slug: propelauth
provider: PropelAuth
generated_by: planning/capability-mapping/scripts/classify_capabilities.py
model: claude-opus-5
frame:
- Software & Technology
min_confidence: 0.7
capability_model:
  source: https://github.com/vincentmakes/turbo-ea-capabilities
  license: CC-BY-4.0
  attribution: Turbo EA Capabilities by Vincent Verdet — Turbo EA, https://github.com/vincentmakes/turbo-ea-capabilities,
    CC BY 4.0
  notice: NOTICE
edge_count: 10
edges:
- tag: OAuth2
  spec_file: propelauth-oauth2-api-openapi.yml
  capability_id: BC-620.20
  capability_id_l1: BC-620
  capability_name: Identity & Access Management
  confidence: 0.85
  evidence: GET /propelauth/oauth/authorize  authorize; POST /propelauth/oauth/token  token; GET /propelauth/oauth/userinfo  userInfo;
    POST /api/backend/v1/logout  logout
  reason: OAuth2/OIDC authorize, token, userinfo and logout endpoints — authentication, federation and
    session termination, plainly Identity & Access Management.
- tag: Users
  spec_file: propelauth-users-api-openapi.yml
  capability_id: BC-620.20
  capability_id_l1: BC-620
  capability_name: Identity & Access Management
  confidence: 0.85
  evidence: POST /api/backend/v1/user/ createUser; PUT /api/backend/v1/user/{userId}/password updateUserPassword;
    POST /api/backend/v1/user/{userId}/disable disableUser
  reason: Full lifecycle of authentication identities — create, update, disable/enable users, password
    and email management — which is Identity & Access Management (joiners-movers-leavers for application
    identities), not HR employee records.
- tag: API Keys
  spec_file: propelauth-api-keys-api-openapi.yml
  capability_id: BC-620.20
  capability_id_l1: BC-620
  capability_name: Identity & Access Management
  confidence: 0.8
  evidence: Backend REST API for validating, issuing, listing, and revoking API keys ... scoped to a personal
    user, an organization
  reason: Issuance and revocation of scoped credentials for users and organizations is identity and access
    management as a delivered capability. BC-4270.40 (developer credentials) was considered but these
    are end-user/tenant API keys rather than a developer-ecosystem programme, so IAM is the safer fit.
- tag: MCP OAuth 2.1
  spec_file: propelauth-mcp-oauth-2-1-api-openapi.yml
  capability_id: BC-620.20
  capability_id_l1: BC-620
  capability_name: Identity & Access Management
  confidence: 0.8
  evidence: GET /oauth/2.1/authorize  mcpAuthorize; POST /oauth/2.1/token  mcpToken; POST /oauth/2.1/introspect  mcpIntrospect
  reason: Authorization, token issuance and token introspection endpoints of an OAuth 2.1 authorization
    server — core authentication/authorisation, i.e. IAM and federation.
- tag: Members
  spec_file: propelauth-members-api-openapi.yml
  capability_id: BC-620.20
  capability_id_l1: BC-620
  capability_name: Identity & Access Management
  confidence: 0.8
  evidence: POST /api/backend/v1/org/add_user  addUserToOrg; POST /api/backend/v1/org/change_role  changeRole;
    POST /api/backend/v1/org/remove_user  removeUserFromOrg
  reason: Adding/removing users from organizations and changing their roles is access administration (joiners-movers-leavers,
    RBAC) — Identity & Access Management.
- tag: Sessions
  spec_file: propelauth-sessions-api-openapi.yml
  capability_id: BC-620.20
  capability_id_l1: BC-620
  capability_name: Identity & Access Management
  confidence: 0.78
  evidence: POST /api/backend/v1/user/{userId}/logout_all_sessions  logoutAllUserSessions  Logout All
    User Sessions
  reason: Single operation terminates a user's authenticated sessions in an authentication/user-management
    platform — session and access control, i.e. Identity & Access Management. Thin surface (one op) so
    confidence moderated.
- tag: Invites
  spec_file: propelauth-invites-api-openapi.yml
  capability_id: BC-620.20
  capability_id_l1: BC-620
  capability_name: Identity & Access Management
  confidence: 0.75
  evidence: POST /api/backend/v1/invite_user  inviteUserToOrg; DELETE /api/backend/v1/pending_org_invites  revokePendingOrgInvite
  reason: Invitation, listing and revocation of pending org membership invites is joiner/leaver account
    lifecycle within an identity platform — Identity & Access Management.
- tag: Magic Links
  spec_file: propelauth-magic-links-api-openapi.yml
  capability_id: BC-620.20
  capability_id_l1: BC-620
  capability_name: Identity & Access Management
  confidence: 0.7
  evidence: 'POST /api/backend/v1/magic_link  createMagicLink  Create Magic Link; schemas: MagicLink,
    MagicLinkRequest'
  reason: Creates passwordless authentication links for users — an authentication mechanism, mapped to
    Identity & Access Management.
- tag: Organizations
  spec_file: propelauth-organizations-api-openapi.yml
  capability_id: BC-4230.10
  capability_id_l1: BC-4230
  capability_name: Tenant Provisioning & Lifecycle
  confidence: 0.7
  evidence: '''Backend REST API for managing tenants (organizations) in PropelAuth''; POST /api/backend/v1/org/  createOrg;
    DELETE /api/backend/v1/org/{orgId}  deleteOrg'
  reason: Create/update/delete/query of organizations which the vendor explicitly equates with tenants
    — tenant provisioning and lifecycle in a multi-tenant SaaS. Some overlap with IAM directory management,
    hence 0.7.
- tag: Role Mappings
  spec_file: propelauth-role-mappings-api-openapi.yml
  capability_id: BC-620.20
  capability_id_l1: BC-620
  capability_name: Identity & Access Management
  confidence: 0.7
  evidence: GET /api/backend/v1/custom_role_mappings  fetchRoleMappings; schema RoleMapping
  reason: Retrieval of custom role mappings used to grant permissions to organization members — role-based
    access administration under Identity & Access Management.