentication_context'
        additional_user_attributes:
          description: Any additional attributes to attach to the assertion.
          type: array
          items:
            $ref: '#/components/schemas/SsoConfigWsFed/properties/additional_user_attributes/items'
        icon:
          description: The URL or data URI of the icon representing the SSO configuration.
          type: string
        is_tile_visible:
          description: Indicates if the SSO configuration tile is visible to the user.
          type: boolean
        inbound_scim:
          default: null
          type: object
    Error:
      type: object
      properties:
        code:
          type: string
          description: 'Human-readable HTTP status code name, stylized as lower snake case (e.g. bad_request).

            '
        message:
          type: string
          description: 'Human-readable message describing the error.

            '
        details:
          type: array
          items:
            $ref: '#/components/schemas/ErrorDetail'
      required:
      - code
      - message
    ErrorDetail:
      title: Error Detail
      description: 'Additional details for errors designed to support client applications.

        '
      type: object
      discriminator:
        propertyName: type
      properties:
        type:
          type: string
          description: Type of the error detail.
      required:
      - type
    PkceConfig:
      type: string
      enum:
      - disabled
      - plain
      - s256
      description: "PKCE code challenge methods supported for applications, as defined by\n[RFC-7636](https://datatracker.ietf.org/doc/html/rfc7636). Allowable values are:\n  - `disabled` : PKCE is disabled for this application. This is the default state if\n    the `pkce` field is left blank. Please note that public OIDC and OAuth2 configured\n    applications MUST enable PKCE support. Confidential clients can leave PKCE disabled\n    if they choose.\n  - `plain` : PKCE is enabled for this application. The server will correlate the `code_challenge` and\n    `code_verifier` between the `authorize` and `token` requests. In this configuration, those fields are\n    required to be identical. This is the lower security option for PKCE support and should only be used\n    by legacy clients, or clients that don't support `s256`.\n  - `s256` : PKCE is enabled for this application, and the server will correlate the `code_challenge` and\n    `code_verifier` between the `authorize` and `token` requests. In this configuration, those fields are\n    required to equate as follows: `code_challenge` = `base64url(sha256(ascii(code_verifier)))`. This is\n    the higher security option and should always be preferred if it is supported by the client.\n"
      example: s256
    SsoConfigGenericOidcIdpPartialUpdate:
      type: object
      required:
      - type
      properties:
        type:
          $ref: '#/components/schemas/SsoConfigType'
        client_id:
          description: The client ID for the idp application.
          type: string
        client_secret:
          description: The client secret to authenticate as the idp application.
          type: string
          nullable: true
        pkce:
          default: null
          allOf:
          - $ref: '#/components/schemas/PkceConfig'
        id_token_scopes:
          default: null
          type: array
          items:
            type: string
        identifying_claim_name:
          type: string
        identity_attribute:
          $ref: '#/components/schemas/SubjectField'
        authorization_endpoint:
          type: string
          nullable: true
        token_endpoint:
          type: string
        jwks_endpoint:
          type: string
    SsoConfigGenericOidc:
      type: object
      required:
      - type
      - redirect_uris
      - scopes
      - confidentiality
      - pkce
      properties:
        type:
          $ref: '#/components/schemas/SsoConfigType'
        redirect_uris:
          default: null
          type: array
          items:
            type: string
        scopes:
          default: null
          type: array
          items:
            type: string
        trusted_origins:
          default: null
          type: array
          items:
            type: string
        login_link:
          type: string
        icon:
          type: string
        is_tile_visible:
          type: boolean
        confidentiality:
          default: null
          allOf:
          - $ref: '#/components/schemas/Confidentiality'
        pkce:
          default: null
          allOf:
          - $ref: '#/components/schemas/PkceConfig'
        inbound_scim:
          default: null
          type: object
    SsoConfigOktaBiIdp:
      type: object
      required:
      - type
      - pkce
      - okta_registration
      properties:
        type:
          $ref: '#/components/schemas/SsoConfigType'
        pkce:
          default: null
          allOf:
          - $ref: '#/components/schemas/PkceConfig'
        okta_registration:
          description: Represents a list of Resource Servers as a response body.
          type: object
          properties:
            domain:
              description: The domain Url inside of Okta.
              type: string
            okta_token:
              description: An okta token used for accessing the okta API.
              type: string
            attribute_name:
              description: 'The name of the attribute within okta that we are going to set to

                true.'
              type: string
            is_enabled:
              description: If the integration is enabled.
              type: boolean
        inbound_scim:
          default: null
          type: object
    SsoConfigType:
      description: 'Describes the type of sso config.

        '
      type: string
      enum:
      - bookmark
      - entra_id_external_auth_methods
      - generic_oidc
      - generic_oidc_idp
      - generic_saml
      - okta_idp
      - okta_sso_bi_idp
      - scim
      - ws_fed
    SsoConfigBookmarkPartialUpdate:
      type: object
      required:
      - type
      properties:
        type:
          $ref: '#/components/schemas/SsoConfigType'
        login_link:
          type: string
        icon:
          type: string
        is_tile_visible:
          type: boolean
    SsoConfigDeleteGroup:
      title: Delete Groups from SSO Config
      description: Request for DeleteGroupsToSsoConfig.
      type: object
      properties:
        group_ids:
          description: IDs of the groups to be removed from the sso config.
          type: array
          items:
            type: string
          minItems: 1
          maxItems: 1000
      required:
      - group_ids
    SsoConfigPartialUpdatePayload:
      oneOf:
      - $ref: '#/components/schemas/SsoConfigBookmarkPartialUpdate'
      - $ref: '#/components/schemas/SsoConfigEntraIdAuthMethodPartial'
      - $ref: '#/components/schemas/SsoConfigGenericOidcPartialUpdate'
      - $ref: '#/components/schemas/SsoConfigGenericOidcIdpPartialUpdate'
      - $ref: '#/components/schemas/SsoConfigSamlPartialUpdate'
      - type: object
        required:
        - type
        properties:
          type:
            $ref: '#/components/schemas/SsoConfigType'
          client_id:
            description: The client ID for the idp application.
            type: string
          client_secret:
            description: The client secret to authenticate as the idp application.
            type: string
            nullable: true
          pkce:
            default: null
            allOf:
            - $ref: '#/components/schemas/PkceConfig'
          id_token_scopes:
            default: null
            type: array
            items:
              type: string
          identifying_claim_name:
            type: string
          identity_attribute:
            $ref: '#/components/schemas/SubjectField'
          okta_domain:
            type: string
          inbound_scim:
            default: null
            type: object
      - $ref: '#/components/schemas/SsoConfigOktaBiIdpPartialUpdate'
      - $ref: '#/components/schemas/SsoConfigRealityCheckPartialUpdate'
      - $ref: '#/components/schemas/SsoConfigWsFedPartialUpdate'
    SsoConfigEntraIdAuthMethodPartial:
      type: object
      required:
      - type
      properties:
        type:
          $ref: '#/components/schemas/SsoConfigType'
        redirect_uris:
          default: null
          type: array
          items:
            type: string
        inbound_scim:
          default: null
          type: object
        discover_endpoint:
          default: null
          $ref: '#/components/schemas/SsoConfigEntraIdExternalAuthMethod/properties/discover_endpoint'
    SsoConfigGenericOidcPartialUpdate:
      type: object
      required:
      - type
      properties:
        type:
          $ref: '#/components/schemas/SsoConfigType'
        redirect_uris:
          default: null
          type: array
          items:
            type: string
        scopes:
          default: null
          type: array
          items:
            type: string
        trusted_origins:
          default: null
          type: array
          items:
            type: string
        login_link:
          type: string
        icon:
          type: string
        is_tile_visible:
          type: boolean
        confidentiality:
          default: null
          allOf:
          - $ref: '#/components/schemas/Confidentiality'
        pkce:
          default: null
          allOf:
          - $ref: '#/components/schemas/PkceConfig'
        inbound_scim:
          default: null
          type: object
    SsoConfigEntraIdExternalAuthMethod:
      type: object
      required:
      - type
      - redirect_uris
      - discover_endpoint
      properties:
        type:
          $ref: '#/components/schemas/SsoConfigType'
        redirect_uris:
          default: null
          type: array
          items:
            type: string
        inbound_scim:
          default: null
          type: object
        discover_endpoint:
          description: 'Describes the type of discovery endpoint for the entra_id_external_auth_methods sso config.

            '
          type: string
          enum:
          - global_azure
          - azure_us_government
          - microsoft_azure_vianet
    SsoConfig:
      description: Represents an SSO config as a request body.
      type: object
      required:
      - display_name
      - payload
      properties:
        is_migrated:
          description: Indicates that the SSO Config was added by a script such as fast migrate
          type: boolean
        display_name:
          description: A human-readable name for the application. This name is used for display purposes.
          type: string
        payload:
          $ref: '#/components/schemas/SsoConfigPayload'
    SsoConfigEnvelope:
      description: Represents an SSO config as a request body.
      type: object
      required:
      - sso_config
      properties:
        sso_config:
          $ref: '#/components/schemas/SsoConfig'
    SsoConfigRealityCheck:
      type: object
      required:
      - type
      - company_identifier
      properties:
        type:
          $ref: '#/components/schemas/SsoConfigType'
        company_identifier:
          default: null
          type: string
    TokenEndpointAuthMethod:
      description: "Indicator of the requested authentication method for the token endpoint.\nAllowable values are: - `client_secret_post`: The client uses the HTTP POST\nparameters\n   as defined in OAuth 2.0, Section 2.3.1. Namely, `client_id`\n   and `client_secret` are sent in the body of the POST request.\n- `client_secret_basic`: The client uses HTTP Basic as defined in\n   OAuth 2.0, Section 2.3.1. Namely, `client_id` and `client_secret`\n   are sent in the Basic Authorization header.\n- `none`: The `client_secret` is not part of the request body and there is no\nauthorization header.\n   This endpoint authentication method is only allowed if the application has\n`confidentiality` set to `confidential`.\n\nDeprecation Notice: This field is deprecated. The API will ignore the value\nof this field in requests. In responses, confidential applications will\nalways have `client_secret_basic` and public applications will always have\n`none`. On authentication, confidential applications may use both\n`client_secret_post` and `client_secret_basic`. Public applications may only\nuse `none`. **This field is scheduled for removal on August 1, 2023**\n"
      type: string
      deprecated: true
      enum:
      - client_secret_basic
      - client_secret_post
      - none
      example: client_secret_basic
    SsoConfigPartialUpdate:
      description: Represents an sso config as an update request body.
      type: object
      required:
      - sso_config
      properties:
        sso_config:
          $ref: '#/components/schemas/SsoConfigPartialUpdatePayload'
    ApplicationSsoResponse:
      type: object
      properties:
        sso_config_id:
          type: string
          description: 'This is the id of the SSO Config object that is associated with the

            provided application id. If this is missing it means that the

            application isn''t associated with an SSO config.

            '
    Identity:
      title: Identity
      type: object
      description: 'An identity is a unique identifier that may be used by an end-user to gain access governed by Beyond Identity.

        '
      properties:
        id:
          type: string
          description: 'A unique identifier for the identity. This is automatically generated on creation. This field is immutable and read-only. This field is unique within the realm.

            '
          readOnly: true
          example: e372db224c06e850
        realm_id:
          type: string
          description: 'A unique identifier for the identity''s realm. This is automatically set on creation. This field is immutable and read-only.

            '
          readOnly: true
          example: 8f5bec58229e6f29
        tenant_id:
          type: string
          description: 'A unique identifier for the identity''s tenant. This is automatically set on creation. This field is immutable and read-only.

            '
          readOnly: true
          example: 0001f1f460b1ace6
        display_name:
          type: string
          minLength: 1
          maxLength: 64
          pattern: ^[^{}[\]<>;:?\\/|*^%$#=~`!]*$
          description: 'A human-readable name for the identity. This name is used for display purposes.

            '
          example: Test Display
        create_time:
          type: string
          format: date-time
          description: 'A time value given in ISO8601 combined date and time format that represents when the identity was created. This is automatically generated on creation. This field is read-only.

            '
          readOnly: true
          example: '2022-04-12T05:53:07.119Z'
        update_time:
          type: string
          format: date-time
          description: 'A time value given in ISO8601 combined date and time format that represents when the identity was last updated. This is automatically updated when the identity is updated. This field is read-only.

            '
          readOnly: true
          example: '2022-06-16T14:31:03.770Z'
        status:
          type: string
          description: 'Indicator for the identity''s administrative status.  If ''active'', the identity is able to generate passkeys and login.  If ''suspended'', the identity is unable to generate passkeys or login.

            '
          example: active
        traits:
          description: 'A collection of properties to describe an identity. All traits contain a `type` key which describes the specific traits schema.

            '
          oneOf:
          - $ref: '#/components/schemas/Traits_v0'
          discriminator:
            propertyName: type
            mapping:
              traits_v0: '#/components/schemas/Traits_v0'
        enrollment_status:
          type: string
          enum:
          - ENROLLED
          - PENDING
          - INVITE_FAILED
          - UNENROLLED
          description: 'Indicator for the identity''s enrollment status.


            If ''ENROLLED'', the identity has 1 or more active passkeys.

            If ''PENDING'', the identity has no active passkeys and 1 or more pending enrollments.

            If ''INVITE_FAILED'', the identity has no active passkeys, no pending enrollments, and 1 or more failed enrollments.

            If ''UNENROLLED'', the identity is not enrolled in the organization.


            May be undefined. This field is output-only.

            '
          example: ENROLLED
          readOnly: true
    SsoConfigAddIdentities:
      title: Associate Identities with SSO Config
      description: Request for AddIdentitiesToSsoConfig.
      type: object
      properties:
        identity_ids:
          description: IDs of the identities to be added to the sso config.
          type: array
          items:
            type: string
          minItems: 1
          maxItems: 1000
      required:
      - identity_ids
    Traits_v0:
      title: Traits_v0
      description: Set of traits associated with an identity.
      type: object
      properties:
        type:
          type: string
          description: 'The type of the traits schema. This value must be provided on all writes.

            '
          example: traits_v0
        username:
          type: string
          minLength: 1
          maxLength: 64
          pattern: ^[^{}[\]<>;:?\\/|*^%$#=~`!]*$
          description: A required, unique, case-insensitive username for an identity in the realm.
          example: test
        primary_email_address:
          type: string
          description: Email address serving as primary contact for identity.
          example: test@example.com
        secondary_email_address:
          type: string
          description: 'An additional email address for the user.

            '
        external_id:
          type: string
          description: 'An ID issued by the provisioning client. It is assumed that the value''s uniqueness is controlled by the client setting the value.

            '
        family_name:
          type: string
          description: 'The family name or last name in most Western languages.

            '
        given_name:
          type: string
          description: 'The given name or first name in most Western languages.

            '
        formatted_name:
          type: string
          description: 'The full name, including all middle names, titles, and suffixes as appropriate, formatted for display (e.g. "Ms. Barbara Jane Jensen, III").

            '
        middle_name:
          type: string
          description: 'The middle name of the user, if applicable.

            '
        honorific_prefix:
          type: string
          description: 'Honorifics like "Mr.", "Mrs.", "Dr.", etc.

            '
        honorific_suffix:
          type: string
          description: 'Suffixes such as "Jr.", "Sr.", "III", etc.

            '
        nick_name:
          type: string
          description: 'A nickname the user goes by.

            '
        title:
          type: string
          description: 'The user''s job title.

            '
        primary_phone:
          type: string
          description: 'The primary contact phone number for the user.

            '
        secondary_phone:
          type: string
          description: 'An additional phone number for the user.

            '
        profile_url:
          type: string
          description: 'A URL to the user''s profile.

            '
        photo:
          type: string
          description: 'A URL to the user''s photo.

            '
        preferred_language:
          type: string
          description: 'The user''s preferred language.

            '
        locale:
          type: string
          description: 'The locale of the user, typically in the format of language-region.

            '
        timezone:
          type: string
          description: 'The timezone of the user.

            '
        formatted_address:
          type: string
          description: 'The full mailing address, formatted for display or use with a mailing label. This attribute MAY contain newlines.

            '
        street_address:
          type: string
          description: 'The full street address component, which may include house number, street name, P.O. box, and multi-line extended street address information. This attribute MAY contain newlines.

            '
        locality:
          type: string
          description: 'The locality or city of the user.

            '
        region:
          type: string
          description: 'The region or state of the user.

            '
        postal_code:
          type: string
          description: 'The zip code or postal code of the user.

            '
        country:
          type: string
          description: 'The country of the user.

            '
        user_type:
          type: string
          description: 'Used to identify the relationship between the organization and the user. Typical values used might be ''Contractor'', ''Employee'', ''Intern'', ''Temp'', ''External'', and ''Unknown'', but any value may be used.

            '
        employee_number:
          type: string
          description: 'The employee number assigned to the user, typically based on order of hire or association with an organization.

            '
        cost_center:
          type: string
          description: 'The cost center associated with the user.

            '
        organization:
          type: string
          description: 'The organization the user belongs to.

            '
        division:
          type: string
          description: 'The division of the organization the user belongs to.

            '
        department:
          type: string
          description: 'The department of the organization the user belongs to.

            '
        manager_id:
          type: string
          description: 'The unique identifier for the user''s manager.

            '
        manager_name:
          type: string
          description: 'The name of the user''s manager.

            '
      required:
      - type
    IdentityProviderTestResponse:
      description: Represents an SSO config test response body.
      type: object
      required:
      - identity_provider_id
      - display_name
      - is_success
      - status_code
      properties:
        identity_provider_id:
          type: string
        display_name:
          type: string
        is_success:
          type: boolean
        status_code:
          type: string
        error_context:
          type: string
    Confidentiality:
      description: "The confidentiality of the client, as prescribed by OAuth 2.0 and\nOIDC. Confidentiality is based on a client's ability to authenticate\nsecurely with the authorization server (i.e., ability to\nmaintain the confidentiality of their client credentials). Allowable\nvalues are:\n- `confidential`: Clients capable of maintaining the confidentiality\n  of their credentials (e.g., client implemented on a secure server with\n  restricted access to the client credentials), or capable of secure\n  client authentication using other means.\n- `public`: Clients incapable of maintaining the confidentiality of their\n  credentials (e.g., clients executing on the device used by the\n  resource owner, such as an installed native application or a web\n  browser-based application), and incapable of secure client\n  authentication via any other means.\n"
      type: string
      enum:
      - confidential
      - public
      example: confidential
  parameters:
    group_id:
      name: group_id
      in: path
      description: A unique identifier for a group.
      required: true
      schema:
        type: string
        example: 81490afab171aef0
    page_size:
      name: page_size
      in: query
      description: 'Number of items returned per page. The response will include at most this many results but may include fewer. If this value is omitted, the response will return the default number of results allowed by the method.

        '
      schema:
        type: integer
        format: uint32
        minimum: 0
    page_token:
      name: page_token
      in: query
      description: 'Token to retrieve the subsequent page of the previous request. All other parameters to the list endpoint should match the original request that provided this token unless otherwise specified.

        '
      schema:
        type: string
    identity_id:
      name: identity_id
      in: path
      description: A unique identifier for an identity.
      required: true
      schema:
        type: string
        example: e372db224c06e850
    application_id:
      name: application_id
      in: path
      description: A unique identifier for an application.
      required: true
      schema:
        type: string
        example: 38833c36-6f47-4992-9329-ea0a00915137
    correlation_id:
      name: x-correlation_id
      description: Correlation ID. If supplied with the request, the response must contain the same value. If not supplied with the request, it is generated by the server and returned in the response.
      in: header
      required: true
      schema:
        type: string
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: 'See the [Authentication](#section/Authentication) section for details.

        '