openapi: 3.1.0
info:
  title: PingOne Platform API
  description: |
    PingOne is Ping Identity's cloud-based identity and access management
    platform. The Platform API manages PingOne environments, populations,
    users, applications, identity providers, and authentication flows.
    Authentication uses OAuth 2.0 access tokens obtained from
    auth.pingone.com; the platform API base endpoint is api.pingone.com.
  version: "1.0.0"
  contact:
    name: API Evangelist
    email: kin@apievangelist.com
  license:
    name: Proprietary
servers:
  - url: https://api.pingone.com/v1
    description: PingOne Platform API
  - url: https://auth.pingone.com
    description: PingOne Authentication service (token endpoint)
security:
  - bearerAuth: []
tags:
  - name: Authentication
    description: OAuth 2.0 token endpoints.
  - name: Environments
    description: Manage PingOne environments.
  - name: Populations
    description: Manage user populations inside an environment.
  - name: Users
    description: Manage end-user identities.
  - name: Applications
    description: Manage OIDC/SAML applications.
paths:
  /as/token:
    post:
      tags: [Authentication]
      summary: Obtain OAuth 2.0 access token
      description: Exchange client credentials for a Bearer access token.
      security: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required: [grant_type]
              properties:
                grant_type:
                  type: string
                  enum: [client_credentials, authorization_code, refresh_token]
                client_id:
                  type: string
                client_secret:
                  type: string
                scope:
                  type: string
      responses:
        '200':
          description: Access token issued.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenResponse'
  /environments:
    get:
      tags: [Environments]
      summary: Read all environments
      responses:
        '200':
          description: Environment collection.
    post:
      tags: [Environments]
      summary: Create environment
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Environment'
      responses:
        '201':
          description: Environment created.
  /environments/{environmentId}:
    parameters:
      - $ref: '#/components/parameters/EnvironmentId'
    get:
      tags: [Environments]
      summary: Read one environment
      responses:
        '200':
          description: Environment.
    put:
      tags: [Environments]
      summary: Update environment
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Environment'
      responses:
        '200':
          description: Environment updated.
    delete:
      tags: [Environments]
      summary: Delete environment
      responses:
        '204':
          description: Environment deleted.
  /environments/{environmentId}/populations:
    parameters:
      - $ref: '#/components/parameters/EnvironmentId'
    get:
      tags: [Populations]
      summary: Read populations
      responses:
        '200':
          description: Population collection.
    post:
      tags: [Populations]
      summary: Create a population
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Population'
      responses:
        '201':
          description: Population created.
  /environments/{environmentId}/users:
    parameters:
      - $ref: '#/components/parameters/EnvironmentId'
    get:
      tags: [Users]
      summary: Read users
      responses:
        '200':
          description: User collection.
    post:
      tags: [Users]
      summary: Create a user
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/User'
      responses:
        '201':
          description: User created.
  /environments/{environmentId}/users/{userId}:
    parameters:
      - $ref: '#/components/parameters/EnvironmentId'
      - $ref: '#/components/parameters/UserId'
    put:
      tags: [Users]
      summary: Update user
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/User'
      responses:
        '200':
          description: User updated.
  /environments/{environmentId}/users/{userId}/password:
    parameters:
      - $ref: '#/components/parameters/EnvironmentId'
      - $ref: '#/components/parameters/UserId'
    put:
      tags: [Users]
      summary: Set user password
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                currentPassword:
                  type: string
                newPassword:
                  type: string
      responses:
        '200':
          description: Password set.
  /environments/{environmentId}/applications:
    parameters:
      - $ref: '#/components/parameters/EnvironmentId'
    get:
      tags: [Applications]
      summary: Read all applications
      responses:
        '200':
          description: Application collection.
    post:
      tags: [Applications]
      summary: Create application
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Application'
      responses:
        '201':
          description: Application created.
  /environments/{environmentId}/applications/{applicationId}:
    parameters:
      - $ref: '#/components/parameters/EnvironmentId'
      - $ref: '#/components/parameters/ApplicationId'
    get:
      tags: [Applications]
      summary: Read one application
      responses:
        '200':
          description: Application.
    put:
      tags: [Applications]
      summary: Update application
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Application'
      responses:
        '200':
          description: Application updated.
    delete:
      tags: [Applications]
      summary: Delete application
      responses:
        '204':
          description: Application deleted.
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: |
        OAuth 2.0 Bearer access token issued by the PingOne authentication
        service at auth.pingone.com.
  parameters:
    EnvironmentId:
      name: environmentId
      in: path
      required: true
      schema:
        type: string
      description: PingOne environment identifier.
    UserId:
      name: userId
      in: path
      required: true
      schema:
        type: string
    ApplicationId:
      name: applicationId
      in: path
      required: true
      schema:
        type: string
  schemas:
    TokenResponse:
      type: object
      properties:
        access_token:
          type: string
        token_type:
          type: string
        expires_in:
          type: integer
        scope:
          type: string
    Environment:
      type: object
      properties:
        id:
          type: string
        name:
          type: string
        description:
          type: string
        type:
          type: string
          enum: [PRODUCTION, SANDBOX]
        region:
          type: string
    Population:
      type: object
      properties:
        id:
          type: string
        name:
          type: string
        description:
          type: string
    User:
      type: object
      properties:
        id:
          type: string
        username:
          type: string
        email:
          type: string
        name:
          type: object
          properties:
            given:
              type: string
            family:
              type: string
        population:
          type: object
          properties:
            id:
              type: string
    Application:
      type: object
      properties:
        id:
          type: string
        name:
          type: string
        description:
          type: string
        enabled:
          type: boolean
        protocol:
          type: string
          enum: [OPENID_CONNECT, SAML, WS_FED]
        type:
          type: string