openapi: 3.0.1 info: title: Logto API references Account center Configs API description: 'API references for Logto services. Note: The documentation is for Logto Cloud. If you are using Logto OSS, please refer to the response of `/api/swagger.json` endpoint on your Logto instance.' version: Cloud servers: - url: https://[tenant_id].logto.app/ description: Logto endpoint address. security: - OAuth2: - all tags: - name: Configs description: 'Endpoints for managing Logto global configurations for the tenant, such as admin console config and OIDC signing keys. See [🔑 Signing keys](https://docs.logto.io/docs/recipes/signing-keys-rotation/) to learn more about signing keys and key rotation.' paths: /api/configs/admin-console: get: operationId: GetAdminConsoleConfig tags: - Configs parameters: [] responses: '200': description: The configuration object. content: application/json: schema: type: object required: - signInExperienceCustomized - organizationCreated properties: signInExperienceCustomized: type: boolean organizationCreated: type: boolean developmentTenantMigrationNotification: type: object required: - isPaidTenant - tag properties: isPaidTenant: type: boolean tag: type: string readAt: type: number checkedChargeNotification: type: object properties: token: type: boolean apiResource: type: boolean machineToMachineApp: type: boolean tenantMember: type: boolean '401': description: Unauthorized '403': description: Forbidden '404': description: Configuration not found. summary: Get admin console config description: Get the global configuration object for Logto Console. patch: operationId: UpdateAdminConsoleConfig tags: - Configs parameters: [] requestBody: required: true content: application/json: schema: type: object properties: signInExperienceCustomized: type: boolean organizationCreated: type: boolean developmentTenantMigrationNotification: type: object required: - isPaidTenant - tag properties: isPaidTenant: type: boolean tag: type: string readAt: type: number checkedChargeNotification: type: object properties: token: type: boolean apiResource: type: boolean machineToMachineApp: type: boolean tenantMember: type: boolean responses: '200': description: The updated configuration object. content: application/json: schema: type: object required: - signInExperienceCustomized - organizationCreated properties: signInExperienceCustomized: type: boolean organizationCreated: type: boolean developmentTenantMigrationNotification: type: object required: - isPaidTenant - tag properties: isPaidTenant: type: boolean tag: type: string readAt: type: number checkedChargeNotification: type: object properties: token: type: boolean apiResource: type: boolean machineToMachineApp: type: boolean tenantMember: type: boolean '400': description: Bad Request '401': description: Unauthorized '403': description: Forbidden '404': description: Configuration not found. summary: Update admin console config description: Update the global configuration object for Logto Console. This method performs a partial update. /api/configs/oidc/session: get: operationId: GetOidcSessionConfig tags: - Configs parameters: [] responses: '200': description: The OIDC session configuration. Returns empty object if the configuration does not exist. content: application/json: schema: type: object required: - ttl properties: ttl: type: number '401': description: Unauthorized '403': description: Forbidden summary: Get OIDC session config description: 'Get the OIDC session configuration for the tenant. ' patch: operationId: UpdateOidcSessionConfig tags: - Configs parameters: [] requestBody: required: true content: application/json: schema: type: object properties: ttl: type: number responses: '200': description: The updated OIDC session configuration. content: application/json: schema: type: object required: - ttl properties: ttl: type: number '400': description: Bad Request '401': description: Unauthorized '403': description: Forbidden summary: Update OIDC session config description: Update the OIDC session configuration for the tenant. This method performs a partial update. If the configuration does not exist, it will be created. /api/configs/oidc/{keyType}: get: operationId: GetOidcKeys tags: - Configs parameters: - name: keyType in: path required: true schema: type: string enum: - private-keys - cookie-keys description: Private keys are used to sign OIDC JWTs. Cookie keys are used to sign OIDC cookies. For clients, they do not need to know private keys to verify OIDC JWTs; they can use public keys from the JWKS endpoint instead. responses: '200': description: An array of OIDC signing keys for the given key type. content: application/json: schema: type: array items: type: object required: - id - createdAt properties: id: type: string createdAt: type: number signingKeyAlgorithm: type: string enum: - RSA - EC status: type: string enum: - Next - Current - Previous effectiveAt: type: number '400': description: Bad Request '401': description: Unauthorized '403': description: Forbidden summary: Get OIDC keys description: Get OIDC signing keys by key type. The actual key will be redacted from the result. /api/configs/oidc/{keyType}/{keyId}: delete: operationId: DeleteOidcKey tags: - Configs parameters: - name: keyType in: path required: true schema: type: string enum: - private-keys - cookie-keys description: Private keys are used to sign OIDC JWTs. Cookie keys are used to sign OIDC cookies. For clients, they do not need to know private keys to verify OIDC JWTs; they can use public keys from the JWKS endpoint instead. - $ref: '#/components/parameters/keyId' responses: '204': description: The key was deleted successfully. '400': description: Bad Request '401': description: Unauthorized '403': description: Forbidden '404': description: The key was not found. '422': description: At least one key must be kept. summary: Delete OIDC key description: Delete an OIDC signing key by key type and key ID. /api/configs/oidc/{keyType}/rotate: post: operationId: RotateOidcKeys tags: - Configs parameters: - name: keyType in: path required: true schema: type: string enum: - private-keys - cookie-keys description: Private keys are used to sign OIDC JWTs. Cookie keys are used to sign OIDC cookies. For clients, they do not need to know private keys to verify OIDC JWTs; they can use public keys from the JWKS endpoint instead. requestBody: required: true content: application/json: schema: type: object properties: signingKeyAlgorithm: type: string enum: - RSA - EC description: 'The signing key algorithm the new generated private key is using. Only applicable when `keyType` is `private-keys`.' rotationGracePeriod: type: number responses: '200': description: An array of OIDC signing keys after rotation. content: application/json: schema: type: array items: type: object required: - id - createdAt properties: id: type: string createdAt: type: number signingKeyAlgorithm: type: string enum: - RSA - EC status: type: string enum: - Next - Current - Previous effectiveAt: type: number '400': description: Bad Request '401': description: Unauthorized '403': description: Forbidden '422': description: Unprocessable Content summary: Rotate OIDC keys description: 'A new key will be generated and prepend to the list of keys. Only two recent keys will be kept. The oldest key will be automatically removed if there are more than two keys.' /api/configs/jwt-customizer/{tokenTypePath}: put: operationId: UpsertJwtCustomizer tags: - Configs parameters: - name: tokenTypePath in: path required: true schema: type: string enum: - access-token - client-credentials description: The token type to create a JWT customizer for. requestBody: required: true content: application/json: schema: example: {} properties: script: description: The script of the JWT customizer. environmentVariables: description: The environment variables for the JWT customizer. contextSample: description: The sample context for the JWT customizer script testing purpose. tokenSample: description: The sample raw token payload for the JWT customizer script testing purpose. blockIssuanceOnError: description: Whether to block token issuance when the JWT customizer script fails. responses: '200': description: The updated JWT customizer. content: application/json: schema: oneOf: - type: object required: - script properties: script: type: string environmentVariables: type: object additionalProperties: type: string contextSample: type: object required: - user properties: user: type: object properties: id: type: string minLength: 1 maxLength: 12 username: type: string maxLength: 128 nullable: true primaryEmail: type: string maxLength: 128 nullable: true primaryPhone: type: string maxLength: 128 nullable: true name: type: string maxLength: 128 nullable: true avatar: type: string maxLength: 2048 nullable: true customData: type: object description: arbitrary identities: type: object additionalProperties: type: object required: - userId properties: userId: type: string details: type: object description: arbitrary lastSignInAt: type: number nullable: true createdAt: type: number updatedAt: type: number profile: type: object properties: familyName: type: string givenName: type: string middleName: type: string nickname: type: string preferredUsername: type: string profile: type: string website: type: string gender: type: string birthdate: type: string zoneinfo: type: string locale: type: string address: type: object properties: formatted: type: string streetAddress: type: string locality: type: string region: type: string postalCode: type: string country: type: string applicationId: type: string maxLength: 21 nullable: true isSuspended: type: boolean hasPassword: type: boolean ssoIdentities: type: array items: type: object required: - issuer - identityId - detail properties: issuer: type: string minLength: 1 maxLength: 256 identityId: type: string minLength: 1 maxLength: 128 detail: type: object description: arbitrary mfaVerificationFactors: type: array items: type: string enum: - Totp - WebAuthn - BackupCode - EmailVerificationCode - PhoneVerificationCode roles: type: array items: type: object required: - id - name - description - scopes properties: id: type: string minLength: 1 maxLength: 21 name: type: string minLength: 1 maxLength: 128 description: type: string minLength: 1 maxLength: 128 scopes: type: array items: type: object required: - id - name - description - resourceId - resource properties: id: type: string minLength: 1 maxLength: 21 name: type: string minLength: 1 maxLength: 256 description: type: string nullable: true resourceId: type: string minLength: 1 maxLength: 21 resource: type: object required: - tenantId - id - name - indicator - isDefault - accessTokenTtl properties: tenantId: type: string maxLength: 21 id: type: string minLength: 1 maxLength: 21 name: type: string minLength: 1 indicator: type: string minLength: 1 isDefault: type: boolean accessTokenTtl: type: number organizations: type: array items: type: object required: - id - name - description properties: id: type: string minLength: 1 maxLength: 21 name: type: string minLength: 1 maxLength: 128 description: type: string maxLength: 256 nullable: true organizationRoles: type: array items: type: object required: - organizationId - roleId - roleName properties: organizationId: type: string roleId: type: string roleName: type: string grant: type: object properties: type: type: string format: '"urn:ietf:params:oauth:grant-type:token-exchange"' subjectTokenContext: type: object description: arbitrary interaction: type: object properties: interactionEvent: type: string enum: - SignIn - Register - ForgotPassword userId: type: string verificationRecords: type: array items: oneOf: - type: object required: - id - type - identifier - verified properties: id: type: string type: type: string format: '"Password"' identifier: type: object required: - type - value properties: type: oneOf: - type: string enum: - username - email - phone - type: string enum: - userId value: type: string verified: type: boolean - type: object required: - id - templateType - verified - type - identifier properties: id: type: string templateType: type: string enum: - SignIn - Register - ForgotPassword - OrganizationInvitation - Generic - UserPermissionValidation - BindNewIdentifier - MfaVerification - BindMfa verified: type: boolean type: type: string format: '"EmailVerificationCode"' identifier: type: object required: - type - value properties: type: type: string format: '"email"' value: type: string - type: object required: - id - templateType - verified - type - identifier properties: id: type: string templateType: type: string enum: - SignIn - Register - ForgotPassword - OrganizationInvitation - Generic - UserPermissionValidation - BindNewIdentifier - MfaVerification - BindMfa verified: type: boolean type: type: string format: '"PhoneVerificationCode"' identifier: type: object required: - type - value properties: type: type: string format: '"phone"' value: type: string - type: object required: - id - templateType - verified - type - identifier properties: id: type: string templateType: type: string enum: - SignIn - Register - ForgotPassword - OrganizationInvitation - Generic - UserPermissionValidation - BindNewIdentifier - MfaVerification - BindMfa verified: type: boolean type: type: string format: '"MfaEmailVerificationCode"' identifier: type: object required: - type - value properties: type: type: string format: '"email"' value: type: string - type: object required: - id - templateType - verified - type - identifier properties: id: type: string templateType: type: string enum: - SignIn - Register - ForgotPassword - OrganizationInvitation - Generic - UserPermissionValidation - BindNewIdentifier - MfaVerification - BindMfa verified: type: boolean type: type: string format: '"MfaPhoneVerificationCode"' identifier: type: object required: - type - value properties: type: type: string format: '"phone"' value: type: string - type: object required: - id - connectorId - type properties: id: type: string connectorId: type: string type: type: string format: '"Social"' socialUserInfo: type: object required: - id properties: id: type: string email: type: string phone: type: string name: type: string avatar: type: string rawData: type: object oneOf: - type: object description: arbitrary JSON object - type: array items: oneOf: - type: string - type: number - type: boolean - type: string nullable: true description: null value - type: object description: arbitrary JSON object - type: string - type: number - type: boolean nullable: true - type: object required: - id - connectorId - type properties: id: type: string connectorId: type: string type: type: string format: '"EnterpriseSso"' enterpriseSsoUserInfo: type: object required: - id properties: id: type: string email: type: string phone: type: string name: type: string avatar: type: string rawData: type: object oneOf: - type: object description: arbitrary JSON object - type: array items: oneOf: - type: string - type: number - type: boolean - type: string nullable: true description: null value - type: object description: arbitrary JSON object - type: string - type: number - type: boolean nullable: true issuer: type: string - type: object required: - id - type - userId - verified properties: id: type: string type: type: string format: '"Totp"' userId: type: string verified: type: boolean - type: object required: - id - type - userId properties: id: type: string type: type: string format: '"BackupCode"' userId: type: string code: type: string - type: object required: - id - verified - type - userId properties: id: type: string verified: type: boolean registrationRpId: type: string type: type: string format: '"WebAuthn"' userId: type: string - type: object required: - id - verified - type properties: id: type: string verified: type: boolean registrationRpId: type: string type: type: string format: '"SignInPasskey"' userId: type: string - type: object required: - id - type - verified - identifier properties: id: type: string type: type: string format: '"OneTimeToken"' verified: type: boolean identifier: type: object required: - type - value properties: type: type: string format: '"email"' value: type: string oneTimeTokenContext: type: object properties: jitOrganizationIds: type: array items: type: string - type: object required: - id - type - identifier properties: id: type: string type: type: string format: '"NewPasswordIdentity"' identifier: type: object required: - type - value properties: type: type: string enum: - username - email - phone value: type: string signInContext: type: object additionalProperties: type: string application: type: object properties: tenantId: type: string maxLength: 21 id: type: string minLength: 1 maxLength: 21 name: type: string minLength: 1 maxLength: 256 description: type: string nullable: true type: type: string enum: - Native - SPA - Traditional - MachineToMachine - Protected - SAML oidcClientMetadata: type: object required: - redirectUris - postLogoutRedirectUris properties: redirectUris: type: array items: type: object description: Validator function postLogoutRedirectUris: type: array items: type: object description: Validator function backchannelLogoutUri: type: string format: url backchannelLogoutSessionRequired: type: boolean logoUri: type: string customClientMetadata: type: object properties: corsAllowedOrigins: type: array items: type: string minLength: 1 idTokenTtl: type: number refreshTokenTtl: type: number refreshTokenTtlInDays: type: number tenantId: type: string alwaysIssueRefreshToken: type: boolean rotateRefreshToken: type: boolean allowTokenExchange: type: boolean isDeviceFlow: type: boolean maxAllowedGrants: type: number protectedAppMetadata: type: object required: - host - origin - sessionDuration - pageRules properties: host: type: string origin: type: string sessionDuration: type: number pageRules: type: array items: type: object required: - path properties: path: type: string customDomains: type: array items: type: object required: - domain - status - errorMessage - dnsRecords - cloudflareData properties: domain: type: string status: type: string enum: - PendingVerification - PendingSsl - Active - Error errorMessage: type: string nullable: true dnsRecords: type: array items: type: object required: - name - type - value properties: name: type: string type: type: string value: type: string cloudflareData: type: object required: - id - status - ssl properties: id: type: string status: type: string ssl: type: object required: - status properties: status: type: string validation_errors: type: array items: type: object required: - message properties: message: type: string verification_errors: type: array items: type: string nullable: true nullable: true customData: type: object description: arbitrary isThirdParty: type: boolean createdAt: type: number blockIssuanceOnError: type: boolean tokenSample: type: object properties: jti: type: string aud: oneOf: - type: string - type: array items: type: string scope: type: string clientId: type: string accountId: type: string expiresWithSession: type: boolean grantId: type: string gty: type: string sessionUid: type: string sid: type: string kind: type: string format: '"AccessToken"' - type: object required: - script properties: script: type: string environmentVariables: type: object additionalProperties: type: string contextSample: type: object properties: application: type: object properties: tenantId: type: string maxLength: 21 id: type: string minLength: 1 maxLength: 21 name: type: string minLength: 1 maxLength: 256 description: type: string nullable: true type: type: string enum: - Native - SPA - Traditional - MachineToMachine - Protected - SAML oidcClientMetadata: type: object required: - redirectUris - postLogoutRedirectUris properties: redirectUris: type: array items: type: object description: Validator function postLogoutRedirectUris: type: array items: type: object description: Validator function backchannelLogoutUri: type: string format: url backchannelLogoutSessionRequired: type: boolean logoUri: type: string customClientMetadata: type: object properties: corsAllowedOrigins: type: array items: type: string minLength: 1 idTokenTtl: type: number refreshTokenTtl: type: number refreshTokenTtlInDays: type: number tenantId: type: string alwaysIssueRefreshToken: type: boolean rotateRefreshToken: type: boolean allowTokenExchange: type: boolean isDeviceFlow: type: boolean maxAllowedGrants: type: number protectedAppMetadata: type: object required: - host - origin - sessionDuration - pageRules properties: host: type: string origin: type: string sessionDuration: type: number pageRules: type: array items: type: object required: - path properties: path: type: string customDomains: type: array items: type: object required: - domain - status - errorMessage - dnsRecords - cloudflareData properties: domain: type: string status: type: string enum: - PendingVerification - PendingSsl - Active - Error errorMessage: type: string nullable: true dnsRecords: type: array items: type: object required: - name - type - value properties: name: type: string type: type: string value: type: string cloudflareData: type: object required: - id - status - ssl properties: id: type: string status: type: string ssl: type: object required: - status properties: status: type: string validation_errors: type: array items: type: object required: - message properties: message: type: string verification_errors: type: array items: type: string nullable: true nullable: true customData: type: object description: arbitrary isThirdParty: type: boolean createdAt: type: number blockIssuanceOnError: type: boolean tokenSample: type: object properties: jti: type: string aud: oneOf: - type: string - type: array items: type: string scope: type: string clientId: type: string kind: type: string format: '"ClientCredentials"' '201': description: The created JWT customizer. content: application/json: schema: oneOf: - type: object required: - script properties: script: type: string environmentVariables: type: object additionalProperties: type: string contextSample: type: object required: - user properties: user: type: object properties: id: type: string minLength: 1 maxLength: 12 username: type: string maxLength: 128 nullable: true primaryEmail: type: string maxLength: 128 nullable: true primaryPhone: type: string maxLength: 128 nullable: true name: type: string maxLength: 128 nullable: true avatar: type: string maxLength: 2048 nullable: true customData: type: object description: arbitrary identities: type: object additionalProperties: type: object required: - userId properties: userId: type: string details: type: object description: arbitrary lastSignInAt: type: number nullable: true createdAt: type: number updatedAt: type: number profile: type: object properties: familyName: type: string givenName: type: string middleName: type: string nickname: type: string preferredUsername: type: string profile: type: string website: type: string gender: type: string birthdate: type: string zoneinfo: type: string locale: type: string address: type: object properties: formatted: type: string streetAddress: type: string locality: type: string region: type: string postalCode: type: string country: type: string applicationId: type: string maxLength: 21 nullable: true isSuspended: type: boolean hasPassword: type: boolean ssoIdentities: type: array items: type: object required: - issuer - identityId - detail properties: issuer: type: string minLength: 1 maxLength: 256 identityId: type: string minLength: 1 maxLength: 128 detail: type: object description: arbitrary mfaVerificationFactors: type: array items: type: string enum: - Totp - WebAuthn - BackupCode - EmailVerificationCode - PhoneVerificationCode roles: type: array items: type: object required: - id - name - description - scopes properties: id: type: string minLength: 1 maxLength: 21 name: type: string minLength: 1 maxLength: 128 description: type: string minLength: 1 maxLength: 128 scopes: type: array items: type: object required: - id - name - description - resourceId - resource properties: id: type: string minLength: 1 maxLength: 21 name: type: string minLength: 1 maxLength: 256 description: type: string nullable: true resourceId: type: string minLength: 1 maxLength: 21 resource: type: object required: - tenantId - id - name - indicator - isDefault - accessTokenTtl properties: tenantId: type: string maxLength: 21 id: type: string minLength: 1 maxLength: 21 name: type: string minLength: 1 indicator: type: string minLength: 1 isDefault: type: boolean accessTokenTtl: type: number organizations: type: array items: type: object required: - id - name - description properties: id: type: string minLength: 1 maxLength: 21 name: type: string minLength: 1 maxLength: 128 description: type: string maxLength: 256 nullable: true organizationRoles: type: array items: type: object required: - organizationId - roleId - roleName properties: organizationId: type: string roleId: type: string roleName: type: string grant: type: object properties: type: type: string format: '"urn:ietf:params:oauth:grant-type:token-exchange"' subjectTokenContext: type: object description: arbitrary interaction: type: object properties: interactionEvent: type: string enum: - SignIn - Register - ForgotPassword userId: type: string verificationRecords: type: array items: oneOf: - type: object required: - id - type - identifier - verified properties: id: type: string type: type: string format: '"Password"' identifier: type: object required: - type - value properties: type: oneOf: - type: string enum: - username - email - phone - type: string enum: - userId value: type: string verified: type: boolean - type: object required: - id - templateType - verified - type - identifier properties: id: type: string templateType: type: string enum: - SignIn - Register - ForgotPassword - OrganizationInvitation - Generic - UserPermissionValidation - BindNewIdentifier - MfaVerification - BindMfa verified: type: boolean type: type: string format: '"EmailVerificationCode"' identifier: type: object required: - type - value properties: type: type: string format: '"email"' value: type: string - type: object required: - id - templateType - verified - type - identifier properties: id: type: string templateType: type: string enum: - SignIn - Register - ForgotPassword - OrganizationInvitation - Generic - UserPermissionValidation - BindNewIdentifier - MfaVerification - BindMfa verified: type: boolean type: type: string format: '"PhoneVerificationCode"' identifier: type: object required: - type - value properties: type: type: string format: '"phone"' value: type: string - type: object required: - id - templateType - verified - type - identifier properties: id: type: string templateType: type: string enum: - SignIn - Register - ForgotPassword - OrganizationInvitation - Generic - UserPermissionValidation - BindNewIdentifier - MfaVerification - BindMfa verified: type: boolean type: type: string format: '"MfaEmailVerificationCode"' identifier: type: object required: - type - value properties: type: type: string format: '"email"' value: type: string - type: object required: - id - templateType - verified - type - identifier properties: id: type: string templateType: type: string enum: - SignIn - Register - ForgotPassword - OrganizationInvitation - Generic - UserPermissionValidation - BindNewIdentifier - MfaVerification - BindMfa verified: type: boolean type: type: string format: '"MfaPhoneVerificationCode"' identifier: type: object required: - type - value properties: type: type: string format: '"phone"' value: type: string - type: object required: - id - connectorId - type properties: id: type: string connectorId: type: string type: type: string format: '"Social"' socialUserInfo: type: object required: - id properties: id: type: string email: type: string phone: type: string name: type: string avatar: type: string rawData: type: object oneOf: - type: object description: arbitrary JSON object - type: array items: oneOf: - type: string - type: number - type: boolean - type: string nullable: true description: null value - type: object description: arbitrary JSON object - type: string - type: number - type: boolean nullable: true - type: object required: - id - connectorId - type properties: id: type: string connectorId: type: string type: type: string format: '"EnterpriseSso"' enterpriseSsoUserInfo: type: object required: - id properties: id: type: string email: type: string phone: type: string name: type: string avatar: type: string rawData: type: object oneOf: - type: object description: arbitrary JSON object - type: array items: oneOf: - type: string - type: number - type: boolean - type: string nullable: true description: null value - type: object description: arbitrary JSON object - type: string - type: number - type: boolean nullable: true issuer: type: string - type: object required: - id - type - userId - verified properties: id: type: string type: type: string format: '"Totp"' userId: type: string verified: type: boolean - type: object required: - id - type - userId properties: id: type: string type: type: string format: '"BackupCode"' userId: type: string code: type: string - type: object required: - id - verified - type - userId properties: id: type: string verified: type: boolean registrationRpId: type: string type: type: string format: '"WebAuthn"' userId: type: string - type: object required: - id - verified - type properties: id: type: string verified: type: boolean registrationRpId: type: string type: type: string format: '"SignInPasskey"' userId: type: string - type: object required: - id - type - verified - identifier properties: id: type: string type: type: string format: '"OneTimeToken"' verified: type: boolean identifier: type: object required: - type - value properties: type: type: string format: '"email"' value: type: string oneTimeTokenContext: type: object properties: jitOrganizationIds: type: array items: type: string - type: object required: - id - type - identifier properties: id: type: string type: type: string format: '"NewPasswordIdentity"' identifier: type: object required: - type - value properties: type: type: string enum: - username - email - phone value: type: string signInContext: type: object additionalProperties: type: string application: type: object properties: tenantId: type: string maxLength: 21 id: type: string minLength: 1 maxLength: 21 name: type: string minLength: 1 maxLength: 256 description: type: string nullable: true type: type: string enum: - Native - SPA - Traditional - MachineToMachine - Protected - SAML oidcClientMetadata: type: object required: - redirectUris - postLogoutRedirectUris properties: redirectUris: type: array items: type: object description: Validator function postLogoutRedirectUris: type: array items: type: object description: Validator function backchannelLogoutUri: type: string format: url backchannelLogoutSessionRequired: type: boolean logoUri: type: string customClientMetadata: type: object properties: corsAllowedOrigins: type: array items: type: string minLength: 1 idTokenTtl: type: number refreshTokenTtl: type: number refreshTokenTtlInDays: type: number tenantId: type: string alwaysIssueRefreshToken: type: boolean rotateRefreshToken: type: boolean allowTokenExchange: type: boolean isDeviceFlow: type: boolean maxAllowedGrants: type: number protectedAppMetadata: type: object required: - host - origin - sessionDuration - pageRules properties: host: type: string origin: type: string sessionDuration: type: number pageRules: type: array items: type: object required: - path properties: path: type: string customDomains: type: array items: type: object required: - domain - status - errorMessage - dnsRecords - cloudflareData properties: domain: type: string status: type: string enum: - PendingVerification - PendingSsl - Active - Error errorMessage: type: string nullable: true dnsRecords: type: array items: type: object required: - name - type - value properties: name: type: string type: type: string value: type: string cloudflareData: type: object required: - id - status - ssl properties: id: type: string status: type: string ssl: type: object required: - status properties: status: type: string validation_errors: type: array items: type: object required: - message properties: message: type: string verification_errors: type: array items: type: string nullable: true nullable: true customData: type: object description: arbitrary isThirdParty: type: boolean createdAt: type: number blockIssuanceOnError: type: boolean tokenSample: type: object properties: jti: type: string aud: oneOf: - type: string - type: array items: type: string scope: type: string clientId: type: string accountId: type: string expiresWithSession: type: boolean grantId: type: string gty: type: string sessionUid: type: string sid: type: string kind: type: string format: '"AccessToken"' - type: object required: - script properties: script: type: string environmentVariables: type: object additionalProperties: type: string contextSample: type: object properties: application: type: object properties: tenantId: type: string maxLength: 21 id: type: string minLength: 1 maxLength: 21 name: type: string minLength: 1 maxLength: 256 description: type: string nullable: true type: type: string enum: - Native - SPA - Traditional - MachineToMachine - Protected - SAML oidcClientMetadata: type: object required: - redirectUris - postLogoutRedirectUris properties: redirectUris: type: array items: type: object description: Validator function postLogoutRedirectUris: type: array items: type: object description: Validator function backchannelLogoutUri: type: string format: url backchannelLogoutSessionRequired: type: boolean logoUri: type: string customClientMetadata: type: object properties: corsAllowedOrigins: type: array items: type: string minLength: 1 idTokenTtl: type: number refreshTokenTtl: type: number refreshTokenTtlInDays: type: number tenantId: type: string alwaysIssueRefreshToken: type: boolean rotateRefreshToken: type: boolean allowTokenExchange: type: boolean isDeviceFlow: type: boolean maxAllowedGrants: type: number protectedAppMetadata: type: object required: - host - origin - sessionDuration - pageRules properties: host: type: string origin: type: string sessionDuration: type: number pageRules: type: array items: type: object required: - path properties: path: type: string customDomains: type: array items: type: object required: - domain - status - errorMessage - dnsRecords - cloudflareData properties: domain: type: string status: type: string enum: - PendingVerification - PendingSsl - Active - Error errorMessage: type: string nullable: true dnsRecords: type: array items: type: object required: - name - type - value properties: name: type: string type: type: string value: type: string cloudflareData: type: object required: - id - status - ssl properties: id: type: string status: type: string ssl: type: object required: - status properties: status: type: string validation_errors: type: array items: type: object required: - message properties: message: type: string verification_errors: type: array items: type: string nullable: true nullable: true customData: type: object description: arbitrary isThirdParty: type: boolean createdAt: type: number blockIssuanceOnError: type: boolean tokenSample: type: object properties: jti: type: string aud: oneOf: - type: string - type: array items: type: string scope: type: string clientId: type: string kind: type: string format: '"ClientCredentials"' '400': description: The request body is invalid. '401': description: Unauthorized '403': description: Permission denied. summary: Create or update JWT customizer description: Create or update a JWT customizer for the given token type. patch: operationId: UpdateJwtCustomizer tags: - Configs parameters: - name: tokenTypePath in: path required: true schema: type: string enum: - access-token - client-credentials description: The token type to update a JWT customizer for. requestBody: required: true content: application/json: schema: example: {} properties: script: description: The script of the JWT customizer. environmentVariables: description: The environment variables for the JWT customizer. contextSample: description: The sample context for the JWT customizer script testing purpose. tokenSample: description: The sample raw token payload for the JWT customizer script testing purpose. blockIssuanceOnError: description: Whether to block token issuance when the JWT customizer script fails. responses: '200': description: The updated JWT customizer. content: application/json: schema: oneOf: - type: object required: - script properties: script: type: string environmentVariables: type: object additionalProperties: type: string contextSample: type: object required: - user properties: user: type: object properties: id: type: string minLength: 1 maxLength: 12 username: type: string maxLength: 128 nullable: true primaryEmail: type: string maxLength: 128 nullable: true primaryPhone: type: string maxLength: 128 nullable: true name: type: string maxLength: 128 nullable: true avatar: type: string maxLength: 2048 nullable: true customData: type: object description: arbitrary identities: type: object additionalProperties: type: object required: - userId properties: userId: type: string details: type: object description: arbitrary lastSignInAt: type: number nullable: true createdAt: type: number updatedAt: type: number profile: type: object properties: familyName: type: string givenName: type: string middleName: type: string nickname: type: string preferredUsername: type: string profile: type: string website: type: string gender: type: string birthdate: type: string zoneinfo: type: string locale: type: string address: type: object properties: formatted: type: string streetAddress: type: string locality: type: string region: type: string postalCode: type: string country: type: string applicationId: type: string maxLength: 21 nullable: true isSuspended: type: boolean hasPassword: type: boolean ssoIdentities: type: array items: type: object required: - issuer - identityId - detail properties: issuer: type: string minLength: 1 maxLength: 256 identityId: type: string minLength: 1 maxLength: 128 detail: type: object description: arbitrary mfaVerificationFactors: type: array items: type: string enum: - Totp - WebAuthn - BackupCode - EmailVerificationCode - PhoneVerificationCode roles: type: array items: type: object required: - id - name - description - scopes properties: id: type: string minLength: 1 maxLength: 21 name: type: string minLength: 1 maxLength: 128 description: type: string minLength: 1 maxLength: 128 scopes: type: array items: type: object required: - id - name - description - resourceId - resource properties: id: type: string minLength: 1 maxLength: 21 name: type: string minLength: 1 maxLength: 256 description: type: string nullable: true resourceId: type: string minLength: 1 maxLength: 21 resource: type: object required: - tenantId - id - name - indicator - isDefault - accessTokenTtl properties: tenantId: type: string maxLength: 21 id: type: string minLength: 1 maxLength: 21 name: type: string minLength: 1 indicator: type: string minLength: 1 isDefault: type: boolean accessTokenTtl: type: number organizations: type: array items: type: object required: - id - name - description properties: id: type: string minLength: 1 maxLength: 21 name: type: string minLength: 1 maxLength: 128 description: type: string maxLength: 256 nullable: true organizationRoles: type: array items: type: object required: - organizationId - roleId - roleName properties: organizationId: type: string roleId: type: string roleName: type: string grant: type: object properties: type: type: string format: '"urn:ietf:params:oauth:grant-type:token-exchange"' subjectTokenContext: type: object description: arbitrary interaction: type: object properties: interactionEvent: type: string enum: - SignIn - Register - ForgotPassword userId: type: string verificationRecords: type: array items: oneOf: - type: object required: - id - type - identifier - verified properties: id: type: string type: type: string format: '"Password"' identifier: type: object required: - type - value properties: type: oneOf: - type: string enum: - username - email - phone - type: string enum: - userId value: type: string verified: type: boolean - type: object required: - id - templateType - verified - type - identifier properties: id: type: string templateType: type: string enum: - SignIn - Register - ForgotPassword - OrganizationInvitation - Generic - UserPermissionValidation - BindNewIdentifier - MfaVerification - BindMfa verified: type: boolean type: type: string format: '"EmailVerificationCode"' identifier: type: object required: - type - value properties: type: type: string format: '"email"' value: type: string - type: object required: - id - templateType - verified - type - identifier properties: id: type: string templateType: type: string enum: - SignIn - Register - ForgotPassword - OrganizationInvitation - Generic - UserPermissionValidation - BindNewIdentifier - MfaVerification - BindMfa verified: type: boolean type: type: string format: '"PhoneVerificationCode"' identifier: type: object required: - type - value properties: type: type: string format: '"phone"' value: type: string - type: object required: - id - templateType - verified - type - identifier properties: id: type: string templateType: type: string enum: - SignIn - Register - ForgotPassword - OrganizationInvitation - Generic - UserPermissionValidation - BindNewIdentifier - MfaVerification - BindMfa verified: type: boolean type: type: string format: '"MfaEmailVerificationCode"' identifier: type: object required: - type - value properties: type: type: string format: '"email"' value: type: string - type: object required: - id - templateType - verified - type - identifier properties: id: type: string templateType: type: string enum: - SignIn - Register - ForgotPassword - OrganizationInvitation - Generic - UserPermissionValidation - BindNewIdentifier - MfaVerification - BindMfa verified: type: boolean type: type: string format: '"MfaPhoneVerificationCode"' identifier: type: object required: - type - value properties: type: type: string format: '"phone"' value: type: string - type: object required: - id - connectorId - type properties: id: type: string connectorId: type: string type: type: string format: '"Social"' socialUserInfo: type: object required: - id properties: id: type: string email: type: string phone: type: string name: type: string avatar: type: string rawData: type: object oneOf: - type: object description: arbitrary JSON object - type: array items: oneOf: - type: string - type: number - type: boolean - type: string nullable: true description: null value - type: object description: arbitrary JSON object - type: string - type: number - type: boolean nullable: true - type: object required: - id - connectorId - type properties: id: type: string connectorId: type: string type: type: string format: '"EnterpriseSso"' enterpriseSsoUserInfo: type: object required: - id properties: id: type: string email: type: string phone: type: string name: type: string avatar: type: string rawData: type: object oneOf: - type: object description: arbitrary JSON object - type: array items: oneOf: - type: string - type: number - type: boolean - type: string nullable: true description: null value - type: object description: arbitrary JSON object - type: string - type: number - type: boolean nullable: true issuer: type: string - type: object required: - id - type - userId - verified properties: id: type: string type: type: string format: '"Totp"' userId: type: string verified: type: boolean - type: object required: - id - type - userId properties: id: type: string type: type: string format: '"BackupCode"' userId: type: string code: type: string - type: object required: - id - verified - type - userId properties: id: type: string verified: type: boolean registrationRpId: type: string type: type: string format: '"WebAuthn"' userId: type: string - type: object required: - id - verified - type properties: id: type: string verified: type: boolean registrationRpId: type: string type: type: string format: '"SignInPasskey"' userId: type: string - type: object required: - id - type - verified - identifier properties: id: type: string type: type: string format: '"OneTimeToken"' verified: type: boolean identifier: type: object required: - type - value properties: type: type: string format: '"email"' value: type: string oneTimeTokenContext: type: object properties: jitOrganizationIds: type: array items: type: string - type: object required: - id - type - identifier properties: id: type: string type: type: string format: '"NewPasswordIdentity"' identifier: type: object required: - type - value properties: type: type: string enum: - username - email - phone value: type: string signInContext: type: object additionalProperties: type: string application: type: object properties: tenantId: type: string maxLength: 21 id: type: string minLength: 1 maxLength: 21 name: type: string minLength: 1 maxLength: 256 description: type: string nullable: true type: type: string enum: - Native - SPA - Traditional - MachineToMachine - Protected - SAML oidcClientMetadata: type: object required: - redirectUris - postLogoutRedirectUris properties: redirectUris: type: array items: type: object description: Validator function postLogoutRedirectUris: type: array items: type: object description: Validator function backchannelLogoutUri: type: string format: url backchannelLogoutSessionRequired: type: boolean logoUri: type: string customClientMetadata: type: object properties: corsAllowedOrigins: type: array items: type: string minLength: 1 idTokenTtl: type: number refreshTokenTtl: type: number refreshTokenTtlInDays: type: number tenantId: type: string alwaysIssueRefreshToken: type: boolean rotateRefreshToken: type: boolean allowTokenExchange: type: boolean isDeviceFlow: type: boolean maxAllowedGrants: type: number protectedAppMetadata: type: object required: - host - origin - sessionDuration - pageRules properties: host: type: string origin: type: string sessionDuration: type: number pageRules: type: array items: type: object required: - path properties: path: type: string customDomains: type: array items: type: object required: - domain - status - errorMessage - dnsRecords - cloudflareData properties: domain: type: string status: type: string enum: - PendingVerification - PendingSsl - Active - Error errorMessage: type: string nullable: true dnsRecords: type: array items: type: object required: - name - type - value properties: name: type: string type: type: string value: type: string cloudflareData: type: object required: - id - status - ssl properties: id: type: string status: type: string ssl: type: object required: - status properties: status: type: string validation_errors: type: array items: type: object required: - message properties: message: type: string verification_errors: type: array items: type: string nullable: true nullable: true customData: type: object description: arbitrary isThirdParty: type: boolean createdAt: type: number blockIssuanceOnError: type: boolean tokenSample: type: object properties: jti: type: string aud: oneOf: - type: string - type: array items: type: string scope: type: string clientId: type: string accountId: type: string expiresWithSession: type: boolean grantId: type: string gty: type: string sessionUid: type: string sid: type: string kind: type: string format: '"AccessToken"' - type: object required: - script properties: script: type: string environmentVariables: type: object additionalProperties: type: string contextSample: type: object properties: application: type: object properties: tenantId: type: string maxLength: 21 id: type: string minLength: 1 maxLength: 21 name: type: string minLength: 1 maxLength: 256 description: type: string nullable: true type: type: string enum: - Native - SPA - Traditional - MachineToMachine - Protected - SAML oidcClientMetadata: type: object required: - redirectUris - postLogoutRedirectUris properties: redirectUris: type: array items: type: object description: Validator function postLogoutRedirectUris: type: array items: type: object description: Validator function backchannelLogoutUri: type: string format: url backchannelLogoutSessionRequired: type: boolean logoUri: type: string customClientMetadata: type: object properties: corsAllowedOrigins: type: array items: type: string minLength: 1 idTokenTtl: type: number refreshTokenTtl: type: number refreshTokenTtlInDays: type: number tenantId: type: string alwaysIssueRefreshToken: type: boolean rotateRefreshToken: type: boolean allowTokenExchange: type: boolean isDeviceFlow: type: boolean maxAllowedGrants: type: number protectedAppMetadata: type: object required: - host - origin - sessionDuration - pageRules properties: host: type: string origin: type: string sessionDuration: type: number pageRules: type: array items: type: object required: - path properties: path: type: string customDomains: type: array items: type: object required: - domain - status - errorMessage - dnsRecords - cloudflareData properties: domain: type: string status: type: string enum: - PendingVerification - PendingSsl - Active - Error errorMessage: type: string nullable: true dnsRecords: type: array items: type: object required: - name - type - value properties: name: type: string type: type: string value: type: string cloudflareData: type: object required: - id - status - ssl properties: id: type: string status: type: string ssl: type: object required: - status properties: status: type: string validation_errors: type: array items: type: object required: - message properties: message: type: string verification_errors: type: array items: type: string nullable: true nullable: true customData: type: object description: arbitrary isThirdParty: type: boolean createdAt: type: number blockIssuanceOnError: type: boolean tokenSample: type: object properties: jti: type: string aud: oneOf: - type: string - type: array items: type: string scope: type: string clientId: type: string kind: type: string format: '"ClientCredentials"' '400': description: The request body is invalid. '401': description: Unauthorized '403': description: Forbidden '404': description: Not Found summary: Update JWT customizer description: Update the JWT customizer for the given token type. get: operationId: GetJwtCustomizer tags: - Configs parameters: - name: tokenTypePath in: path required: true schema: type: string enum: - access-token - client-credentials description: The token type to get the JWT customizer for. responses: '200': description: The JWT customizer. content: application/json: schema: oneOf: - type: object required: - script properties: script: type: string environmentVariables: type: object additionalProperties: type: string contextSample: type: object required: - user properties: user: type: object properties: id: type: string minLength: 1 maxLength: 12 username: type: string maxLength: 128 nullable: true primaryEmail: type: string maxLength: 128 nullable: true primaryPhone: type: string maxLength: 128 nullable: true name: type: string maxLength: 128 nullable: true avatar: type: string maxLength: 2048 nullable: true customData: type: object description: arbitrary identities: type: object additionalProperties: type: object required: - userId properties: userId: type: string details: type: object description: arbitrary lastSignInAt: type: number nullable: true createdAt: type: number updatedAt: type: number profile: type: object properties: familyName: type: string givenName: type: string middleName: type: string nickname: type: string preferredUsername: type: string profile: type: string website: type: string gender: type: string birthdate: type: string zoneinfo: type: string locale: type: string address: type: object properties: formatted: type: string streetAddress: type: string locality: type: string region: type: string postalCode: type: string country: type: string applicationId: type: string maxLength: 21 nullable: true isSuspended: type: boolean hasPassword: type: boolean ssoIdentities: type: array items: type: object required: - issuer - identityId - detail properties: issuer: type: string minLength: 1 maxLength: 256 identityId: type: string minLength: 1 maxLength: 128 detail: type: object description: arbitrary mfaVerificationFactors: type: array items: type: string enum: - Totp - WebAuthn - BackupCode - EmailVerificationCode - PhoneVerificationCode roles: type: array items: type: object required: - id - name - description - scopes properties: id: type: string minLength: 1 maxLength: 21 name: type: string minLength: 1 maxLength: 128 description: type: string minLength: 1 maxLength: 128 scopes: type: array items: type: object required: - id - name - description - resourceId - resource properties: id: type: string minLength: 1 maxLength: 21 name: type: string minLength: 1 maxLength: 256 description: type: string nullable: true resourceId: type: string minLength: 1 maxLength: 21 resource: type: object required: - tenantId - id - name - indicator - isDefault - accessTokenTtl properties: tenantId: type: string maxLength: 21 id: type: string minLength: 1 maxLength: 21 name: type: string minLength: 1 indicator: type: string minLength: 1 isDefault: type: boolean accessTokenTtl: type: number organizations: type: array items: type: object required: - id - name - description properties: id: type: string minLength: 1 maxLength: 21 name: type: string minLength: 1 maxLength: 128 description: type: string maxLength: 256 nullable: true organizationRoles: type: array items: type: object required: - organizationId - roleId - roleName properties: organizationId: type: string roleId: type: string roleName: type: string grant: type: object properties: type: type: string format: '"urn:ietf:params:oauth:grant-type:token-exchange"' subjectTokenContext: type: object description: arbitrary interaction: type: object properties: interactionEvent: type: string enum: - SignIn - Register - ForgotPassword userId: type: string verificationRecords: type: array items: oneOf: - type: object required: - id - type - identifier - verified properties: id: type: string type: type: string format: '"Password"' identifier: type: object required: - type - value properties: type: oneOf: - type: string enum: - username - email - phone - type: string enum: - userId value: type: string verified: type: boolean - type: object required: - id - templateType - verified - type - identifier properties: id: type: string templateType: type: string enum: - SignIn - Register - ForgotPassword - OrganizationInvitation - Generic - UserPermissionValidation - BindNewIdentifier - MfaVerification - BindMfa verified: type: boolean type: type: string format: '"EmailVerificationCode"' identifier: type: object required: - type - value properties: type: type: string format: '"email"' value: type: string - type: object required: - id - templateType - verified - type - identifier properties: id: type: string templateType: type: string enum: - SignIn - Register - ForgotPassword - OrganizationInvitation - Generic - UserPermissionValidation - BindNewIdentifier - MfaVerification - BindMfa verified: type: boolean type: type: string format: '"PhoneVerificationCode"' identifier: type: object required: - type - value properties: type: type: string format: '"phone"' value: type: string - type: object required: - id - templateType - verified - type - identifier properties: id: type: string templateType: type: string enum: - SignIn - Register - ForgotPassword - OrganizationInvitation - Generic - UserPermissionValidation - BindNewIdentifier - MfaVerification - BindMfa verified: type: boolean type: type: string format: '"MfaEmailVerificationCode"' identifier: type: object required: - type - value properties: type: type: string format: '"email"' value: type: string - type: object required: - id - templateType - verified - type - identifier properties: id: type: string templateType: type: string enum: - SignIn - Register - ForgotPassword - OrganizationInvitation - Generic - UserPermissionValidation - BindNewIdentifier - MfaVerification - BindMfa verified: type: boolean type: type: string format: '"MfaPhoneVerificationCode"' identifier: type: object required: - type - value properties: type: type: string format: '"phone"' value: type: string - type: object required: - id - connectorId - type properties: id: type: string connectorId: type: string type: type: string format: '"Social"' socialUserInfo: type: object required: - id properties: id: type: string email: type: string phone: type: string name: type: string avatar: type: string rawData: type: object oneOf: - type: object description: arbitrary JSON object - type: array items: oneOf: - type: string - type: number - type: boolean - type: string nullable: true description: null value - type: object description: arbitrary JSON object - type: string - type: number - type: boolean nullable: true - type: object required: - id - connectorId - type properties: id: type: string connectorId: type: string type: type: string format: '"EnterpriseSso"' enterpriseSsoUserInfo: type: object required: - id properties: id: type: string email: type: string phone: type: string name: type: string avatar: type: string rawData: type: object oneOf: - type: object description: arbitrary JSON object - type: array items: oneOf: - type: string - type: number - type: boolean - type: string nullable: true description: null value - type: object description: arbitrary JSON object - type: string - type: number - type: boolean nullable: true issuer: type: string - type: object required: - id - type - userId - verified properties: id: type: string type: type: string format: '"Totp"' userId: type: string verified: type: boolean - type: object required: - id - type - userId properties: id: type: string type: type: string format: '"BackupCode"' userId: type: string code: type: string - type: object required: - id - verified - type - userId properties: id: type: string verified: type: boolean registrationRpId: type: string type: type: string format: '"WebAuthn"' userId: type: string - type: object required: - id - verified - type properties: id: type: string verified: type: boolean registrationRpId: type: string type: type: string format: '"SignInPasskey"' userId: type: string - type: object required: - id - type - verified - identifier properties: id: type: string type: type: string format: '"OneTimeToken"' verified: type: boolean identifier: type: object required: - type - value properties: type: type: string format: '"email"' value: type: string oneTimeTokenContext: type: object properties: jitOrganizationIds: type: array items: type: string - type: object required: - id - type - identifier properties: id: type: string type: type: string format: '"NewPasswordIdentity"' identifier: type: object required: - type - value properties: type: type: string enum: - username - email - phone value: type: string signInContext: type: object additionalProperties: type: string application: type: object properties: tenantId: type: string maxLength: 21 id: type: string minLength: 1 maxLength: 21 name: type: string minLength: 1 maxLength: 256 description: type: string nullable: true type: type: string enum: - Native - SPA - Traditional - MachineToMachine - Protected - SAML oidcClientMetadata: type: object required: - redirectUris - postLogoutRedirectUris properties: redirectUris: type: array items: type: object description: Validator function postLogoutRedirectUris: type: array items: type: object description: Validator function backchannelLogoutUri: type: string format: url backchannelLogoutSessionRequired: type: boolean logoUri: type: string customClientMetadata: type: object properties: corsAllowedOrigins: type: array items: type: string minLength: 1 idTokenTtl: type: number refreshTokenTtl: type: number refreshTokenTtlInDays: type: number tenantId: type: string alwaysIssueRefreshToken: type: boolean rotateRefreshToken: type: boolean allowTokenExchange: type: boolean isDeviceFlow: type: boolean maxAllowedGrants: type: number protectedAppMetadata: type: object required: - host - origin - sessionDuration - pageRules properties: host: type: string origin: type: string sessionDuration: type: number pageRules: type: array items: type: object required: - path properties: path: type: string customDomains: type: array items: type: object required: - domain - status - errorMessage - dnsRecords - cloudflareData properties: domain: type: string status: type: string enum: - PendingVerification - PendingSsl - Active - Error errorMessage: type: string nullable: true dnsRecords: type: array items: type: object required: - name - type - value properties: name: type: string type: type: string value: type: string cloudflareData: type: object required: - id - status - ssl properties: id: type: string status: type: string ssl: type: object required: - status properties: status: type: string validation_errors: type: array items: type: object required: - message properties: message: type: string verification_errors: type: array items: type: string nullable: true nullable: true customData: type: object description: arbitrary isThirdParty: type: boolean createdAt: type: number blockIssuanceOnError: type: boolean tokenSample: type: object properties: jti: type: string aud: oneOf: - type: string - type: array items: type: string scope: type: string clientId: type: string accountId: type: string expiresWithSession: type: boolean grantId: type: string gty: type: string sessionUid: type: string sid: type: string kind: type: string format: '"AccessToken"' - type: object required: - script properties: script: type: string environmentVariables: type: object additionalProperties: type: string contextSample: type: object properties: application: type: object properties: tenantId: type: string maxLength: 21 id: type: string minLength: 1 maxLength: 21 name: type: string minLength: 1 maxLength: 256 description: type: string nullable: true type: type: string enum: - Native - SPA - Traditional - MachineToMachine - Protected - SAML oidcClientMetadata: type: object required: - redirectUris - postLogoutRedirectUris properties: redirectUris: type: array items: type: object description: Validator function postLogoutRedirectUris: type: array items: type: object description: Validator function backchannelLogoutUri: type: string format: url backchannelLogoutSessionRequired: type: boolean logoUri: type: string customClientMetadata: type: object properties: corsAllowedOrigins: type: array items: type: string minLength: 1 idTokenTtl: type: number refreshTokenTtl: type: number refreshTokenTtlInDays: type: number tenantId: type: string alwaysIssueRefreshToken: type: boolean rotateRefreshToken: type: boolean allowTokenExchange: type: boolean isDeviceFlow: type: boolean maxAllowedGrants: type: number protectedAppMetadata: type: object required: - host - origin - sessionDuration - pageRules properties: host: type: string origin: type: string sessionDuration: type: number pageRules: type: array items: type: object required: - path properties: path: type: string customDomains: type: array items: type: object required: - domain - status - errorMessage - dnsRecords - cloudflareData properties: domain: type: string status: type: string enum: - PendingVerification - PendingSsl - Active - Error errorMessage: type: string nullable: true dnsRecords: type: array items: type: object required: - name - type - value properties: name: type: string type: type: string value: type: string cloudflareData: type: object required: - id - status - ssl properties: id: type: string status: type: string ssl: type: object required: - status properties: status: type: string validation_errors: type: array items: type: object required: - message properties: message: type: string verification_errors: type: array items: type: string nullable: true nullable: true customData: type: object description: arbitrary isThirdParty: type: boolean createdAt: type: number blockIssuanceOnError: type: boolean tokenSample: type: object properties: jti: type: string aud: oneOf: - type: string - type: array items: type: string scope: type: string clientId: type: string kind: type: string format: '"ClientCredentials"' '400': description: Bad Request '401': description: Unauthorized '403': description: Forbidden '404': description: The JWT customizer does not exist. summary: Get JWT customizer description: Get the JWT customizer for the given token type. delete: operationId: DeleteJwtCustomizer tags: - Configs parameters: - name: tokenTypePath in: path required: true schema: type: string enum: - access-token - client-credentials description: The token type path to delete the JWT customizer for. responses: '204': description: The JWT customizer was deleted successfully. '400': description: Bad Request '401': description: Unauthorized '403': description: Forbidden '404': description: The JWT customizer does not exist. summary: Delete JWT customizer description: Delete the JWT customizer for the given token type. /api/configs/jwt-customizer: get: operationId: ListJwtCustomizers tags: - Configs parameters: [] responses: '200': description: The JWT customizers. content: application/json: schema: type: array items: oneOf: - type: object required: - key - value properties: key: type: string format: '"jwt.accessToken"' value: type: object required: - script properties: script: type: string environmentVariables: type: object additionalProperties: type: string contextSample: type: object required: - user properties: user: type: object properties: id: type: string minLength: 1 maxLength: 12 username: type: string maxLength: 128 nullable: true primaryEmail: type: string maxLength: 128 nullable: true primaryPhone: type: string maxLength: 128 nullable: true name: type: string maxLength: 128 nullable: true avatar: type: string maxLength: 2048 nullable: true customData: type: object description: arbitrary identities: type: object additionalProperties: type: object required: - userId properties: userId: type: string details: type: object description: arbitrary lastSignInAt: type: number nullable: true createdAt: type: number updatedAt: type: number profile: type: object properties: familyName: type: string givenName: type: string middleName: type: string nickname: type: string preferredUsername: type: string profile: type: string website: type: string gender: type: string birthdate: type: string zoneinfo: type: string locale: type: string address: type: object properties: formatted: type: string streetAddress: type: string locality: type: string region: type: string postalCode: type: string country: type: string applicationId: type: string maxLength: 21 nullable: true isSuspended: type: boolean hasPassword: type: boolean ssoIdentities: type: array items: type: object required: - issuer - identityId - detail properties: issuer: type: string minLength: 1 maxLength: 256 identityId: type: string minLength: 1 maxLength: 128 detail: type: object description: arbitrary mfaVerificationFactors: type: array items: type: string enum: - Totp - WebAuthn - BackupCode - EmailVerificationCode - PhoneVerificationCode roles: type: array items: type: object required: - id - name - description - scopes properties: id: type: string minLength: 1 maxLength: 21 name: type: string minLength: 1 maxLength: 128 description: type: string minLength: 1 maxLength: 128 scopes: type: array items: type: object required: - id - name - description - resourceId - resource properties: id: type: string minLength: 1 maxLength: 21 name: type: string minLength: 1 maxLength: 256 description: type: string nullable: true resourceId: type: string minLength: 1 maxLength: 21 resource: type: object required: - tenantId - id - name - indicator - isDefault - accessTokenTtl properties: tenantId: type: string maxLength: 21 id: type: string minLength: 1 maxLength: 21 name: type: string minLength: 1 indicator: type: string minLength: 1 isDefault: type: boolean accessTokenTtl: type: number organizations: type: array items: type: object required: - id - name - description properties: id: type: string minLength: 1 maxLength: 21 name: type: string minLength: 1 maxLength: 128 description: type: string maxLength: 256 nullable: true organizationRoles: type: array items: type: object required: - organizationId - roleId - roleName properties: organizationId: type: string roleId: type: string roleName: type: string grant: type: object properties: type: type: string format: '"urn:ietf:params:oauth:grant-type:token-exchange"' subjectTokenContext: type: object description: arbitrary interaction: type: object properties: interactionEvent: type: string enum: - SignIn - Register - ForgotPassword userId: type: string verificationRecords: type: array items: oneOf: - type: object required: - id - type - identifier - verified properties: id: type: string type: type: string format: '"Password"' identifier: type: object required: - type - value properties: type: oneOf: - type: string enum: - username - email - phone - type: string enum: - userId value: type: string verified: type: boolean - type: object required: - id - templateType - verified - type - identifier properties: id: type: string templateType: type: string enum: - SignIn - Register - ForgotPassword - OrganizationInvitation - Generic - UserPermissionValidation - BindNewIdentifier - MfaVerification - BindMfa verified: type: boolean type: type: string format: '"EmailVerificationCode"' identifier: type: object required: - type - value properties: type: type: string format: '"email"' value: type: string - type: object required: - id - templateType - verified - type - identifier properties: id: type: string templateType: type: string enum: - SignIn - Register - ForgotPassword - OrganizationInvitation - Generic - UserPermissionValidation - BindNewIdentifier - MfaVerification - BindMfa verified: type: boolean type: type: string format: '"PhoneVerificationCode"' identifier: type: object required: - type - value properties: type: type: string format: '"phone"' value: type: string - type: object required: - id - templateType - verified - type - identifier properties: id: type: string templateType: type: string enum: - SignIn - Register - ForgotPassword - OrganizationInvitation - Generic - UserPermissionValidation - BindNewIdentifier - MfaVerification - BindMfa verified: type: boolean type: type: string format: '"MfaEmailVerificationCode"' identifier: type: object required: - type - value properties: type: type: string format: '"email"' value: type: string - type: object required: - id - templateType - verified - type - identifier properties: id: type: string templateType: type: string enum: - SignIn - Register - ForgotPassword - OrganizationInvitation - Generic - UserPermissionValidation - BindNewIdentifier - MfaVerification - BindMfa verified: type: boolean type: type: string format: '"MfaPhoneVerificationCode"' identifier: type: object required: - type - value properties: type: type: string format: '"phone"' value: type: string - type: object required: - id - connectorId - type properties: id: type: string connectorId: type: string type: type: string format: '"Social"' socialUserInfo: type: object required: - id properties: id: type: string email: type: string phone: type: string name: type: string avatar: type: string rawData: type: object oneOf: - type: object description: arbitrary JSON object - type: array items: oneOf: - type: string - type: number - type: boolean - type: string nullable: true description: null value - type: object description: arbitrary JSON object - type: string - type: number - type: boolean nullable: true - type: object required: - id - connectorId - type properties: id: type: string connectorId: type: string type: type: string format: '"EnterpriseSso"' enterpriseSsoUserInfo: type: object required: - id properties: id: type: string email: type: string phone: type: string name: type: string avatar: type: string rawData: type: object oneOf: - type: object description: arbitrary JSON object - type: array items: oneOf: - type: string - type: number - type: boolean - type: string nullable: true description: null value - type: object description: arbitrary JSON object - type: string - type: number - type: boolean nullable: true issuer: type: string - type: object required: - id - type - userId - verified properties: id: type: string type: type: string format: '"Totp"' userId: type: string verified: type: boolean - type: object required: - id - type - userId properties: id: type: string type: type: string format: '"BackupCode"' userId: type: string code: type: string - type: object required: - id - verified - type - userId properties: id: type: string verified: type: boolean registrationRpId: type: string type: type: string format: '"WebAuthn"' userId: type: string - type: object required: - id - verified - type properties: id: type: string verified: type: boolean registrationRpId: type: string type: type: string format: '"SignInPasskey"' userId: type: string - type: object required: - id - type - verified - identifier properties: id: type: string type: type: string format: '"OneTimeToken"' verified: type: boolean identifier: type: object required: - type - value properties: type: type: string format: '"email"' value: type: string oneTimeTokenContext: type: object properties: jitOrganizationIds: type: array items: type: string - type: object required: - id - type - identifier properties: id: type: string type: type: string format: '"NewPasswordIdentity"' identifier: type: object required: - type - value properties: type: type: string enum: - username - email - phone value: type: string signInContext: type: object additionalProperties: type: string application: type: object properties: tenantId: type: string maxLength: 21 id: type: string minLength: 1 maxLength: 21 name: type: string minLength: 1 maxLength: 256 description: type: string nullable: true type: type: string enum: - Native - SPA - Traditional - MachineToMachine - Protected - SAML oidcClientMetadata: type: object required: - redirectUris - postLogoutRedirectUris properties: redirectUris: type: array items: type: object description: Validator function postLogoutRedirectUris: type: array items: type: object description: Validator function backchannelLogoutUri: type: string format: url backchannelLogoutSessionRequired: type: boolean logoUri: type: string customClientMetadata: type: object properties: corsAllowedOrigins: type: array items: type: string minLength: 1 idTokenTtl: type: number refreshTokenTtl: type: number refreshTokenTtlInDays: type: number tenantId: type: string alwaysIssueRefreshToken: type: boolean rotateRefreshToken: type: boolean allowTokenExchange: type: boolean isDeviceFlow: type: boolean maxAllowedGrants: type: number protectedAppMetadata: type: object required: - host - origin - sessionDuration - pageRules properties: host: type: string origin: type: string sessionDuration: type: number pageRules: type: array items: type: object required: - path properties: path: type: string customDomains: type: array items: type: object required: - domain - status - errorMessage - dnsRecords - cloudflareData properties: domain: type: string status: type: string enum: - PendingVerification - PendingSsl - Active - Error errorMessage: type: string nullable: true dnsRecords: type: array items: type: object required: - name - type - value properties: name: type: string type: type: string value: type: string cloudflareData: type: object required: - id - status - ssl properties: id: type: string status: type: string ssl: type: object required: - status properties: status: type: string validation_errors: type: array items: type: object required: - message properties: message: type: string verification_errors: type: array items: type: string nullable: true nullable: true customData: type: object description: arbitrary isThirdParty: type: boolean createdAt: type: number blockIssuanceOnError: type: boolean tokenSample: type: object properties: jti: type: string aud: oneOf: - type: string - type: array items: type: string scope: type: string clientId: type: string accountId: type: string expiresWithSession: type: boolean grantId: type: string gty: type: string sessionUid: type: string sid: type: string kind: type: string format: '"AccessToken"' - type: object required: - key - value properties: key: type: string format: '"jwt.clientCredentials"' value: type: object required: - script properties: script: type: string environmentVariables: type: object additionalProperties: type: string contextSample: type: object properties: application: type: object properties: tenantId: type: string maxLength: 21 id: type: string minLength: 1 maxLength: 21 name: type: string minLength: 1 maxLength: 256 description: type: string nullable: true type: type: string enum: - Native - SPA - Traditional - MachineToMachine - Protected - SAML oidcClientMetadata: type: object required: - redirectUris - postLogoutRedirectUris properties: redirectUris: type: array items: type: object description: Validator function postLogoutRedirectUris: type: array items: type: object description: Validator function backchannelLogoutUri: type: string format: url backchannelLogoutSessionRequired: type: boolean logoUri: type: string customClientMetadata: type: object properties: corsAllowedOrigins: type: array items: type: string minLength: 1 idTokenTtl: type: number refreshTokenTtl: type: number refreshTokenTtlInDays: type: number tenantId: type: string alwaysIssueRefreshToken: type: boolean rotateRefreshToken: type: boolean allowTokenExchange: type: boolean isDeviceFlow: type: boolean maxAllowedGrants: type: number protectedAppMetadata: type: object required: - host - origin - sessionDuration - pageRules properties: host: type: string origin: type: string sessionDuration: type: number pageRules: type: array items: type: object required: - path properties: path: type: string customDomains: type: array items: type: object required: - domain - status - errorMessage - dnsRecords - cloudflareData properties: domain: type: string status: type: string enum: - PendingVerification - PendingSsl - Active - Error errorMessage: type: string nullable: true dnsRecords: type: array items: type: object required: - name - type - value properties: name: type: string type: type: string value: type: string cloudflareData: type: object required: - id - status - ssl properties: id: type: string status: type: string ssl: type: object required: - status properties: status: type: string validation_errors: type: array items: type: object required: - message properties: message: type: string verification_errors: type: array items: type: string nullable: true nullable: true customData: type: object description: arbitrary isThirdParty: type: boolean createdAt: type: number blockIssuanceOnError: type: boolean tokenSample: type: object properties: jti: type: string aud: oneOf: - type: string - type: array items: type: string scope: type: string clientId: type: string kind: type: string format: '"ClientCredentials"' '401': description: Unauthorized '403': description: Forbidden summary: Get all JWT customizers description: Get all JWT customizers for the tenant. /api/configs/jwt-customizer/test: post: operationId: TestJwtCustomizer tags: - Configs parameters: [] requestBody: required: true content: application/json: schema: oneOf: - type: object required: - tokenType - script - token - context properties: tokenType: type: string format: '"access-token"' environmentVariables: type: object additionalProperties: type: string script: type: string token: type: object properties: jti: type: string aud: oneOf: - type: string - type: array items: type: string scope: type: string clientId: type: string accountId: type: string expiresWithSession: type: boolean grantId: type: string gty: type: string sessionUid: type: string sid: type: string kind: type: string format: '"AccessToken"' context: type: object required: - user properties: user: type: object properties: id: type: string minLength: 1 maxLength: 12 username: type: string maxLength: 128 nullable: true primaryEmail: type: string maxLength: 128 nullable: true primaryPhone: type: string maxLength: 128 nullable: true name: type: string maxLength: 128 nullable: true avatar: type: string maxLength: 2048 nullable: true customData: type: object description: arbitrary identities: type: object additionalProperties: type: object required: - userId properties: userId: type: string details: type: object description: arbitrary lastSignInAt: type: number nullable: true createdAt: type: number updatedAt: type: number profile: type: object properties: familyName: type: string givenName: type: string middleName: type: string nickname: type: string preferredUsername: type: string profile: type: string website: type: string gender: type: string birthdate: type: string zoneinfo: type: string locale: type: string address: type: object properties: formatted: type: string streetAddress: type: string locality: type: string region: type: string postalCode: type: string country: type: string applicationId: type: string maxLength: 21 nullable: true isSuspended: type: boolean hasPassword: type: boolean ssoIdentities: type: array items: type: object required: - issuer - identityId - detail properties: issuer: type: string minLength: 1 maxLength: 256 identityId: type: string minLength: 1 maxLength: 128 detail: type: object description: arbitrary mfaVerificationFactors: type: array items: type: string enum: - Totp - WebAuthn - BackupCode - EmailVerificationCode - PhoneVerificationCode roles: type: array items: type: object required: - id - name - description - scopes properties: id: type: string minLength: 1 maxLength: 21 name: type: string minLength: 1 maxLength: 128 description: type: string minLength: 1 maxLength: 128 scopes: type: array items: type: object required: - id - name - description - resourceId - resource properties: id: type: string minLength: 1 maxLength: 21 name: type: string minLength: 1 maxLength: 256 description: type: string nullable: true resourceId: type: string minLength: 1 maxLength: 21 resource: type: object required: - tenantId - id - name - indicator - isDefault - accessTokenTtl properties: tenantId: type: string maxLength: 21 id: type: string minLength: 1 maxLength: 21 name: type: string minLength: 1 indicator: type: string minLength: 1 isDefault: type: boolean accessTokenTtl: type: number organizations: type: array items: type: object required: - id - name - description properties: id: type: string minLength: 1 maxLength: 21 name: type: string minLength: 1 maxLength: 128 description: type: string maxLength: 256 nullable: true organizationRoles: type: array items: type: object required: - organizationId - roleId - roleName properties: organizationId: type: string roleId: type: string roleName: type: string grant: type: object properties: type: type: string format: '"urn:ietf:params:oauth:grant-type:token-exchange"' subjectTokenContext: type: object description: arbitrary interaction: type: object properties: interactionEvent: type: string enum: - SignIn - Register - ForgotPassword userId: type: string verificationRecords: type: array items: oneOf: - type: object required: - id - type - identifier - verified properties: id: type: string type: type: string format: '"Password"' identifier: type: object required: - type - value properties: type: oneOf: - type: string enum: - username - email - phone - type: string enum: - userId value: type: string verified: type: boolean - type: object required: - id - templateType - verified - type - identifier properties: id: type: string templateType: type: string enum: - SignIn - Register - ForgotPassword - OrganizationInvitation - Generic - UserPermissionValidation - BindNewIdentifier - MfaVerification - BindMfa verified: type: boolean type: type: string format: '"EmailVerificationCode"' identifier: type: object required: - type - value properties: type: type: string format: '"email"' value: type: string - type: object required: - id - templateType - verified - type - identifier properties: id: type: string templateType: type: string enum: - SignIn - Register - ForgotPassword - OrganizationInvitation - Generic - UserPermissionValidation - BindNewIdentifier - MfaVerification - BindMfa verified: type: boolean type: type: string format: '"PhoneVerificationCode"' identifier: type: object required: - type - value properties: type: type: string format: '"phone"' value: type: string - type: object required: - id - templateType - verified - type - identifier properties: id: type: string templateType: type: string enum: - SignIn - Register - ForgotPassword - OrganizationInvitation - Generic - UserPermissionValidation - BindNewIdentifier - MfaVerification - BindMfa verified: type: boolean type: type: string format: '"MfaEmailVerificationCode"' identifier: type: object required: - type - value properties: type: type: string format: '"email"' value: type: string - type: object required: - id - templateType - verified - type - identifier properties: id: type: string templateType: type: string enum: - SignIn - Register - ForgotPassword - OrganizationInvitation - Generic - UserPermissionValidation - BindNewIdentifier - MfaVerification - BindMfa verified: type: boolean type: type: string format: '"MfaPhoneVerificationCode"' identifier: type: object required: - type - value properties: type: type: string format: '"phone"' value: type: string - type: object required: - id - connectorId - type properties: id: type: string connectorId: type: string type: type: string format: '"Social"' socialUserInfo: type: object required: - id properties: id: type: string email: type: string phone: type: string name: type: string avatar: type: string rawData: type: object oneOf: - type: object description: arbitrary JSON object - type: array items: oneOf: - type: string - type: number - type: boolean - type: string nullable: true description: null value - type: object description: arbitrary JSON object - type: string - type: number - type: boolean nullable: true - type: object required: - id - connectorId - type properties: id: type: string connectorId: type: string type: type: string format: '"EnterpriseSso"' enterpriseSsoUserInfo: type: object required: - id properties: id: type: string email: type: string phone: type: string name: type: string avatar: type: string rawData: type: object oneOf: - type: object description: arbitrary JSON object - type: array items: oneOf: - type: string - type: number - type: boolean - type: string nullable: true description: null value - type: object description: arbitrary JSON object - type: string - type: number - type: boolean nullable: true issuer: type: string - type: object required: - id - type - userId - verified properties: id: type: string type: type: string format: '"Totp"' userId: type: string verified: type: boolean - type: object required: - id - type - userId properties: id: type: string type: type: string format: '"BackupCode"' userId: type: string code: type: string - type: object required: - id - verified - type - userId properties: id: type: string verified: type: boolean registrationRpId: type: string type: type: string format: '"WebAuthn"' userId: type: string - type: object required: - id - verified - type properties: id: type: string verified: type: boolean registrationRpId: type: string type: type: string format: '"SignInPasskey"' userId: type: string - type: object required: - id - type - verified - identifier properties: id: type: string type: type: string format: '"OneTimeToken"' verified: type: boolean identifier: type: object required: - type - value properties: type: type: string format: '"email"' value: type: string oneTimeTokenContext: type: object properties: jitOrganizationIds: type: array items: type: string - type: object required: - id - type - identifier properties: id: type: string type: type: string format: '"NewPasswordIdentity"' identifier: type: object required: - type - value properties: type: type: string enum: - username - email - phone value: type: string signInContext: type: object additionalProperties: type: string application: type: object properties: tenantId: type: string maxLength: 21 id: type: string minLength: 1 maxLength: 21 name: type: string minLength: 1 maxLength: 256 description: type: string nullable: true type: type: string enum: - Native - SPA - Traditional - MachineToMachine - Protected - SAML oidcClientMetadata: type: object required: - redirectUris - postLogoutRedirectUris properties: redirectUris: type: array items: type: object description: Validator function postLogoutRedirectUris: type: array items: type: object description: Validator function backchannelLogoutUri: type: string format: url backchannelLogoutSessionRequired: type: boolean logoUri: type: string customClientMetadata: type: object properties: corsAllowedOrigins: type: array items: type: string minLength: 1 idTokenTtl: type: number refreshTokenTtl: type: number refreshTokenTtlInDays: type: number tenantId: type: string alwaysIssueRefreshToken: type: boolean rotateRefreshToken: type: boolean allowTokenExchange: type: boolean isDeviceFlow: type: boolean maxAllowedGrants: type: number protectedAppMetadata: type: object required: - host - origin - sessionDuration - pageRules properties: host: type: string origin: type: string sessionDuration: type: number pageRules: type: array items: type: object required: - path properties: path: type: string customDomains: type: array items: type: object required: - domain - status - errorMessage - dnsRecords - cloudflareData properties: domain: type: string status: type: string enum: - PendingVerification - PendingSsl - Active - Error errorMessage: type: string nullable: true dnsRecords: type: array items: type: object required: - name - type - value properties: name: type: string type: type: string value: type: string cloudflareData: type: object required: - id - status - ssl properties: id: type: string status: type: string ssl: type: object required: - status properties: status: type: string validation_errors: type: array items: type: object required: - message properties: message: type: string verification_errors: type: array items: type: string nullable: true nullable: true customData: type: object description: arbitrary isThirdParty: type: boolean createdAt: type: number - type: object required: - tokenType - script - token - context properties: tokenType: type: string format: '"client-credentials"' environmentVariables: type: object additionalProperties: type: string script: type: string token: type: object properties: jti: type: string aud: oneOf: - type: string - type: array items: type: string scope: type: string clientId: type: string kind: type: string format: '"ClientCredentials"' context: type: object properties: application: type: object properties: tenantId: type: string maxLength: 21 id: type: string minLength: 1 maxLength: 21 name: type: string minLength: 1 maxLength: 256 description: type: string nullable: true type: type: string enum: - Native - SPA - Traditional - MachineToMachine - Protected - SAML oidcClientMetadata: type: object required: - redirectUris - postLogoutRedirectUris properties: redirectUris: type: array items: type: object description: Validator function postLogoutRedirectUris: type: array items: type: object description: Validator function backchannelLogoutUri: type: string format: url backchannelLogoutSessionRequired: type: boolean logoUri: type: string customClientMetadata: type: object properties: corsAllowedOrigins: type: array items: type: string minLength: 1 idTokenTtl: type: number refreshTokenTtl: type: number refreshTokenTtlInDays: type: number tenantId: type: string alwaysIssueRefreshToken: type: boolean rotateRefreshToken: type: boolean allowTokenExchange: type: boolean isDeviceFlow: type: boolean maxAllowedGrants: type: number protectedAppMetadata: type: object required: - host - origin - sessionDuration - pageRules properties: host: type: string origin: type: string sessionDuration: type: number pageRules: type: array items: type: object required: - path properties: path: type: string customDomains: type: array items: type: object required: - domain - status - errorMessage - dnsRecords - cloudflareData properties: domain: type: string status: type: string enum: - PendingVerification - PendingSsl - Active - Error errorMessage: type: string nullable: true dnsRecords: type: array items: type: object required: - name - type - value properties: name: type: string type: type: string value: type: string cloudflareData: type: object required: - id - status - ssl properties: id: type: string status: type: string ssl: type: object required: - status properties: status: type: string validation_errors: type: array items: type: object required: - message properties: message: type: string verification_errors: type: array items: type: string nullable: true nullable: true customData: type: object description: arbitrary isThirdParty: type: boolean createdAt: type: number properties: tokenType: description: The token type to test the JWT customizer for. payload: properties: script: description: The code snippet of the JWT customizer. environmentVariables: description: The environment variables for the JWT customizer. contextSample: description: The sample context for the JWT customizer script testing purpose. tokenSample: description: The sample token payload for the JWT customizer script testing purpose. responses: '200': description: The result of the JWT customizer script testing. content: application/json: schema: type: object description: arbitrary '400': description: Zod errors in cloud service (data type does not match expectation, can be either request body or response body). '401': description: Unauthorized '403': description: Cloud connection does not have enough permission to perform the action. '422': description: Syntax errors in cloud service. summary: Test JWT customizer description: Test the JWT customizer script with the given sample context and sample token payload. /api/configs/id-token: get: operationId: GetIdTokenConfig tags: - Configs parameters: [] responses: '200': description: The ID token claims configuration. content: application/json: schema: type: object properties: enabledExtendedClaims: type: array items: type: string enum: - custom_data - identities - sso_identities - roles - organizations - organization_data - organization_roles '401': description: Unauthorized '403': description: Forbidden '404': description: Configuration not found. summary: Get ID token claims configuration description: Get the ID token extended claims configuration for the tenant. This configuration controls which extended claims (e.g., `custom_data`, `identities`, `roles`, `organizations`, `organization_roles`) are included in ID tokens. put: operationId: UpsertIdTokenConfig tags: - Configs parameters: [] requestBody: required: true content: application/json: schema: type: object properties: enabledExtendedClaims: type: array items: type: string enum: - custom_data - identities - sso_identities - roles - organizations - organization_data - organization_roles description: 'An array of extended claims to include in ID tokens. Possible values: `custom_data`, `identities`, `sso_identities`, `roles`, `organizations`, `organization_data`, `organization_roles`.' responses: '200': description: The updated ID token claims configuration. content: application/json: schema: type: object properties: enabledExtendedClaims: type: array items: type: string enum: - custom_data - identities - sso_identities - roles - organizations - organization_data - organization_roles '400': description: Bad Request '401': description: Unauthorized '403': description: The tenant's subscription plan does not support this feature. summary: Upsert ID token claims configuration description: Create or update the ID token extended claims configuration for the tenant. This controls which extended claims are included in ID tokens when the corresponding scopes are requested. components: parameters: keyId: in: path description: The unique identifier of the key. required: true schema: type: string name: keyId securitySchemes: OAuth2: type: oauth2 description: "Logto Management API is a comprehensive set of REST APIs that gives you the full control over Logto to suit your product needs and tech stack. To see the full guide on Management API interactions, visit [Interact with Management API](https://docs.logto.io/docs/recipes/interact-with-management-api/).\n\n### Get started\n\nThe API follows the same authentication principles as other API resources in Logto, with some slight differences. To use Logto Management API:\n\n1. A machine-to-machine (M2M) application needs to be created.\n2. A machine-to-machine (M2M) role with Management API permission `all` needs to be assigned to the application.\n\nOnce you have them set up, you can use the `client_credentials` grant type to fetch an access token and use it to authenticate your requests to the Logto Management API.\n\n### Fetch an access token\n\nTo fetch an access token, you need to make a `POST` request to the `/oidc/token` endpoint of your Logto tenant.\n\nFor Logto Cloud users, the base URL is your Logto endpoint, i.e. `https://[tenant-id].logto.app`. The tenant ID can be found in the following places:\n\n- The first path segment of the URL when you are signed in to Logto Cloud. For example, if the URL is `https://cloud.logto.io/foo/get-started`, the tenant ID is `foo`.\n- In the \"Settings\" tab of Logto Cloud.\n\nThe request should follow the OAuth 2.0 [client credentials](https://datatracker.ietf.org/doc/html/rfc6749#section-4.4) grant type. Here is a non-normative example of how to fetch an access token:\n\n```bash\ncurl --location \\\n --request POST 'https://[tenant-id].logto.app/oidc/token' \\\n --header 'Content-Type: application/x-www-form-urlencoded' \\\n --data-urlencode 'grant_type=client_credentials' \\\n --data-urlencode 'client_id=[app-id]' \\\n --data-urlencode 'client_secret=[app-secret]' \\\n --data-urlencode 'resource=https://[tenant-id].logto.app/api' \\\n --data-urlencode 'scope=all'\n```\n\nReplace `[tenant-id]`, `[app-id]`, and `[app-secret]` with your Logto tenant ID, application ID, and application secret, respectively.\n\nThe response will be like:\n\n```json\n{\n \"access_token\": \"eyJhbG...2g\", // Use this value for accessing the Logto Management API\n \"expires_in\": 3600, // Token expiration in seconds\n \"token_type\": \"Bearer\", // Token type for your request when using the access token\n \"scope\": \"all\" // Scope `all` for Logto Management API\n}\n```\n\n### Use the access token\n\nOnce you have the access token, you can use it to authenticate your requests to the Logto Management API. The access token should be included in the `Authorization` header of your requests with the `Bearer` authentication scheme.\n\nHere is an example of how to list the first page of users in your Logto tenant:\n\n```bash\ncurl --location \\\n --request GET 'https://[tenant-id].logto.app/api/users' \\\n --header 'Authorization: Bearer eyJhbG...2g'\n```\n\nReplace `[tenant-id]` with your Logto tenant ID and `eyJhbG...2g` with the access token you fetched earlier." flows: clientCredentials: tokenUrl: /oidc/token scopes: all: All scopes