openapi: 3.0.1
info:
  title: SlashID Groups Identity Management API
  description: "This is the [OpenAPI](https://www.openapis.org/) specification for communicating with the [SlashID](https://www.slashid.dev/) service.\n\nThe latest version of the OpenAPI API spec can be fetched from [our CDN](https://cdn.slashid.com/slashid-openapi-latest.yaml).\n\nWe recommend you use an [OpenAPI SDK generator](https://openapi.tools/#sdk) to create a client library in your programming language,\nbut you can also use this documentation to make HTTP calls directly.\n\n> **Compatibility note**: We aim to keep wire compatibility whenever we update the API, but parts of the specification may occasionally be refactored.\n  If you use an SDK generator, your code may require minor changes between versions.\n"
  version: '1.1'
  termsOfService: https://www.slashid.dev/terms-of-use/
  contact:
    name: API Support
    email: contact@slashid.dev
servers:
- url: https://api.slashid.com
  description: Production
- url: https://api.sandbox.slashid.com
  description: Sandbox
security:
- ApiKeyAuth: []
tags:
- name: Identity Management
paths:
  /token/validate:
    parameters:
    - $ref: '#/components/parameters/OptionalSdkVersionHeader'
    post:
      operationId: PostTokenValidate
      tags:
      - Identity Management
      summary: Validate a user token
      description: 'This endpoint validates a SlashID user token.

        The response indicates whether the token is valid and its expiration time if so. If the token is not valid, the reason is returned.

        '
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ValidateTokenReq'
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/ValidateTokenResponse'
  /token/revoke:
    parameters:
    - $ref: '#/components/parameters/OptionalSdkVersionHeader'
    post:
      operationId: PostTokenRevoke
      tags:
      - Identity Management
      summary: Revoke a user token
      description: 'This endpoint revokes a SlashID user token.

        '
      parameters:
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RevokeTokenReq'
        required: true
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '408':
          $ref: '#/components/responses/Timeout'
  /organizations/sso/saml/provider-credentials:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    get:
      operationId: GetOrganizationsSamlProviderCredentials
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member,saml-admin
      x-manager-rbac-allowed-groups: admin,member
      tags:
      - Identity Management
      summary: List SAML credentials for SSO
      description: 'Returns a list of existing SAML provider credentials for SSO for your organization.

        '
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      type: array
                      items:
                        $ref: '#/components/schemas/SAMLProviderCredentialsGetResponse'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
    post:
      operationId: PostOrganizationsSamlProviderCredentials
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,saml-admin
      x-manager-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Create a new set of SAML provider credentials for SSO
      description: 'Create a new set of SAML provider credentials for your organization to use with SSO.

        '
      parameters:
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SAMLProviderCredentialsPostRequest'
      responses:
        '201':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/SAMLProviderCredentialsPostResponse'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
  /organizations/sso/saml/provider-credentials/{saml_provider_credentials_id}:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    - $ref: '#/components/parameters/SAMLProviderCredentialsIDPathParam'
    get:
      operationId: GetOrganizationsSsoSamlProviderCredentialsSamlProviderCredentialsId
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member,saml-admin
      x-manager-rbac-allowed-groups: admin,member
      tags:
      - Identity Management
      summary: Get an existing set of SAML provider credentials for SSO
      description: 'Returns an existing set of SAML provider for SSO, specified by the provider credential ID.

        '
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/SAMLProviderCredentialsGetResponse'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
    delete:
      operationId: DeleteOrganizationsSsoSamlProviderCredentialsSamlProviderCredentialsId
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,saml-admin
      x-manager-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Delete an existing set of SAML provider credentials for SSO
      description: 'Deletes an existing set of SAML provider credentials for SSO, specified by the provider credential ID.

        '
      parameters:
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
    patch:
      operationId: PatchOrganizationsSsoSamlProviderCredentialsSamlProviderCredentialsId
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,saml-admin
      x-manager-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Modify an existing set of SAML provider credentials for SSO
      description: Modifies an existing set of SAML provider credentials for SSO, specified by the provider credential ID.
      parameters:
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SAMLProviderCredentialsPatchRequest'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /sso/oidc/tokens/revoke:
    parameters:
    - $ref: '#/components/parameters/SdkVersionHeader'
    post:
      operationId: PostSsoOidcTokensRevoke
      deprecated: true
      tags:
      - Identity Management
      summary: (Deprecated) Revoke an OAuth token obtained through SSO with OIDC
      description: 'Revoke a previously obtained OAuth access or refresh token for an IdP.

        This endpoint is deprecated. Please use /sso/oidc/tokens/revoke/v2 instead.

        '
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OAuthTokenRevokeReq'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
  /sso/oidc/tokens/revoke/v2:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostSsoOidcTokensRevokeV2
      x-rbac-enabled: true
      tags:
      - Identity Management
      summary: Revoke an OAuth token obtained through SSO with OIDC
      description: Revoke a previously obtained OAuth access or refresh token for an IdP
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SsoOidcTokensRevokeV2Req'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /sso/oidc/tokens:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    - $ref: '#/components/parameters/RequiredTokenHeader'
    get:
      operationId: GetSsoOidcTokens
      x-rbac-enabled: true
      tags:
      - Identity Management
      summary: Retrieve OIDC tokens
      description: 'Retrieve tokens issued by an OIDC provider as part of an SSO authentication.

        This endpoint expects a valid SlashID token container issued after an SSO authentication.

        The response will include all of the OIDC tokens that were issued by that SSO authentication.

        '
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/SsoOidcTokensGetResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
  /sso/oidc/tokens/query:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostSsoOidcTokensQuery
      tags:
      - Identity Management
      summary: Query tokens obtained through SSO with OIDC
      description: Query the OIDC tokens for a person issued during SSO authentications.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SsoOidcTokensQueryReq'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/SsoOidcTokensQueryResp'
        '400':
          $ref: '#/components/responses/BadRequest'
  /persons/{person_id}/direct-id:
    parameters:
    - $ref: '#/components/parameters/PersonIDPathParam'
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostPersonsPersonIdDirectId
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Get Direct-ID value for a person
      description: 'This endpoint creates a one-time Direct-ID for a specific user. The returned Direct-ID string can embedded in a URL in the `challenges` query parameter to let your users land on a target page already authenticated.

        '
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PersonDirectIDReq'
        required: true
      responses:
        '201':
          description: The result string is a Direct-ID you can include in your links in the `challenges` query parameter.
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/DirectID'
                  required:
                  - result
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
  /persons/{person_id}/mint-token:
    parameters:
    - $ref: '#/components/parameters/PersonIDPathParam'
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostPersonsPersonIdMintToken
      tags:
      - Identity Management
      summary: Mint a token for a person
      description: "This endpoint creates a token for a specific user.\n\n\nCustom claims can be specified in the request body which will be added to the token's payload.\nCustom claims are added to the token's payload.\n\nTokens created with this endpoint will have an `authenticated_methods` claim equal to [\"api\"].\n\n\nThe following claims are reserved and cannot be specified:\n  - aud\n  - exp\n  - jti\n  - iat\n  - iss\n  - nbf\n  - sub\n  - prev_token_id\n  - oid\n  - org_id\n  - user_id\n  - person_id\n  - first_token\n  - authenticated_methods\n  - oidc_tokens\n  - user_token\n  - groups\n  - roles\n  - access_token\n  - refresh_token\n  - id\n  - id_token\n  - gdpr\n  - gdpr_consent\n  - gdpr_consent_level\n  - parent_user_id\n  - parent_person_id\n  - parent_org_id\n  - parent_oid\n  - attributes\n  - custom_claims\n  - slashid\n  - slashid.dev\n  - slashid.com\n  - slashid.me\n  - sid\n\n\nWith the following request body:\n\n\n```\n{\n    \"custom_claims\": {\n        \"foo\": \"bar\",\n        \"baz\": {\"everything\": 42}\n    }\n}\n```\n\n\nthe token in the response will have the following payload:\n\n```\n{\n  \"authenticated_methods\": [\n    \"api\"\n  ],\n  \"baz\": {\n    \"everything\": 42\n  },\n  \"exp\": <expiration time timestamp>,\n  \"first_token\": false,\n  \"foo\": \"bar\",\n  \"iat\": <issued at timestamp>,\n  \"iss\": <token issuer>,\n  \"jti\": <token ID>,\n  \"oid\": <organisation ID>,\n  \"person_id\": <person ID>\n}\n```\n"
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostMintTokenRequest'
        required: true
      responses:
        '201':
          description: The result string is a newly-minted SlashID token.
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/UserTokenText'
                  required:
                  - result
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
  /persons/{person_id}/credentials:
    parameters:
    - $ref: '#/components/parameters/PersonIDPathParam'
    - $ref: '#/components/parameters/OrgIDHeader'
    get:
      operationId: GetPersonsPersonIdCredentials
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      tags:
      - Identity Management
      summary: Retrieve a person's credentials
      description: 'Retrieves credentials linked to the specified person in your organization.

        '
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      type: array
                      items:
                        $ref: '#/components/schemas/ExportedCredential'
                  required:
                  - result
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
    post:
      operationId: PostPersonsPersonIdCredentials
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Create a new credential
      description: 'Creates a new credential linked to the specified person in your organization. This credential will then be available for use in future authentication challenges.

        '
      requestBody:
        description: The credential creation request
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Credential'
        required: true
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/ExportedCredential'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
    delete:
      operationId: DeletePersonsPersonIdCredentials
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Delete all credentials
      description: 'Deletes all credentials from a person. Note that deletion is irreversible and the credentials will no longer be usable for authentication.

        '
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /persons/{person_id}/credentials/{credential_id}:
    parameters:
    - $ref: '#/components/parameters/PersonIDPathParam'
    - $ref: '#/components/parameters/CredentialIDPathParam'
    - $ref: '#/components/parameters/OrgIDHeader'
    delete:
      operationId: DeletePersonsPersonIdCredentialsCredentialId
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Delete a credential object
      description: 'Deletes the specified credential from a person,organization pair. Note that deletion is irreversible and the credential will no longer be usable for authentication.

        '
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /persons/{person_id}/credentials/password:
    parameters:
    - $ref: '#/components/parameters/PersonIDPathParam'
    - $ref: '#/components/parameters/OrgIDHeader'
    put:
      operationId: PutPersonsPersonIdCredentialsPassword
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Create or overwrite a password credential.
      description: 'Creates or overwrites the password credential linked to the specified person in your organization. This credential will then be available for use in future authentication challenges.

        '
      requestBody:
        description: The password credential creation/overwrite request
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PasswordCredential'
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
        '201':
          description: Created
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /persons/{person_id}/credentials/password-reset:
    parameters:
    - $ref: '#/components/parameters/PersonIDPathParam'
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostPersonsPersonIdCredentialsPasswordReset
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Trigger a password reset flow
      description: 'Triggers a password reset flow for the specified person and credential. The specified person must then take action to complete the flow and set a new password. Optionally, you can specify which of the person''s handles will be used to send the password reset link.

        '
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PasswordResetPostReq'
      responses:
        '202':
          $ref: '#/components/responses/Accepted'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /persons/{person_id}/credentials/password-rotate:
    parameters:
    - $ref: '#/components/parameters/PersonIDPathParam'
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostPersonsPersonIdCredentialsPasswordRotate
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Rotate a person's password
      description: 'Rotates a person''s password. The specified person does not need to have an existing password credential. A new password credential will be created regardless and returned in the response.

        '
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/PasswordRotatePostResp'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /persons/{person_id}/attributes:
    patch:
      operationId: PatchPersonsPersonIdAttributes
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      summary: Create or modify attributes for a person in multiple buckets
      description: 'Create new attributes or modify existing attributes for a person in one or more attribute buckets.

        The request body should be a nested object, with bucket names as top-level keys, and key-value pair attributes as values, as shown in the example request body. The buckets must exist and must be accessible by the organization identified in the request header. Attribute names may be at most 70 bytes long. Attribute values must be JSON-serializable and are limited to 64KiB. Any existing attribute that isn''t referenced by key in the request is left untouched.

        '
      tags:
      - Identity Management
      parameters:
      - $ref: '#/components/parameters/PersonIDPathParam'
      - $ref: '#/components/parameters/OrgIDHeader'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PatchBucketedAttributesReq'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
    put:
      operationId: PutPersonsPersonIdAttributes
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      summary: Create or modify attributes for a person in multiple buckets
      description: 'Create new attributes or modify existing attributes for a person in one or more attribute buckets.

        The request body should be a nested object, with bucket names as top-level keys, and key-value pair attributes as values, as shown in the example request body. The buckets must exist and must be accessible by the organization identified in the request header. Attribute names may be at most 70 bytes long. Attribute values must be JSON-serializable and are limited to 64KiB. Replaces the set of existing attributes with those present in the request. In other words, it deletes any existing attributes that aren''t referenced by key in the request.

        '
      tags:
      - Identity Management
      parameters:
      - $ref: '#/components/parameters/PersonIDPathParam'
      - $ref: '#/components/parameters/OrgIDHeader'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PutBucketedAttributesReq'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
    get:
      operationId: GetPersonsPersonIdAttributes
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      summary: Retrieve attributes for a person from multiple buckets
      description: 'Retrieve attributes for a person from one or more buckets. If no buckets are specified, attributes from all buckets will be retrieved.

        Bucket names can be specified as a comma-separated list in the `buckets` query parameter. All buckets specified must exist, and the organization specified in the header must be able to access them. Empty bucket names are not permitted.

        '
      tags:
      - Identity Management
      parameters:
      - $ref: '#/components/parameters/PersonIDPathParam'
      - $ref: '#/components/parameters/OrgIDHeader'
      - $ref: '#/components/parameters/AttributeBucketsQueryParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/GetBucketedAttributesResp'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
  /persons/{person_id}/attributes/{bucket_name}:
    patch:
      operationId: PatchPersonsPersonIdAttributesBucketName
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      summary: Create or modify attributes for a person in a single bucket
      description: 'Create new attributes or modify existing attributes for a person in a single attribute bucket.

        The bucket must exist and must be accessible by the organization identified in the request header.

        The request body should be an object consisting of key-value pair attributes. Attribute names may be at most 70 bytes long. Attribute values must be JSON-serializable and are limited to 64KiB. Any existing attribute that isn''t referenced by key in the request is left untouched.

        '
      tags:
      - Identity Management
      parameters:
      - $ref: '#/components/parameters/PersonIDPathParam'
      - $ref: '#/components/parameters/OrgIDHeader'
      - $ref: '#/components/parameters/AttributeBucketNamePathParam'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PatchAttributesReq'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
    put:
      operationId: PutPersonsPersonIdAttributesBucketName
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      summary: Create or modify attributes for a person in a single bucket
      description: 'Create new attributes or modify existing attributes for a person in a single attribute bucket.

        The bucket must exist and must be accessible by the organization identified in the request header.

        The request body should be an object consisting of key-value pair attributes. Attribute names may be at most 70 bytes long. Attribute values must be JSON-serializable and are limited to 64KiB. Replaces the set of existing attributes with those present in the request. In other words, it deletes any existing attributes that aren''t referenced by key in the request.

        '
      tags:
      - Identity Management
      parameters:
      - $ref: '#/components/parameters/PersonIDPathParam'
      - $ref: '#/components/parameters/OrgIDHeader'
      - $ref: '#/components/parameters/AttributeBucketNamePathParam'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PutAttributesReq'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
    get:
      operationId: GetPersonsPersonIdAttributesBucketName
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      summary: Retrieve attributes for a person from a single bucket
      description: 'Retrieve attributes for a person from a single attribute bucket.

        The bucket must exist and must be accessible by the organization identified in the request header. If no attribute names are specified, all attributes in the bucket will be retrieved. Attribute names can be provided as a comma-separated list in the `attributes` query parameter. Empty attribute names are not permitted.

        '
      tags:
      - Identity Management
      parameters:
      - $ref: '#/components/parameters/PersonIDPathParam'
      - $ref: '#/components/parameters/OrgIDHeader'
      - $ref: '#/components/parameters/AttributeBucketNamePathParam'
        required: true
      - $ref: '#/components/parameters/AttributeNamesQueryParam'
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/GetAttributesResp'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
    delete:
      operationId: DeletePersonsPersonIdAttributesBucketName
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      summary: Delete attributes for a person from a single bucket
      description: 'Delete attributes for a person from a single attribute bucket.

        The bucket must exist and must be accessible by the organization identified in the request header. Attribute names can be provided as a comma-separated list in the `attributes` query parameter. Empty attribute names are not permitted. If no attribute names are specified, all attributes in the bucket will be deleted.

        WARNING: this action is permanent and cannot be undone.

        '
      tags:
      - Identity Management
      parameters:
      - $ref: '#/components/parameters/PersonIDPathParam'
      - $ref: '#/components/parameters/OrgIDHeader'
      - $ref: '#/components/parameters/AttributeBucketNamePathParam'
      - $ref: '#/components/parameters/AttributeNamesQueryParam'
        required: true
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
  /persons/{person_id}/consent/gdpr:
    parameters:
    - $ref: '#/components/parameters/PersonIDPathParam'
    - $ref: '#/components/parameters/OrgIDHeader'
    get:
      operationId: GetPersonsPersonIdConsentGdpr
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      tags:
      - Identity Management
      summary: Get GDPR consent
      description: 'Takes an organization ID and a person ID and returns the GDPR consent levels and timestamp for that person, if it exists.

        '
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/GDPRConsentResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
    post:
      operationId: PostPersonsPersonIdConsentGdpr
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Store GDPR consent
      description: 'Takes the organization ID, the person ID, and GDPR consent levels, and stores the GDPR consent levels and timestamp. Returns the consent levels and the timestamp at which the consent information was received. This will overwrite existing GDPR consent levels for the specified person.

        The consent levels indicate the types of data classes the person has allowed during their use of your services, in accordance with GDPR.

        '
      requestBody:
        description: The GDPR consent level for the person
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GDPRConsentRequest'
        required: true
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/GDPRConsentResponse'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
    put:
      operationId: PutPersonsPersonIdConsentGdpr
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Set GDPR consent
      description: 'Takes the organization ID, the person ID, and GDPR consent levels, and stores the GDPR consent levels and timestamp. Returns the consent levels and the timestamp at which the consent information was received. This will overwrite existing GDPR consent levels for the specified person.

        The consent levels indicate the types of data classes the person has allowed during their use of your services, in accordance with GDPR.

        '
      requestBody:
        description: The GDPR consent level for the person
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GDPRConsentRequest'
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/GDPRConsentResponse'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
    delete:
      operationId: DeletePersonsPersonIdConsentGdpr
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Remove GDPR consent
      description: The function takes the organization ID and person ID and removes the specified GDPR consent, or all consents.
      parameters:
      - name: consent_levels
        in: query
        description: The names of the consent levels to remove from the person
        required: false
        schema:
          type: array
          items:
            $ref: '#/components/schemas/GDPRConsentLevel'
      - name: deleteAll
        in: query
        description: Whether to delete all GDPR consents for this person
        required: false
        schema:
          type: boolean
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /consent/gdpr:
    parameters:
    - $ref: '#/components/parameters/SdkVersionHeader'
    get:
      operationId: GetConsentGdpr
      x-rbac-enabled: false
      tags:
      - Identity Management
      summary: Get GDPR consent of current user
      description: 'Returns the GDPR consent levels and timestamp for current person, if it exists.

        '
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/GDPRConsentResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
    post:
      operationId: PostConsentGdpr
      x-rbac-enabled: false
      tags:
      - Identity Management
      summary: Store GDPR consent of current user
      description: 'Stores the GDPR consent levels and timestamp. Returns the consent levels and the timestamp at which the consent information was received. This will overwrite existing GDPR consent levels for the specified person.

        The consent levels indicate the types of data classes the person has allowed during their use of your services, in accordance with GDPR.

        '
      requestBody:
        description: The GDPR consent level
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GDPRConsentRequest'
        required: true
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/GDPRConsentResponse'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
    put:
      operationId: PutConsentGdpr
      x-rbac-enabled: false
      tags:
      - Identity Management
      summary: Set GDPR consent of current user
      description: 'Stores the GDPR consent levels and timestamp. Returns the consent levels and the timestamp at which the consent information was received. This will overwrite existing GDPR consent levels for the specified person.

        The consent levels indicate the types of data classes the person has allowed during their use of your services, in accordance with GDPR.

        '
      requestBody:
        description: The GDPR consent level for the person
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GDPRConsentRequest'
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/GDPRConsentResponse'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
    delete:
      operationId: DeleteConsentGdpr
      x-rbac-enabled: false
      tags:
      - Identity Management
      summary: Remove GDPR consent of current user
      description: Removes the specified GDPR consent, or all consents.
      parameters:
      - name: consent_levels
        in: query
        description: The names of the consent levels to remove from the person
        required: false
        schema:
          type: array
          items:
            $ref: '#/components/schemas/GDPRConsentLevel'
      - name: deleteAll
        in: query
        description: Whether to delete all GDPR consents for this person
        required: false
        schema:
          type: boolean
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
  /persons/{person_id}:
    parameters:
    - $ref: '#/components/parameters/PersonIDPathParam'
    - $ref: '#/components/parameters/OrgIDHeader'
    get:
      operationId: GetPersonsPersonId
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member,impersonator
      x-manager-rbac-allowed-groups: admin,member,impersonator
      tags:
      - Identity Management
      summary: Retrieve a person
      description: 'Get a person object by its ID. The function returns the decrypted, abridged person record.


        Please use the Attributes API to retrieve custom person attributes.'
      parameters:
      - $ref: '#/components/parameters/PersonFieldsQueryParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/PersonRet'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
    delete:
      operationId: DeletePersonsPersonId
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      x-manager-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Delete a person from an organization
      description: 'Remove the person, specified by its ID, from the organization.


        Note that access to all the attributes associated with this person will be permanently revoked.'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
    patch:
      operationId: PatchPersonsPersonId
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Modify an existing person
      description: 'Modify configuration for an existing specific person associated with your organization. This includes the list of roles for the person and whether the person is active or not.

        '
      requestBody:
        description: The person patch request
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PersonPatchReq'
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/PersonRet'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /persons/{person_id}/handles:
    parameters:
    - $ref: '#/components/parameters/PersonIDPathParam'
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostPersonsPersonIdHandles
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Add handles to a person
      description: Add one or more handles to an existing person linked to your organization.
      requestBody:
        description: The person handles POST request
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PersonHandlesReq'
            examples:
              personHandlesExample:
                $ref: '#/components/examples/personHandlesExample'
        required: true
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
    get:
      operationId: GetPersonsPersonIdHandles
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member,impersonator
      tags:
      - Identity Management
      summary: Get handles for a person
      description: Retrieve the list of handles associated with an existing person
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/PersonHandlesResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /persons/{person_id}/handles/{handle}:
    parameters:
    - $ref: '#/components/parameters/PersonIDPathParam'
    - $ref: '#/components/parameters/OrgIDHeader'
    - $ref: '#/components/parameters/HandlePathParam'
    delete:
      operationId: DeletePersonsPersonIdHandlesHandle
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Delete a handle from a person
      description: Remove a handle associated with an existing person
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /persons/{person_id}/groups:
    parameters:
    - $ref: '#/components/parameters/PersonIDPathParam'
    - $ref: '#/components/parameters/OrgIDHeader'
    get:
      operationId: GetPersonsPersonIdGroups
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member,impersonator,saml-admin,uar-certifier,uar-campaign-manager,cs-id-verifier
      x-manager-rbac-allowed-groups: admin,member,impersonator,saml-admin,uar-certifier,uar-campaign-manager,cs-id-verifier
      tags:
      - Identity Management
      summary: Get groups for a person
      description: Retrieve the list of groups the specified person belongs to
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/PersonGroupsResponse'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
    put:
      operationId: PutPersonsPersonIdGroups
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      x-manager-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Set the groups for a person
      description: 'Add the person to the groups specified in the request body, and remove the person from any other existing groups.

        All groups in the request body must already exist. Duplicate groups in the request body will be ignored. If an empty list is supplied in the request body, the person will be removed from all groups they are currently a member of, and will not be added to any others.

        New groups can be created with the [POST /groups](/docs/api/post-groups) endpoint.

        '
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PutPersonGroupsReq'
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/PersonGroupsResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /persons/{person_id}/permissions:
    parameters:
    - $ref: '#/components/parameters/PersonIDPathParam'
    - $ref: '#/components/parameters/OrgIDHeader'
    get:
      operationId: GetPersonsPersonIdPermissions
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      tags:
      - Identity Management
      summary: Get permissions for a person
      description: Retrieve the list of permissions granted to the specified person. It contains both assigned permissions and permissions from roles.
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/PersonPermissionsResponse'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /persons/{person_id}/additional-permissions:
    parameters:
    - $ref: '#/components/parameters/PersonIDPathParam'
    - $ref: '#/components/parameters/OrgIDHeader'
    get:
      operationId: GetPersonsPersonIdAdditionalPermissions
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      tags:
      - Identity Management
      summary: Get additional permissions for a person
      description: Retrieve the list of additional permissions assigned to person. This endpoint doesn't return permissions from roles.
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/PersonPermissionsResponse'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
    put:
      operationId: PutPersonsPersonIdPermissions
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Set the permissions for a person
      description: 'Grant the person the permissions specified in the request body, and revoke the person any other existing permissions.

        All permissions in the request body must already exist. Duplicate permissions in the request body will be ignored. If an empty list is supplied in the request body, the person will be revoked all permissions they currently have.

        '
      parameters:
      - $ref: '#/components/parameters/IfMatchHeader'
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PutPersonPermissionsRequest'
        required: true
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
        '412':
          $ref: '#/components/responses/PreconditionFailed'
  /persons/{person_id}/roles:
    parameters:
    - $ref: '#/components/parameters/PersonIDPathParam'
    - $ref: '#/components/parameters/OrgIDHeader'
    get:
      operationId: GetPersonsPersonIdRoles
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      x-manager-rbac-allowed-groups: admin,member
      tags:
      - Identity Management
      summary: Get roles for a person
      description: Retrieve the list of roles granted to the specified person
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/PersonRolesResponse'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
    put:
      operationId: PutPersonsPersonIdRoles
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      x-manager-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Set the roles for a person
      description: 'Grant the person the roles specified in the request body, and revoke the person any other existing roles.

        All roles in the request body must already exist. Duplicate roles in the request body will be ignored. If an empty list is supplied in the request body, the person will be revoked all roles they currently have.

        '
      parameters:
      - $ref: '#/components/parameters/IfMatchHeader'
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PutPersonRolesRequest'
        required: true
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
        '412':
          $ref: '#/components/responses/PreconditionFailed'
  /persons/{person_id}/organizations:
    parameters:
    - $ref: '#/components/parameters/PersonIDPathParam'
    - $ref: '#/components/parameters/OrgIDHeader'
    get:
      operationId: GetPersonsPersonIdOrganizations
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      tags:
      - Identity Management
      summary: Retrieve the list of person's organizations
      description: "Retrieve details of all the organizations a person belongs to, including:\n - The organization of the request: the person must be a member of the organization you authenticate\n   with for you to be allowed to retrieve this list\n - Any sub- and super-organizations that share the person pool with the organization of the request:\n   A hierarchy of organizations can be created using [this API endpoint](/docs/api/post-organizations-suborganizations).\n   When organizations are configured to share a person pool, if the same person registers with multiple organizations\n   in the pool using the same handle, all organizations will see the same person ID for that person.\n"
      parameters:
      - $ref: '#/components/parameters/GetPersonsPersonIdOrganizationsFilterQueryParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/GetPersonOrganizationsResponse'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
  /persons:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostPersons
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      x-manager-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Create new person
      description: 'Create a new person linked to your organization.

        The request must contain at least one handle for the person (email address, phone number, or username). Optionally, you can specify a list of roles, a geographical region and attributes. Attributes are a map from attribute bucket names to key-value pairs.

        If a person with the specified handles already exists, an error will be returned.

        If the region is not specified, the person will be created in the region closest to the region of your backend.

        If you explicitly specify the region and a person with the provided handle already exists in a different region, this endpoint will return an error.

        A person''s region association is eventually consistent between regions. Because of that, creating a person between regions within the time frame of data replication can result in a person being created in multiple regions. You can learn more on the [Cross-region replication model](/docs/access/concepts/replication) page.

        '
      requestBody:
        description: The person creation request
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PersonCreateReq'
        required: true
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/PersonsPostResponse'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
        '402':
          $ref: '#/components/responses/PaymentRequired'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
    put:
      operationId: PutPersons
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Create or update a person (idempotent)
      description: 'This endpoint works as the [`POST /persons`](/docs/api/post-persons) endpoint, except that it is idempotent. If the person already exists, it will be updated with the new data and 200 status code will be returned.

        '
      requestBody:
        description: The person creation request
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PersonCreateReq'
        required: true
      responses:
        '200':
          description: OK - person already exists and was updated
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/PersonsPutResponse'
                  required:
                  - result
        '201':
          description: Created - person was created
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/PersonsPutResponse'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
        '402':
          $ref: '#/components/responses/PaymentRequired'
        '404':
          $ref: '#/components/responses/NotFound'
    get:
      operationId: GetPersons
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member,impersonator
      x-manager-rbac-allowed-groups: admin,member,impersonator
      tags:
      - Identity Management
      summary: Retrieve a list of persons
      description: Retrieve the full list of persons in your organization.
      parameters:
      - $ref: '#/components/parameters/HandleQueryParam'
      - $ref: '#/components/parameters/PersonsFilterQueryParam'
      - $ref: '#/components/parameters/LimitQueryParam'
      - $ref: '#/components/parameters/OffsetQueryParam'
      - $ref: '#/components/parameters/PersonIDsQueryParam'
      - $ref: '#/components/parameters/PersonFieldsQueryParam'
      - in: query
        name: all_regions
        schema:
          type: boolean
          default: true
        description: If true, users from all regions will be returned. Defaults to true.
      - in: query
        name: all_person_types
        schema:
          type: boolean
          default: false
        description: If true, also returns non-regular users. Defaults to false.
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      type: array
                      items:
                        $ref: '#/components/schemas/PersonRet'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /persons/bulk-import:
    get:
      operationId: GetPersonsBulkImport
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      tags:
      - Identity Management
      summary: Fetch the import CSV template
      parameters:
      - $ref: '#/components/parameters/OrgIDHeader'
      responses:
        '200':
          description: OK
          content:
            text/csv:
              schema:
                type: string
          headers:
            Content-Disposition:
              schema:
                type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
    post:
      operationId: PostPersonsBulkImport
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Bulk import persons
      description: 'Bulk import persons into your organization by uploading a CSV file.


        The import will take the following CSV column headers into consideration:


        "slashid:emails","slashid:phone_numbers","slashid:usernames","slashid:region","slashid:groups","slashid:attributes"


        Each row in the CSV must contain at least one handle for the person

        (email address, phone number, or a username). Optionally, you can

        specify a list of roles, a geographical region and attributes.

        Attributes are a JSON-encoded map from attribute bucket names to

        key-value pairs. Email addresses, phone numbers, and usernames must be

        comma-separated.'
      parameters:
      - $ref: '#/components/parameters/OrgIDHeader'
      requestBody:
        content:
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/PersonsBulkImportRequest'
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/PersonsBulkImportResponse'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
        '402':
          $ref: '#/components/responses/PaymentRequired'
  /groups:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostGroups
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Create a group
      description: "This endpoint creates a new persons group with the given name.\n\nIf the group exists already, no action will be taken.\n\nThe group name must be unique within your organization; is case-sensitive; and must conform to the following:\n  - must be at least 2 characters long\n  - may be at most 100 characters long\n  - may contain only the characters `A-Z a-z 0-9 - _ .`\n  - must start and end with an alphanumeric character (`A-Z a-z 0-9`)\n\nA person can be added to a group through the [`POST /persons/:person_id/groups`](/docs/api/put-persons-person-id-groups) endpoint.\n"
      parameters:
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostGroupReq'
        required: true
      responses:
        '201':
          description: The group was successfully created
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
        '400':
          $ref: '#/components/responses/BadRequest'
        '402':
          $ref: '#/components/responses/PaymentRequired'
    get:
      operationId: GetGroups
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      tags:
      - Identity Management
      summary: Get a list of groups
      description: List the names of all groups that exist for your organization
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/ListGroupsResponse'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /groups/{group_name}:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    - $ref: '#/components/parameters/GroupNamePathParam'
    get:
      operationId: GetGroupsGroupName
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      tags:
      - Identity Management
      summary: Get a group
      description: Get the named group
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/GetGroupResponse'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
    delete:
      operationId: DeleteGroupsGroupName
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Delete a group
      description: Remove all persons from a group and permanently delete the group.
      parameters:
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIResponseBase'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /groups/{group_name}/persons:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    - $ref: '#/components/parameters/GroupNamePathParam'
    post:
      operationId: PostGroupsGroupNamePersons
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Add persons to a group
      description: 'This endpoint adds one or more persons to an existing group. The group and all of the persons must exist. The persons to be added to the group must always be an array in the request body, even if only one user is being added. All persons needs to be in the same region.

        A new group can be created with the [POST /groups](/docs/api/post-groups) endpoint.

        '
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostGroupPersonsReq'
        required: true
      responses:
        '201':
          description: The persons were successfully added to the group
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
    get:
      operationId: GetGroupsGroupNamePersons
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      tags:
      - Identity Management
      summary: List the persons in a group
      description: Lists all the persons in the named group. Returns an array of person IDs.
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      type: array
                      items:
                        type: string
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /groups/{group_name}/persons/{person_id}:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    - $ref: '#/components/parameters/GroupNamePathParam'
    - $ref: '#/components/parameters/PersonIDPathParam'
    delete:
      operationId: DeleteGroupsGroupNamePersonsPersonId
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Delete a person from a group
      description: 'Removes the identified person from the named group. Returns an error if the person is not in the group.

        '
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIResponseBase'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /rbac/permissions:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostRBACPermissions
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Create a permission
      description: 'This endpoint creates a new permission with the given name.


        If the permission exists already, no action will be taken.

        A person can be assigned a permission through the [`POST /persons/:person_id/permissions`](/docs/api/put-persons-person-id-permissions) endpoint.

        Sub-organization can create permissions only when [`inherit_rbac_pools` is disabled](/docs/api/post-organizations-suborganizations). If `inherit_rbac_pools` is enabled, the permissions from the root organization will be inherited.

        '
      parameters:
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostPermissionRequest'
        required: true
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '402':
          $ref: '#/components/responses/PaymentRequired'
        '409':
          $ref: '#/components/responses/Conflict'
    get:
      operationId: GetRBACPermissions
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      tags:
      - Identity Management
      summary: Get a list of permissions
      description: List the names of all permissions that exist for your organization
      responses:
        '200':
          description: OK
          headers:
            ETagHeader:
              $ref: '#/components/headers/ETagHeader'
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/ListPermissionsResponse'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
  /rbac/permissions/{permission_name}:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    - $ref: '#/components/parameters/PermissionsNamePathParam'
    get:
      operationId: GetRBACPermissionsPermissionName
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      tags:
      - Identity Management
      summary: Get a permission
      description: Get the named permission
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/GetPermissionResponse'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
    patch:
      operationId: PatchRBACPermissionsPermissionName
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Update a permission
      parameters:
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      - $ref: '#/components/parameters/IfMatchHeader'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PatchPermissionRequest'
        required: true
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
    delete:
      operationId: DeleteRBACPermissionsPermissionName
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Delete a permission
      description: 'Remove a permission and revoke it for all users. A permission cannot be deleted as long as it''s included in a role. Sub-organization can delete roles only when [`inherit_rbac_pools` is disabled](/docs/api/post-organizations-suborganizations).

        '
      parameters:
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /rbac/roles:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostRBACRoles
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Create a role
      description: 'This endpoint creates a new role with the given name.


        If the Role exists already, no action will be taken.

        '
      parameters:
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostRoleRequest'
        required: true
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '402':
          $ref: '#/components/responses/PaymentRequired'
        '409':
          $ref: '#/components/responses/Conflict'
    get:
      operationId: GetRBACRoles
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      tags:
      - Identity Management
      summary: Get a list of roles
      description: List the names of all roles that exist for your organization
      responses:
        '200':
          description: OK
          headers:
            ETagHeader:
              $ref: '#/components/headers/ETagHeader'
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/ListRolesResponse'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
  /rbac/roles/{role_name}:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    - $ref: '#/components/parameters/RolesNamePathParam'
    get:
      operationId: GetRBACRolesRoleName
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      tags:
      - Identity Management
      summary: Get a role
      description: Get the named role
      responses:
        '200':
          description: OK
          headers:
            ETagHeader:
              $ref: '#/components/headers/ETagHeader'
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/GetRoleResponse'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
    patch:
      operationId: PatchRBACRolesRoleName
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Update a role
      description: Update an existing role.
      parameters:
      - $ref: '#/components/parameters/IfMatchHeader'
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PatchRoleRequest'
        required: true
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '402':
          $ref: '#/components/responses/PaymentRequired'
        '412':
          $ref: '#/components/responses/PreconditionFailed'
    delete:
      operationId: DeleteRBACRolesRoleName
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Delete a role
      description: Remove a role and revoke it for all users.
      parameters:
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /rbac/check:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostRBACCheck
      tags:
      - Identity Management
      summary: Check whether a person has a permission
      description: Check whether the given person has the given permission. The service automatically takes into account permissions included in granted roles as well as permissions granted individually.
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostRBACCheckRequest'
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/PostRBACCheckResp'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /organizations/config/external-credentials:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    get:
      operationId: GetOrganizationsConfigExternalCredentials
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      tags:
      - Identity Management
      summary: List available external credentials
      description: 'Lists the all available external credentials for third party services. The call doesn''t return any key material, credential IDs can be used to retrieve the credential.

        '
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      type: array
                      items:
                        $ref: '#/components/schemas/ExternalCredential'
        '400':
          $ref: '#/components/responses/BadRequest'
    post:
      operationId: PostOrganizationsConfigExternalCredentials
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Create a new set of external credentials
      description: 'Create a new set of credentials for your organization to use with third party services. Includes a provider name and a content whose body is a key value pair of the data needed to authenticate with the third party service - currently only API Key, API ID/API Key, Client Credentials, Access Token and username/password combinations are supported.

        '
      parameters:
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ExternalCredentialPostRequest'
      responses:
        '201':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      type: array
                      items:
                        type: string
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
    delete:
      operationId: DeleteOrganizationsConfigExternalCredentials
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Remove an external credential by id
      description: 'Remove the specified external credential by id or delete all external credentials. If a credential id is specified, it takes precedence over the deleteAll parameter, so a request with a credentialId specified and deleteAll=true will delete only the specified credential from the list of external credentials. If the specified credential id does not exist in the list of allowed origin credentials, no action will be taken, and a 200 status code will be returned.

        '
      parameters:
      - name: credentialId
        in: query
        description: The id of the credential to delete
        required: true
        schema:
          type: string
      - name: deleteAll
        in: query
        description: Whether to delete all credentials
        required: false
        schema:
          type: boolean
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /organizations/config/external-credentials/{cred_id}:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    - in: path
      name: cred_id
      schema:
        type: string
      required: true
      description: ID of the credential to retrieve, modify or delete
    get:
      operationId: GetOrganizationsConfigExternalCredentialsCredId
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Get the specified credential
      description: 'Returns the credential specified by the ID. The returned object contains the name of the provider, the credential type and an object which contains the credential material necessary to access a third-party provider (API Key, API ID/API Key, Client Credentials, Access Token and username/password)

        '
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/ExternalCredential'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
    patch:
      operationId: PatchOrganizationsConfigExternalCredentialsCredId
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Modify the selected credential
      description: 'Set the content of the selected credential to be the request body. If the content or name for this

        credential had previously been created for your organization, it will be overwritten and cannot

        be retrieved. Otherwise, the new content will be set.'
      parameters:
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      requestBody:
        description: The new content of the selected credential
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PatchExternalCredentialRequest'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /organizations/config/templates:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    get:
      operationId: GetOrganizationsConfigTemplates
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      tags:
      - Identity Management
      summary: List available templates
      description: 'Lists the names of all available templates for communicating with users.


        Template names can be used to retrieve the template body for your organization.'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      type: array
                      items:
                        $ref: '#/components/schemas/TemplateName'
  /organizations/config/templates/{template_name}:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    - in: path
      name: template_name
      schema:
        $ref: '#/components/schemas/TemplateName'
      required: true
      description: Name of the template to retrieve or modify
    get:
      operationId: GetOrganizationsConfigTemplatesTemplateName
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      tags:
      - Identity Management
      summary: Get the named template
      description: 'Retrieves the message template named in the path.


        If a custom template was previously created, it will be returned.

        Otherwise the default template is returned


        Likewise, any template fields were left empty during creation will be set to their default values.'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/MessageTemplate'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
    put:
      operationId: PutOrganizationsConfigTemplatesTemplateName
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Modify the named template
      description: "Sets the named message template for your organization. If a template already exists it will be overwritten and cannot\nbe retrieved.\n\nThe following templates are available for customization:\n  - `email_authn_challenge`: E-mail template with magic link;\n  - `text_authn_challenge`: SMS template with magic link;\n  - `text_otp_message`: SMS template with OTP code;\n  - `email_password_reset_challenge`: E-mail template with a password reset link;\n  - `text_password_reset_challenge`: SMS template with a password reset link.\n\nAll templates must conform to the [mustache template syntax](https://mustache.github.io/mustache.5.html). The following tags are available:\n  - `{{attestation_url}}`: Magic link URL (at least one of `attestation_url` and `attestation_query_string` are required on `email_authn_challenge` and `text_authn_challenge`)\n  - `{{attestation_query_string}}`: Magic link URL query string (at least one of `attestation_query_string` and `attestation_url` are required on `email_authn_challenge` and `text_authn_challenge`)\n  - `{{password_reset_url}}`: Password reset URL (required on `email_password_reset_challenge` and `text_password_reset_challenge`)\n  - `{{otp_code}}`: OTP code (Required on `text_otp_message`)\n  - `{{org_name}}`: Organization name (Optional)\n  - `{{new_user}}`: `true` for new signups, false for returning users (Optional)\n\nConstraints:\n  - Email templates:\n     - Sender name must be at most 128B in size\n     - Subject must be at most 128B in size\n     - Body must be HTML and at most 50KB in size.\n  - SMS:\n     - Body must be at most 140 bytes in size."
      parameters:
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      requestBody:
        description: The new content of the named template
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MessageTemplate'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
  /organizations/config/domains:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    get:
      operationId: GetOrganizationsConfigDomains
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      tags:
      - Identity Management
      summary: List the allowed domains
      description: Returns a list of the allowed origin domains for your organization.
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      type: array
                      items:
                        type: string
        '400':
          $ref: '#/components/responses/BadRequest'
    delete:
      operationId: DeleteOrganizationsConfigDomains
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Remove allowed domains
      description: 'Remove the specified domain from the list of allowed origin domains, or delete all domains. origin domains. If the specified domain does not exist in the list of allowed origin domains, no action will be taken, and a 200 status code will be returned.

        If both domain and deleteAll query parameters are specified, API will return 400 (Bad Request) status code.

        '
      parameters:
      - name: domain
        in: query
        description: The name of the domain to delete
        required: false
        schema:
          type: string
      - name: deleteAll
        in: query
        description: Whether to delete all domains
        required: false
        schema:
          type: boolean
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
    post:
      operationId: PostOrganizationsConfigDomains
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Add allowed domains
      description: 'Add the specified domain patterns to the list of allowed origin domains, or overwrite the existing list.


        Domains may be specified exactly, or as patterns using asterisk wildcards ''*''.

        The ''*'' wildcard will match zero or more characters.

        If a pattern is used, any origin domain matching the pattern will be treated as an allowed domain.

        Otherwise, the origin domain must match the allowed domain exactly. Matching is case-insensitive.

        For example, to specify that domain ''xyz.com'' and all of its subdomains are allowed, use

        [''xyz.com'', ''*.xyz.com'']. This would allow requests with origins ''xyz.com'', ''a.xyz.com'', ''b.c.xyz.com'', and so

        on (but would not allow requests from ''xyz.net'').


        If overwrite is set to true, all existing allowed domains/patterns will be removed and replaced with the provided list.

        If overwrite is set to false, the provided list of domain patterns will be appended to the existing list

        of allowed origin domains. Adding a domain pattern that already exists in the list of allowed origin domains

        will have no effect.'
      parameters:
      - name: overwrite
        in: query
        description: If true, the current list of domains will be replaced with the provided list
        required: false
        schema:
          type: boolean
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OrganizationDomainsPatchRequest'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '402':
          $ref: '#/components/responses/PaymentRequired'
        '404':
          $ref: '#/components/responses/NotFound'
        '408':
          $ref: '#/components/responses/Timeout'
  /organizations/config/token-template:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    get:
      operationId: GetOrganizationsConfigTokenTemplate
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      tags:
      - Identity Management
      summary: Get the organization's token template
      description: 'Retrieves the token template for the given organization.


        If a custom token template was previously created, it will be returned.

        Otherwise the default template is returned.'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/TokenTemplate'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
    put:
      operationId: PutOrganizationsConfigTokenTemplate
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      parameters:
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      summary: Modify the organization's token template
      description: "Sets the token template for your organization. If a template already exists it will be overwritten and cannot\nbe retrieved.\n\nThe template must conform to the [mustache template syntax](https://mustache.github.io/mustache.5.html). The following tags are available:\n  - `{{ organization }}`: provides information on the organization. Renders to\n    ```json\n    {\n      \"id\": \"00000000-0000-0000-0000-000000000000\",\n      \"name\": \"Your Org Name\",\n      \"ancestors\": [\n        {\n          \"id\": \"00000000-0000-0000-0000-111111111111\",\n          \"name\": \"Parent Name\"\n        },\n        ...\n      ]\n    }\n    ```\n\n    The following sub-tags are available:\n    - `{{ organization.id }}`: the ID of the organization. Renders to `00000000-0000-0000-0000-000000000000`\n    - `{{ organization.name }}`: the name of the organization. Renders to `Your Org Name`\n    - `{{ organization.ancestors }}`: the list of ancestor organizations, starting from the parent up to the root. Renders to\n      ```json\n      [{\"id\": \"00000000-0000-0000-0000-111111111111\", \"name\": \"Parent Name\"}, ...]\n      ```\n    - `{{ person.permissions }}`: provides information on the person's permissions (additional and from roles). Renders to\n      ```json\n      [\n        \"permission1\",\n        \"permission2\"\n      ]\n      ```\n"
      requestBody:
        description: The new content of the token template
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TokenTemplate'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '408':
          $ref: '#/components/responses/Timeout'
  /organizations/sso/oidc/provider-credentials:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    get:
      operationId: GetOrganizationsSsoOidcProviderCredentials
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      x-manager-rbac-allowed-groups: admin,member
      tags:
      - Identity Management
      summary: List OIDC credentials for SSO
      description: 'Returns a list of existing OIDC provider credentials for SSO for your organization. Optionally, a provider can be specified to return only credentials for that provider.

        '
      parameters:
      - $ref: '#/components/parameters/OAuthProviderQueryParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      type: array
                      items:
                        $ref: '#/components/schemas/OAuthCredentialGetResponse'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
    post:
      operationId: PostOrganizationsSsoOidcProviderCredentials
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      x-manager-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Create a new set of OIDC provider credentials for SSO
      description: 'Create a new set of OIDC provider credentials for your organization to use with SSO. Includes a client ID, client secret, and the name of the provider. The client ID and client secret should be generated separately using the third-party identity provider you wish to integrate with (such as Google). Not all identity providers are currently supported.

        '
      parameters:
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OAuthCredentialPostRequest'
      responses:
        '201':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
        '400':
          $ref: '#/components/responses/BadRequest'
  /organizations/sso/oidc/provider-credentials/{oauth_client_id}:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    - $ref: '#/components/parameters/OAuthClientIDPathParam'
    get:
      operationId: GetOrganizationsSsoOidcProviderCredentialsOauthClientId
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      x-manager-rbac-allowed-groups: admin,member
      tags:
      - Identity Management
      summary: Get an existing set of OIDC provider credentials for SSO
      description: 'Returns an existing set of OIDC provider for SSO, specified by the client ID.

        '
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/OAuthCredentialGetResponse'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
    delete:
      operationId: DeleteOrganizationsSsoOidcProviderCredentialsOauthClientId
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      x-manager-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Delete an existing set of OIDC provider credentials for SSO
      description: 'Deletes an existing set of OIDC provider credentials for SSO, specified by the client ID.

        '
      parameters:
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIResponseBase'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
    patch:
      operationId: PatchOrganizationsSsoOidcProviderCredentialsOauthClientId
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      x-manager-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Modify an existing set of OIDC provider credentials for SSO
      description: Modifies the client secret and/or label of an existing set of OIDC provider credentials for SSO, specified by the client ID.
      parameters:
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OAuthCredentialPatchRequest'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIResponseBase'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /organizations:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    get:
      operationId: GetOrganizations
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      tags:
      - Identity Management
      summary: Retrieve information about an organization
      description: 'Retrieve information about which other organizations the given shares persons and groups with.

        '
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/OrganizationResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
    delete:
      operationId: DeleteOrganizations
      x-rbac-enabled: false
      tags:
      - Identity Management
      summary: Delete an organization
      description: 'Delete a non-root, leaf organization, including all its persons memberships and their groups memberships and attributes.

        '
      parameters:
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      - $ref: '#/components/parameters/DeleteSuborganizationOptionalQueryParam'
      - $ref: '#/components/parameters/ConfirmationTimestampQueryParam'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
  /organizations/attributes:
    patch:
      operationId: PatchOrganizationsAttributes
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      summary: Create or modify attributes for the organization in multiple buckets
      description: 'Create new attributes or modify existing attributes for the organization in one or more attribute buckets.

        The request body should be a nested object, with bucket names as top-level keys, and key-value pair attributes as values, as shown in the example request body. The buckets must exist and must be accessible by the organization identified in the request header. Attribute names may be at most 70 bytes long. Attribute values must be JSON-serializable and are limited to 64KiB. Any existing attribute that isn''t referenced by key in the request is left untouched.

        '
      tags:
      - Identity Management
      parameters:
      - $ref: '#/components/parameters/OrgIDHeader'
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PatchBucketedAttributesReq'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
    put:
      operationId: PutOrganizationsAttributes
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      summary: Create or modify attributes for the organization in multiple buckets
      description: 'Create new attributes or modify existing attributes for the organization in one or more attribute buckets.

        The request body should be a nested object, with bucket names as top-level keys, and key-value pair attributes as values, as shown in the example request body. The buckets must exist and must be accessible by the organization identified in the request header. Attribute names may be at most 70 bytes long. Attribute values must be JSON-serializable and are limited to 64KiB. Replaces the set of existing attributes with those present in the request. In other words, it deletes any existing attributes that aren''t referenced by key in the request.

        '
      tags:
      - Identity Management
      parameters:
      - $ref: '#/components/parameters/OrgIDHeader'
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PutBucketedAttributesReq'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
    get:
      operationId: GetOrganizationsAttributes
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      summary: Retrieve attributes for the organization from multiple buckets
      description: 'Retrieve attributes for the organization from one or more buckets. If no buckets are specified, attributes from all buckets will be retrieved.

        Bucket names can be specified as a comma-separated list in the `buckets` query parameter. All buckets specified must exist, and the organization specified in the header must be able to access them. Empty bucket names are not permitted.

        '
      tags:
      - Identity Management
      parameters:
      - $ref: '#/components/parameters/OrgIDHeader'
      - $ref: '#/components/parameters/AttributeBucketsQueryParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/GetBucketedAttributesResp'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
  /organizations/attributes/{bucket_name}:
    patch:
      operationId: PatchOrganizationsAttributesBucketName
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      summary: Create or modify attributes for the organization in a single bucket
      description: 'Create new attributes or modify existing attributes for the organization in a single attribute bucket.

        The bucket must exist and must be accessible by the organization identified in the request header.

        The request body should be an object consisting of key-value pair attributes. Attribute names may be at most 70 bytes long. Attribute values must be JSON-serializable and are limited to 64KiB. Any existing attribute that isn''t referenced by key in the request is left untouched.

        '
      tags:
      - Identity Management
      parameters:
      - $ref: '#/components/parameters/OrgIDHeader'
      - $ref: '#/components/parameters/AttributeBucketNamePathParam'
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PatchAttributesReq'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
    put:
      operationId: PutOrganizationsAttributesBucketName
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      summary: Create or modify attributes for the organization in a single bucket
      description: 'Create new attributes or modify existing attributes for the organization in a single attribute bucket.

        The bucket must exist and must be accessible by the organization identified in the request header.

        The request body should be an object consisting of key-value pair attributes. Attribute names may be at most 70 bytes long. Attribute values must be JSON-serializable and are limited to 64KiB. Replaces the set of existing attributes with those present in the request. In other words, it deletes any existing attributes that aren''t referenced by key in the request.

        '
      tags:
      - Identity Management
      parameters:
      - $ref: '#/components/parameters/OrgIDHeader'
      - $ref: '#/components/parameters/AttributeBucketNamePathParam'
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PutAttributesReq'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
    get:
      operationId: GetOrganizationsAttributesBucketName
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      summary: Retrieve attributes for the organization from a single bucket
      description: 'Retrieve attributes for the organization from a single attribute bucket.

        The bucket must exist and must be accessible by the organization identified in the request header. If no attribute names are specified, all attributes in the bucket will be retrieved. Attribute names can be provided as a comma-separated list in the `attributes` query parameter. Empty attribute names are not permitted.

        '
      tags:
      - Identity Management
      parameters:
      - $ref: '#/components/parameters/OrgIDHeader'
      - $ref: '#/components/parameters/AttributeBucketNamePathParam'
        required: true
      - $ref: '#/components/parameters/AttributeNamesQueryParam'
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/GetAttributesResp'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
    delete:
      operationId: DeleteOrganizationsAttributesBucketName
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      summary: Delete attributes for the organization from a single bucket
      description: 'Delete attributes for the organization from a single attribute bucket.

        The bucket must exist and must be accessible by the organization identified in the request header. Attribute names can be provided as a comma-separated list in the `attributes` query parameter. Empty attribute names are not permitted. If no attribute names are specified, all attributes in the bucket will be deleted.

        WARNING: this action is permanent and cannot be undone.

        '
      tags:
      - Identity Management
      parameters:
      - $ref: '#/components/parameters/OrgIDHeader'
      - $ref: '#/components/parameters/AttributeBucketNamePathParam'
      - $ref: '#/components/parameters/AttributeNamesQueryParam'
        required: true
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
  /organizations/suborganizations:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    get:
      operationId: GetOrganizationsSuborganizations
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      tags:
      - Identity Management
      summary: List suborganizations
      description: 'Retrieve a list of all descendant organizations.

        '
      parameters:
      - $ref: '#/components/parameters/OrganizationsFilterQueryParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      type: array
                      items:
                        $ref: '#/components/schemas/OrganizationID'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
    post:
      operationId: PostOrganizationsSuborganizations
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Create a suborganization
      description: 'Create a new organization subordinate to your organization.

        '
      parameters:
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      requestBody:
        required: false
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SuborganizationCreateRequest'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/OrganizationCreateResponse'
        '402':
          $ref: '#/components/responses/PaymentRequired'
        '412':
          $ref: '#/components/responses/PreconditionFailed'
  /organizations/api-keys:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    - $ref: '#/components/parameters/RequiredConsistencyHeader'
    - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
    put:
      operationId: PutOrganizationsApiKeys
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Generate a new API key for the specified organization
      description: A new API key is created and returned. The previous API key will no longer be valid after this.
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/OrganizationsPutAPIKeyResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
  /organizations/config:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    get:
      operationId: GetOrganizationsConfig
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member,impersonator,saml-admin,uar-certifier,uar-campaign-manager,cs-id-verifier
      tags:
      - Identity Management
      summary: Get organization config
      description: Get the current configuration for your organization
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/OrganizationConfig'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
    patch:
      operationId: PatchOrganizationsConfig
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Update organization config
      description: 'Modify the configuration for your organization.


        The token duration determines the number of seconds a token issued by SlashID will be valid for. If not set, or set to 0, the default duration of 24 hours will be used for all tokens.


        The groups claim name determines the name of the claim in the token payload where a user''s groups are found. If not set, or set to the empty string, the default claim name `groups` will be used for all tokens.

        '
      parameters:
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OrganizationConfigPatchRequest'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /organizations/quota/current-tier:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    get:
      operationId: GetOrganizationsQuotaCurrentTier
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      tags:
      - Identity Management
      summary: Get current pricing tier details.
      description: This returns the quotas associated with your organization's current pricing tier.
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/PricingTierConstraints'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
  /organizations/quota/all-tiers:
    get:
      operationId: GetOrganizationsQuotaAllTiers
      tags:
      - Identity Management
      summary: Get details on all pricing tiers.
      description: This returns the quotas for each available pricing tier.
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      type: array
                      items:
                        $ref: '#/components/schemas/PricingTierConstraints'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
  /organizations/quota/usage:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    get:
      operationId: GetOrganizationsQuotaUsage
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      tags:
      - Identity Management
      summary: Get resource usage for the organization hierarchy.
      description: This returns the resources used by your organization and its suborganizations. This can be used to evaluate the need for a tier upgrade.
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/OrganizationUsageDetails'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
  /organizations/attribute-buckets:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    get:
      operationId: GetOrganizationsAttributeBuckets
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      tags:
      - Identity Management
      summary: List organization's attribute buckets
      description: Get a list of available attribute buckets for your organization
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      type: array
                      items:
                        $ref: '#/components/schemas/AttributeBucket'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
  /organizations/config/kyc:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    get:
      operationId: GetOrganizationsConfigKyc
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      tags:
      - Identity Management
      summary: Get organization KYC config
      description: Get the current KYC configuration for your organization
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/OrganizationKYCConfig'
        '400':
          $ref: '#/components/responses/BadRequest'
        '403':
          $ref: '#/components/responses/Forbidden'
    patch:
      operationId: PatchOrganizationsConfigKyc
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Update KYC organization config
      description: 'Modify the KYC configuration for your organization.


        The mobile redirect base URL determines where a user will be redirected to when temporarily switching to a mobile device in order to upload/capture document pictures.

        '
      parameters:
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OrganizationKYCConfigPatchRequest'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '403':
          $ref: '#/components/responses/Forbidden'
  /organizations/webhooks:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostOrganizationsWebhooks
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Create a new webhook
      description: 'Create a new webhook for your organization. Webhooks will be called in response to triggers, and you can use

        the `/organizations/webhooks/{webhook_id}/triggers` endpoint to specify which trigger(s) should call each

        webhook.


        The request body must contain the target URL for the webhook, and this must be unique for your organization

        (you cannot have two webhooks with the same target URL). The target URL must use the HTTPS protocol, and must

        have a host. The host cannot be `localhost` or an IP address. The target URL may have a path element, but may

        not contain query parameters or fragments.


        Additionally, you can specify custom headers that will be sent in the HTTP header of each request to your

        webhook''s target URL. These are encrypted when stored, so can be used for sensitive data.


        You can also choose the webhook''s timeout value. This will determine how long your webhook server has to respond

        to a request before it is considered failed. If you do not set a value, defaults will be used: for synchronous

        webhook calls, this is 2 seconds; for asynchronous calls, 10 seconds. When choosing a timeout, you should

        consider how long your webhook will typically need to process a request, and how this may affect user experience

        (in the case of sychronous webhooks).

        The value provided should be a string that can be parsed as a [Golang `time.Duration`](https://pkg.go.dev/time#Duration);

        for example, "10s", "500ms". The timeout may not be more than 20 seconds, and cannot be negative.

        If you do not set a timeout, when retrieving the webhook you will see a timeout set to 0s, indicating that the

        defaults will be used when the webhook is called.


        You may also specify a name and description for the webhook.


        The response will contain a webhook ID, which uniquely identifies the newly created webhook. This ID can

        be used to modify or delete the webhook, and to add triggers for it.


        For more information on using webhooks with SlashID, see our [dedicated guide](/docs/access/guides/webhooks).

        '
      parameters:
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WebhookPostRequest'
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/WebhookPostResponse'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
    get:
      operationId: GetOrganizationsWebhooks
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      x-manager-rbac-allowed-groups: admin,member
      tags:
      - Identity Management
      summary: List all webhooks
      description: Retrieve a list of all webhooks for your organization.
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      type: array
                      items:
                        $ref: '#/components/schemas/Webhook'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /organizations/webhooks/{webhook_id}:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    - $ref: '#/components/parameters/WebhookIDPathParam'
    get:
      operationId: GetOrganizationsWebhooksWebhookId
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      tags:
      - Identity Management
      summary: Get a webhook
      description: Retrieve information about a specific webhook, identified by its ID.
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/Webhook'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
    patch:
      operationId: PatchOrganizationsWebhooksWebhookId
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Update a webhook
      description: 'Update an existing webhook, identified by its ID.

        This endpoint can be used to modify the target URL, custom headers, name, or description of the webhook. Note that the target URL cannot be changed to a URL already in use by another webhook for your organization. Modifying the custom headers will overwrite any existing custom headers for this webhook.

        '
      parameters:
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WebhookPatchRequest'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/WebhookPatchResponse'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
    delete:
      operationId: DeleteOrganizationsWebhooksWebhookId
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Delete a webhook
      description: 'Delete the specified webhook. This will also delete all triggers associated with this webhook. This action cannot be undone.

        '
      parameters:
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /organizations/webhooks/{webhook_id}/triggers:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    - $ref: '#/components/parameters/WebhookIDPathParam'
    get:
      operationId: GetOrganizationsWebhooksWebhookIdTriggers
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      x-manager-rbac-allowed-groups: admin,member
      tags:
      - Identity Management
      summary: List webhook triggers
      description: List all the triggers for a specific webhook.
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      type: array
                      items:
                        $ref: '#/components/schemas/WebhookTrigger'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
    post:
      operationId: PostOrganizationsWebhooksWebhookIdTriggers
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Create a webhook trigger
      description: 'Create a new trigger for an existing webhook. Each webhook can have multiple triggers, and will be called

        on each of them.


        The trigger type specifies what kind of trigger will cause the webhook to be called. The trigger name specifies

        the exact trigger that will cause the webhook to be called, amongst all triggers of this type. For a full list

        of trigger types and names, refer to our [webhooks guide](/docs/access/guides/webhooks).

        '
      parameters:
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WebhookTriggerPostRequest'
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIResponseBase'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
    delete:
      operationId: DeleteOrganizationsWebhooksWebhookIdTriggers
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Delete a webhook trigger
      description: 'Delete a trigger for a specific webhook. The webhook will no longer be called on this trigger.

        Note that for a short period after the delete request has successfully returned, triggers in flight may still cause the webhook to be called.

        '
      parameters:
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      - $ref: '#/components/parameters/WebhookTriggerTypeQueryParam'
      - $ref: '#/components/parameters/WebhookTriggerNameQueryParam'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /organizations/webhooks/verification-jwks:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    get:
      operationId: GetOrganizationsWebhooksVerificationJwks
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      tags:
      - Identity Management
      summary: Retrieve verification JWKS for webhooks
      description: 'Endpoint to retrieve a JSON Web Key Set (JWKS) for webhook body verification.

        When SlashID calls your webhooks in response to a trigger, the body of the request is a signed and encoded JSON Web Token (JWT). The public part of the signing key can be retrieved from this endpoint and used to verify that the request body comes from SlashID, is intended for your webhook, and has not been modified.

        SlashID uses the ES256 JSON Web Algorithm (JWA), which is the Elliptic Curve Digital Signature Algorithm (ECDSA) with the P-256 curve and SHA256.

        Support for JWTs and JWKS is available for many languages - [jwt.io](https://jwt.io/libraries) maintains an extensive (but not exhaustive) list of libraries for popular languages.

        Note that this endpoint is rate-limited to 30 requests per minute per organization, with bursts of 60. It is therefore recommended that you cache the keyset locally in your webhook handlers.

        '
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JWKS'
  /oauth2/clients:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostOauth2Clients
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Create a new OAuth2 client
      description: 'Create a new client ID/secret pair that can be used with the client credentials grant type.

        A valid SlashID organization ID and API key must be used to authenticate and authorize the request.

        The client credentials can be configured.


        SlashID currently supports the following OAuth 2.0 grants:

        - client credentials

        - authorization code

        - refresh token

        The `grant_types` field may contain only the values `client_credentials` and `authorization_code`.

        Other values will return a `400` error code.


        The client credentials grant requires a client secret, and so all clients allowing that grant should be regarded

        as confidential, as defined in the OAuth 2.0 specification (https://oauth.net/2/client-types/).


        The response body will include the client ID and client secret.

        For the client credentials grant, these can be used with the `/oauth2/tokens` endpoints to obtain an access token.

        For the authorization code grant, these can be used as described in the [OAuth 2.0 specification](https://datatracker.ietf.org/doc/html/rfc6749).

        The client secret must be stored securely, and cannot be retrieved in

        subsequent API calls. If you lose the client secret, a new secret can be generated using the

        `PUT /oauth2/clients/{oauth_client_id}/secret` endpoint.'
      parameters:
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostOAuth2ClientRequest'
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  required:
                  - result
                  properties:
                    result:
                      $ref: '#/components/schemas/OAuth2ClientWithSecret'
        '400':
          $ref: '#/components/responses/BadRequest'
    get:
      operationId: GetOauth2Clients
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      tags:
      - Identity Management
      summary: Retrieve a list of OAuth2 clients
      description: 'Retrieve a list of existing OAuth 2.0 clients for your organization.

        '
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  required:
                  - result
                  properties:
                    result:
                      type: array
                      items:
                        $ref: '#/components/schemas/OAuth2Client'
        '400':
          $ref: '#/components/responses/BadRequest'
  /oauth2/clients/{oauth_client_id}:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    - $ref: '#/components/parameters/OAuthClientIDPathParam'
    get:
      operationId: GetOauth2ClientsOauthClientId
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      tags:
      - Identity Management
      summary: Retrieve an OAuth2 client
      description: 'Get details on the identified client. Authenticated with a SlashID organization ID and API key; the organization ID must match or be a parent of the client owner.

        '
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  required:
                  - result
                  properties:
                    result:
                      $ref: '#/components/schemas/OAuth2Client'
        '400':
          $ref: '#/components/responses/BadRequest'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
    delete:
      operationId: DeleteOauth2ClientsOauthClientId
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Delete an existing OAuth2 client
      description: 'Delete the identified client. Authenticated with a SlashID organization ID and API key; the organization ID must match or be a parent of the client owner.

        '
      parameters:
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
    patch:
      operationId: PatchOauth2ClientsOauthClientId
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Modify an existing OAuth2 client
      description: 'Update the identified client. Authenticated with a SlashID organization ID and API key; the organization ID must match or be a parent of the client owner.


        SlashID currently only supported a subset of OAuth clients, therefore we enforce that grant_types must be ["client_credentials"]. Setting this field to any other value will result in an error response with a `400` status code.

        '
      parameters:
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PatchOAuth2ClientRequest'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  required:
                  - result
                  properties:
                    result:
                      $ref: '#/components/schemas/OAuth2Client'
        '400':
          $ref: '#/components/responses/BadRequest'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
  /oauth2/clients/{oauth_client_id}/secret:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    - $ref: '#/components/parameters/OAuthClientIDPathParam'
    put:
      operationId: PutOauth2ClientsOauthClientIdSecret
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Generate a new client secret
      description: 'A new client secret is created and returned. The previous secret will no longer be valid after this.

        '
      parameters:
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  required:
                  - result
                  properties:
                    result:
                      $ref: '#/components/schemas/OAuth2ClientSecretResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
  /oauth2/clients/{oauth_client_id}/ui-configuration:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    - $ref: '#/components/parameters/OAuthClientIDPathParam'
    get:
      operationId: GetOauth2UiConfiguration
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      summary: Retrieve the configuration for the hosted UI
      description: 'The configuration is used to theme the hosted UI.

        '
      tags:
      - Identity Management
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  required:
                  - result
                  properties:
                    result:
                      $ref: '#/components/schemas/OAuthClientUIConfigurationGetResponse'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
    put:
      operationId: PutOauth2UiConfiguration
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      summary: Modify the configuration for the hosted UI
      description: 'The configuration is used to theme the hosted UI.

        '
      tags:
      - Identity Management
      parameters:
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OAuthClientUIConfigurationPutRequest'
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  required:
                  - result
                  properties:
                    result:
                      $ref: '#/components/schemas/OAuthClientUIConfigurationPutResponse'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
  /oauth2/authorize:
    get:
      operationId: GetOauth2Authorize
      summary: Request an authorization code
      description: 'Used to initiate an authorization code flow.


        SlashID is an OAuth 2.0 and OpenID Connect 1.0 provider.

        '
      tags:
      - Identity Management
      parameters:
      - $ref: '#/components/parameters/ScopeQueryParam'
      - $ref: '#/components/parameters/ResponseTypeQueryParam'
      - $ref: '#/components/parameters/ClientIDQueryParam'
      - $ref: '#/components/parameters/RedirectURIQueryParam'
      - $ref: '#/components/parameters/StateQueryParam'
      - $ref: '#/components/parameters/CodeChallengeQueryParam'
      - $ref: '#/components/parameters/CodeChallengeMethodQueryParam'
      - $ref: '#/components/parameters/ResponseModeQueryParam'
      - $ref: '#/components/parameters/NonceQueryParam'
      - $ref: '#/components/parameters/DisplayQueryParam'
      - $ref: '#/components/parameters/PromptQueryParam'
      - $ref: '#/components/parameters/MaxAgeQueryParam'
      - $ref: '#/components/parameters/UILocalesQueryParam'
      - $ref: '#/components/parameters/LoginHintQueryParam'
      - $ref: '#/components/parameters/ACRValuesQueryParam'
      - $ref: '#/components/parameters/HandleTypesQueryParam'
      responses:
        '200':
          description: OK
          content:
            text/html:
              schema:
                type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '403':
          $ref: '#/components/responses/Forbidden'
  /oauth2/tokens:
    post:
      operationId: PostOauth2Tokens
      tags:
      - Identity Management
      security:
      - OAuth2ClientIdSecret: []
      summary: Obtain an access token
      description: 'Obtain a new OAuth 2.0 access token using an OAuth 2.0 client ID/secret pair.

        '
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/PostOAuth2TokenRequest'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostOAuth2TokenResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '403':
          $ref: '#/components/responses/Forbidden'
  /oauth2/tokens/revoke:
    post:
      operationId: PostOauth2TokensRevoke
      tags:
      - Identity Management
      security:
      - OAuth2ClientIdSecret: []
      summary: Revoke a token
      description: 'Revoke an OAuth 2.0 token using an OAuth 2.0 client ID/secret pair.

        '
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/RevokeOAuth2TokenRequest'
      responses:
        '200':
          $ref: '#/components/responses/OK'
        '400':
          $ref: '#/components/responses/BadRequest'
        '403':
          $ref: '#/components/responses/Forbidden'
  /oauth2/tokens/revoke-all:
    post:
      operationId: PostOauth2TokensRevokeAll
      tags:
      - Identity Management
      security:
      - OAuth2ClientIdSecret: []
      summary: Revoke tokens
      description: 'Revoke OAuth 2.0 tokens using an OAuth 2.0 client ID/secret pair.

        '
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/RevokeAllOAuth2TokensRequest'
      responses:
        '200':
          $ref: '#/components/responses/OK'
        '400':
          $ref: '#/components/responses/BadRequest'
        '403':
          $ref: '#/components/responses/Forbidden'
  /oauth2/tokens/introspect:
    post:
      operationId: PostOauth2TokensIntrospect
      tags:
      - Identity Management
      security:
      - OAuth2ClientIdSecret: []
      summary: Introspect an access token
      description: 'Introspect an OAuth 2.0 access or refresh token using an OAuth 2.0 client ID/secret pair. Note: there is a know issue for this endpoint, whereby the expiry for refresh tokens in the response is incorrect. However, expired refresh tokens will still return a response with `active: false`.

        '
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/IntrospectOAuth2TokenRequest'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IntrospectOAuth2TokenResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
  /oauth2/tokens/mint:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostOauth2TokensMint
      tags:
      - Identity Management
      security:
      - ApiKeyAuth: []
      summary: Mint OAuth 2.0 & OIDC tokens
      description: "This endpoint creates a set of OAuth 2.0 tokens for a specific user.\n\nTo generate a refresh token request scope `offline_access`.\nTo generate an ID token request scope `openid`.\n\nCustom claims can be specified in the request body which will be added to the token's payload.\nCustom claims are added to the token's payload.\n\nTokens created with this endpoint will have an `authenticated_methods` claim equal to [\"api\"].\n\n\nThe following claims are reserved and cannot be specified:\n  - aud\n  - exp\n  - jti\n  - iat\n  - iss\n  - nbf\n  - sub\n  - prev_token_id\n  - oid\n  - org_id\n  - user_id\n  - person_id\n  - first_token\n  - authenticated_methods\n  - oidc_tokens\n  - user_token\n  - groups\n  - roles\n  - access_token\n  - refresh_token\n  - id\n  - id_token\n  - gdpr\n  - gdpr_consent\n  - gdpr_consent_level\n  - parent_user_id\n  - parent_person_id\n  - parent_org_id\n  - parent_oid\n  - attributes\n  - custom_claims\n  - slashid\n  - slashid.dev\n  - slashid.com\n  - slashid.me\n  - sid\n\n\nWith the following request body:\n\n```\n{\n    \"custom_claims\": {\n        \"foo\": \"bar\",\n        \"baz\": {\"everything\": 42}\n    }\n}\n```\n\n\nthe token in the response will have the following payload:\n\n```\n{\n  \"authenticated_methods\": [\n    \"api\"\n  ],\n  \"baz\": {\n    \"everything\": 42\n  },\n  \"exp\": <expiration time timestamp>,\n  \"first_token\": false,\n  \"foo\": \"bar\",\n  \"iat\": <issued at timestamp>,\n  \"iss\": <token issuer>,\n  \"jti\": <token ID>,\n  \"oid\": <organisation ID>,\n  \"person_id\": <person ID>\n}\n```\n"
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MintOAuth2TokensRequest'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  required:
                  - result
                  properties:
                    result:
                      $ref: '#/components/schemas/MintOAuth2TokensResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
  /oauth2/userinfo:
    get:
      operationId: GetOauth2Userinfo
      tags:
      - Identity Management
      summary: Retrieve a person's profile
      description: 'Given the SlashID Access Token obtained during signin, this endpoint returns a person''s profile.


        This endpoint will work only if `openid` was granted as a scope for the Access Token. The information included in the response depends on the scopes requested. For example, a scope of just `openid` may return less information than a scope of `openid profile email`.

        '
      security:
      - OAuth2AccessTokenBearer: []
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserinfoOAuth2Response'
        '401':
          $ref: '#/components/responses/Unauthorized'
    post:
      operationId: PostOauth2Userinfo
      tags:
      - Identity Management
      summary: Retrieve a person's profile
      description: 'Given the SlashID Access Token obtained during signin, this endpoint returns a person''s profile.


        This endpoint will work only if `openid` was granted as a scope for the Access Token. The information included in the response depends on the scopes requested. For example, a scope of just `openid` may return less information than a scope of `openid profile email`.

        '
      security:
      - OAuth2AccessTokenBearer: []
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserinfoOAuth2Response'
        '401':
          $ref: '#/components/responses/Unauthorized'
components:
  responses:
    Forbidden:
      description: Forbidden
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIResponseBase'
    OK:
      description: OK
    PreconditionFailed:
      description: Precondition Failed
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIResponseBase'
    Conflict:
      description: Conflict
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIResponseBase'
    PaymentRequired:
      description: Pricing Tier Violation - operation violated the limits specified in its pricing tier.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIResponseBase'
    BadRequest:
      description: Bad Request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIResponseBase'
    Timeout:
      description: 'Request Timeout - operation exceeded the timeout limit from SlashID-Required-Consistency-Timeout.

        The operation may still be in progress, and will be completed eventually.'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIResponseBase'
    NoContent:
      description: No content
    Unauthorized:
      description: Unauthorized
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIResponseBase'
    Accepted:
      description: Accepted - Request was accepted and will be processed in the background
    NotFound:
      description: Not Found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIResponseBase'
  schemas:
    PublicKeyAuthenticator:
      type: object
      required:
      - aaguid
      properties:
        aaguid:
          type: string
          description: Base64-encoded AAGUID of the authenticator device
        sign_count:
          type: integer
        clone_warning:
          type: boolean
    WebhookPostResponse:
      $ref: '#/components/schemas/Webhook'
    PasswordCredentialParams:
      type: object
      required:
      - password_hash
      properties:
        password_hash:
          type: string
          description: "A hash of a password, in the one of the formats accepts by SlashID.\nSlashID supports the following hashing functions:\n  - pbkdf2\n  - bcrypt\n  - argon2i\n  - argon2id\nHashes created using a function not listed here will be rejected.\nIn all of these cases, SlashID accepts hashes in the format described [here](https://github.com/P-H-C/phc-string-format/blob/master/phc-sf-spec.md).\nThe only departure from the specification described is that the hashing function version can include the characters [a-z0-9], to accommodate bcrypt versions (2, 2a, 2b, 2x, 2y).\nSlashID also accepts password hashes in the format used by [bcrypt](https://www.usenix.org/legacy/events/usenix99/provos/provos.pdf).\nIf a password hash matches this format, it is assumed that the hashing function used was bcrypt.\nIf any other hashing function was used to hash the password, the hash must be in the SlashID hash format.\n"
    OAuthClientUIConfigurationPutResponse:
      $ref: '#/components/schemas/OAuthClientUIConfiguration'
    SAMLProviderCredentialsPostResponse:
      $ref: '#/components/schemas/SAMLProviderCredentials'
    SyncHookName:
      type: string
      enum:
      - token_minted
      - identify_user
      - threat_detection
      - posture_detection
    MintOAuth2TokensRequest:
      type: object
      required:
      - person_id
      - client_id
      properties:
        person_id:
          $ref: '#/components/schemas/PersonID'
        client_id:
          $ref: '#/components/schemas/OAuth2ClientID'
        scopes:
          type: array
          items:
            type: string
        custom_claims:
          type: object
          additionalProperties: true
    GetPersonOrganizationsResponse:
      type: array
      items:
        $ref: '#/components/schemas/OrganizationDetails'
    IntrospectOAuth2TokenResponse:
      type: object
      required:
      - active
      properties:
        active:
          type: boolean
          description: Whether the token is active. False for invalid and expired tokens, and tokens that are not granted the scopes specified in the request.
        client_id:
          type: string
          description: The client ID used to create this token. Only included if `active` is `true`.
        exp:
          type: integer
          description: The expiration timestamp of the token. Only included if `active` is `true`.
        iat:
          type: integer
          description: The timestamp when the token was issued. Only included if `active` is `true`.
        scope:
          type: string
          description: The scope granted to the token. Only included if `active` is `true`.
    PublicKeyCredentialParams:
      type: object
      required:
      - webauthn_credential_id
      - public_key
      - attestation_type
      - authenticator
      properties:
        webauthn_credential_id:
          type: string
          description: The ID of the webauthn credential
        public_key:
          type: string
          description: Base64-encoded public key
        attestation_type:
          type: string
          description: The attestation type for the public key (defaults to "none")
        authenticator:
          $ref: '#/components/schemas/PublicKeyAuthenticator'
    OAuthProvider:
      type: string
      enum:
      - google
      - github
      - bitbucket
      - gitlab
      - facebook
      - line
      - azuread
      - okta
      - apple
    AttributePermissions:
      type: string
      description: The access level for end-users to attributes in this bucket.
      enum:
      - no_access
      - read_only
      - read_write
    OAuth2ClientSecretResponse:
      type: object
      required:
      - client_secret
      properties:
        client_secret:
          $ref: '#/components/schemas/OAuth2ClientSecret'
    JWKS:
      type: object
      additionalProperties: true
    OAuthProvidersOptions:
      type: object
      description: Options for supported third-party providers.
      properties:
        google:
          $ref: '#/components/schemas/OAuthGoogleProviderOptions'
        github:
          $ref: '#/components/schemas/OAuthGithubProviderOptions'
        bitbucket:
          $ref: '#/components/schemas/OAuthBitbucketProviderOptions'
        gitlab:
          $ref: '#/components/schemas/OAuthGitlabProviderOptions'
        facebook:
          $ref: '#/components/schemas/OAuthFacebookProviderOptions'
        line:
          $ref: '#/components/schemas/OAuthLineProviderOptions'
        azuread:
          $ref: '#/components/schemas/OAuthAzureADProviderOptions'
        okta:
          $ref: '#/components/schemas/OAuthOktaProviderOptions'
        apple:
          $ref: '#/components/schemas/OAuthAppleProviderOptions'
    OAuthCredentialPatchRequest:
      type: object
      description: Request to modify an existing OAuth credential
      properties:
        client_secret:
          type: string
        label:
          type: string
        external_cred:
          $ref: '#/components/schemas/ExternalCredID'
          deprecated: true
        external_cred_id:
          $ref: '#/components/schemas/ExternalCredID'
        options:
          $ref: '#/components/schemas/OAuthProvidersOptions'
        enable_in_slashid_oidc_authz_server:
          type: boolean
          description: Indicates whether these credentials can be used for SSO authentication during an OIDC flow in which SlashID acts as the Authorization Server.
    OrganizationUsageDetails:
      type: object
      description: 'Details of how many suborganization/persons/groups have been used by this organization hierarchy.

        '
      required:
      - num_suborganizations
      - num_persons
      - num_groups
      properties:
        pricing_tier_details:
          $ref: '#/components/schemas/PricingTierConstraints'
        num_suborganizations:
          description: Indicates the number of the suborganizations in the hierarchy, not including the root organization.
          type: integer
          format: int64
        num_persons:
          description: Indicates the number of persons, including all suborganizations in the hierarchy.
          type: integer
          format: int64
        num_groups:
          description: Indicates the groups, including all suborganizations in the hierarchy.
          type: integer
          format: int64
    APIResponseBase:
      type: object
      properties:
        meta:
          $ref: '#/components/schemas/APIMeta'
        errors:
          type: array
          items:
            $ref: '#/components/schemas/APIResponseError'
    AttributeSharingScope:
      type: string
      description: The scope in which attributes in this bucket are available
      enum:
      - organization
      - person_pool
    MintOAuth2TokensResponse:
      type: object
      required:
      - access_token
      properties:
        id_token:
          type: string
        access_token:
          type: string
        refresh_token:
          type: string
    PersonDirectIDReq:
      required:
      - duration_secs
      type: object
      properties:
        duration_secs:
          description: How long (in seconds) the Direct-ID should be valid for. If unspecified, it is set to your organization's default value.
          type: integer
    OrganizationKYCConfig:
      type: object
      description: Configuration values related to KYC for an organization.
      properties:
        mobile_redirect_base_url:
          type: string
          description: The base URL to redirect users to perform document upload/capture from mobile devices
          example: https://www.example.com/mobile-upload
    ExternalCredentialContent:
      type: object
      properties: {}
      description: Free form object for implicit server to server authentication credentials, different schema for provider.
      example:
        client_id: my-client-id
        client_secret: my-client-secret
        webhook_token: my-web-hook-token
    GetRoleResponse:
      type: object
      properties:
        name:
          $ref: '#/components/schemas/RoleName'
        description:
          type: string
        created:
          type: string
          format: date-time
        permissions:
          type: array
          items:
            $ref: '#/components/schemas/PermissionName'
      required:
      - name
      - created
      - permissions
    APICursorPagination:
      type: object
      required:
      - limit
      - cursor
      - total_count
      properties:
        limit:
          type: integer
        cursor:
          type: string
        total_count:
          type: integer
          format: int64
    OrganizationID:
      type: string
    WebhookTriggerPostRequest:
      $ref: '#/components/schemas/WebhookTrigger'
    ExternalCredTypes:
      type: string
      enum:
      - api_key
      - client_credentials
      - user_pass
      - api_id_access
      - access_token
      - json_credentials
    ExportedTOTPCredentialParams:
      type: object
      required:
      - recovery_codes_total
      - recovery_codes_unused
      properties:
        recovery_codes_total:
          type: integer
          minimum: 0
          description: The total number of recovery codes originally issued to the given person.
        recovery_codes_unused:
          type: integer
          minimum: 0
          description: The total number of recovery codes still unused by the given person.
    ExportedPasswordCredential:
      type: object
      allOf:
      - $ref: '#/components/schemas/ExportedCredentialBase'
      - $ref: '#/components/schemas/PasswordCredential'
    PostRBACCheckRequest:
      type: object
      properties:
        person_id:
          $ref: '#/components/schemas/PersonID'
        permission_name:
          $ref: '#/components/schemas/PermissionName'
      required:
      - person_id
      - permission_name
    ValidateTokenReq:
      required:
      - token
      type: object
      properties:
        token:
          $ref: '#/components/schemas/TokenText'
    PatchBucketedAttributesReq:
      $ref: '#/components/schemas/BucketedAttributes'
    OAuth2ScopesSpaceDelimited:
      description: List of OAuth2 scopes, delimited with spaces.
      type: string
      example: admin user
    PasswordRotatePostResp:
      type: object
      properties:
        new_password:
          type: string
    SuborganizationCreateRequest:
      type: object
      properties:
        sub_org_name:
          type: string
        admins:
          type: array
          items:
            $ref: '#/components/schemas/PersonHandle'
        persons_org_id:
          $ref: '#/components/schemas/OrganizationID'
        groups_org_id:
          $ref: '#/components/schemas/OrganizationID'
        inherit_rbac_pools:
          type: boolean
          description: "This setting determines how permissions and roles are managed for a suborganization.\nWhen `inherit_rbac_pools` is set to false: - The suborganization has its own independent permissions and roles. - Permissions and roles can be fully customized for this suborganization.\nWhen `inherit_rbac_pools` is set to true: - Permissions:\n  - Inherited from the nearest ancestor with 'inherit_rbac_pools' set to false.\n  - Read-only for this suborganization.\n  - Cannot be modified within this suborganization.\n\n- Roles:\n  - Scoped to each organization, including this suborganization.\n  - Visible across all organizations within the inheritance pool.\n  - Roles from other organizations can be assigned to users in this suborganization.\n\nNote: - Individual role and permission assignments are not inherited. - This setting cannot be changed after the suborganization is created.\n"
      required:
      - sub_org_name
      - admins
    OAuth2AuthTokenType:
      type: string
      enum:
      - bearer
    APIResponseError:
      type: object
      properties:
        httpcode:
          type: integer
        message:
          type: string
    PutBucketedAttributesReq:
      $ref: '#/components/schemas/BucketedAttributes'
    OAuthCredentialGetResponse:
      type: object
      description: Response when retrieving an OAuth credential
      properties:
        client_id:
          $ref: '#/components/schemas/OAuthClientID'
        provider:
          $ref: '#/components/schemas/OAuthProvider'
        label:
          type: string
        external_cred_id:
          $ref: '#/components/schemas/ExternalCredID'
        enable_in_slashid_oidc_authz_server:
          type: boolean
          description: Indicates whether these credentials can be used for SSO authentication during an OIDC flow in which SlashID acts as the Authorization Server.
        options:
          $ref: '#/components/schemas/OAuthProvidersOptions'
      required:
      - client_id
      - provider
    PersonPatchReq:
      type: object
      properties:
        active:
          type: boolean
          description: A flag indicating whether the person should be active or not
          example: true
      description: Structure to modify a person
    OAuth2ClientRefreshTokenDuration:
      description: How long (in seconds) refresh tokens should be valid for. If unspecified, this defaults to 10 days (864,000 seconds).
      type: integer
      example: 36000
    PersonFieldName:
      type: string
      enum:
      - handles
      - groups
      - attributes
    PutPersonRolesRequest:
      type: object
      properties:
        roles:
          type: array
          items:
            $ref: '#/components/schemas/RoleName'
      required:
      - roles
    ExternalCredID:
      description: External credential ID
      type: string
    GetGroupResponse:
      type: object
      properties:
        name:
          $ref: '#/components/schemas/GroupName'
        description:
          type: string
        members_count:
          type: integer
        created:
          type: string
          format: date-time
      required:
      - name
      - members_count
      - created
    PersonGroupsResponse:
      type: array
      items:
        $ref: '#/components/schemas/GroupName'
    OAuth2ClientPublic:
      description: 'Indicates if this client is marked as public. Public clients are unable to use registered client secrets, such as applications running in a browser or on a mobile device. Defaults to false.

        '
      type: boolean
      example: false
    Credential:
      type: object
      oneOf:
      - $ref: '#/components/schemas/PublicKeyCredential'
      - $ref: '#/components/schemas/PasswordCredential'
      - $ref: '#/components/schemas/TOTPCredential'
      discriminator:
        propertyName: type
        mapping:
          public-key: '#/components/schemas/PublicKeyCredential'
          password: '#/components/schemas/PasswordCredential'
          totp: '#/components/schemas/TOTPCredential'
    PatchExternalCredentialRequest:
      type: object
      properties:
        extcred_label:
          type: string
        json_blob:
          $ref: '#/components/schemas/ExternalCredentialContent'
    PricingTierConstraints:
      type: object
      description: 'Details of the constraints applied to a specific pricing tier.

        '
      required:
      - name
      - custom_templates_allowed
      - nhi_external_connections_allowed
      properties:
        name:
          $ref: '#/components/schemas/PricingTier'
        custom_templates_allowed:
          description: Indicates if custom email and SMS message templates are allowed
          type: boolean
        nhi_external_connections_allowed:
          description: Indicates if external connections to non-human identity sources are allowed
          type: boolean
        max_suborganizations:
          description: Indicates the maximum number of the suborganizations in the hierarchy, not including the root organization. `null` indicates no limit.
          type: integer
          format: int64
        max_persons:
          description: Indicates the maximum number of persons allowed, including all suborganizations in the hierarchy. `null` indicates no limit.
          type: integer
          format: int64
        max_groups:
          description: Indicates the maximum number of groups allowed, including all suborganizations in the hierarchy. `null` indicates no limit.
          type: integer
          format: int64
    PersonHandlesReq:
      type: array
      items:
        $ref: '#/components/schemas/PersonHandle'
    OrganizationResponse:
      allOf:
      - $ref: '#/components/schemas/Organization'
      - type: object
        required:
        - persons_pool_org_ids
        - group_pool_org_ids
        properties:
          parent_id:
            description: The ID of the parent organization.
            $ref: '#/components/schemas/OrganizationID'
          persons_pool_org_ids:
            description: The list of organizations or suborganizations that share user identities with this organization
            type: array
            items:
              $ref: '#/components/schemas/OrganizationID'
          group_pool_org_ids:
            description: The list of organizations or suborganizations that share user groups with this organization
            type: array
            items:
              $ref: '#/components/schemas/OrganizationID'
          inherits_rbac_pools:
            type: boolean
    PersonHandle:
      required:
      - type
      - value
      type: object
      properties:
        type:
          $ref: '#/components/schemas/PersonHandleType'
        value:
          type: string
          example: user@user.com
    TokenText:
      description: A JWT token. Can be either a User token (`UserTokenText`) or a Token Container (`TokenContainerText`)
      type: string
    PutPersonPermissionsRequest:
      type: object
      properties:
        permissions:
          type: array
          items:
            $ref: '#/components/schemas/PermissionName'
      required:
      - permissions
    PricingTier:
      type: string
      description: 'The tier associated with a root organization.


        Your organization may be subject to various constraints depending on its

        tier, such as maximum number of users, rate-limits, etc.

        '
      enum:
      - free-trial
      - professional
      - enterprise
      - enterprise-with-nhi
      - identity-protection
    PersonType:
      type: string
      enum:
      - regular
      - anonymous
    PostOAuth2TokenResponseRefreshToken:
      type: object
      required:
      - access_token
      - token_type
      - expires_in
      properties:
        access_token:
          type: string
        refresh_token:
          type: string
        id_token:
          type: string
        expires_in:
          type: integer
          description: Number of seconds until the token expires.
        scope:
          $ref: '#/components/schemas/OAuth2ScopesSpaceDelimited'
        token_type:
          $ref: '#/components/schemas/OAuth2AuthTokenType'
    PostOAuth2TokenResponseClientCredentials:
      type: object
      required:
      - access_token
      - token_type
      - expires_in
      properties:
        access_token:
          type: string
        expires_in:
          type: integer
          description: Number of seconds until the token expires.
        scope:
          $ref: '#/components/schemas/OAuth2ScopesSpaceDelimited'
        token_type:
          $ref: '#/components/schemas/OAuth2AuthTokenType'
    OAuth2ClientName:
      description: Human-friendly name to identify this client.
      type: string
      example: My Awesome Application
    ListRolesResponse:
      type: array
      items:
        $ref: '#/components/schemas/RoleName'
    OrganizationDomainPattern:
      type: string
    ListGroupsResponse:
      type: array
      items:
        $ref: '#/components/schemas/GroupName'
    OAuthCredentialPostRequest:
      type: object
      required:
      - client_id
      - client_secret
      - provider
      description: Request to create a new OAuth credential
      properties:
        client_id:
          $ref: '#/components/schemas/OAuthClientID'
        client_secret:
          type: string
        provider:
          $ref: '#/components/schemas/OAuthProvider'
        label:
          type: string
        external_cred:
          $ref: '#/components/schemas/ExternalCredID'
          deprecated: true
        external_cred_id:
          $ref: '#/components/schemas/ExternalCredID'
        enable_in_slashid_oidc_authz_server:
          type: boolean
          description: Indicates whether these credentials can be used for SSO authentication during an OIDC flow in which SlashID acts as the Authorization Server.
        options:
          $ref: '#/components/schemas/OAuthProvidersOptions'
    PersonsBulkImportResponse:
      type: object
      properties:
        successful_imports:
          description: Number of sucessfully imported persons.
          type: integer
        failed_imports:
          description: Number of persons that we failed to import.
          type: integer
        failed_csv:
          description: CSV containing the persons we failed to import and the reason behind the failure.
          type: string
      required:
      - successful_imports
      - failed_imports
    OAuth2TokenType:
      type: string
      enum:
      - access_token
      - refresh_token
      - authorize_code
      - id_token
    PersonsPutResponse:
      $ref: '#/components/schemas/PersonRet'
    OAuthBitbucketProviderOptions:
      type: object
      properties:
        authorize_scopes:
          type: array
          items:
            type: string
          default:
          - account
          description: 'The scopes of access granted by the access_token expressed as a list of space-delimited, case-sensitive strings.


            Read [Bitbucket''s documentation](https://developer.atlassian.com/cloud/bitbucket/rest/intro#scopes) to know more.


            Note: scope `account` is always requested.'
    FactorMethod:
      type: string
      description: Allowed login factor
      enum:
      - webauthn
      - email_link
      - sms_link
      - otp_via_sms
      - otp_via_email
      - totp
      - oidc
      - saml
      - api
      - direct_id
      - password
      - impersonate
      - anonymous
    PostRoleRequest:
      type: object
      properties:
        name:
          $ref: '#/components/schemas/RoleName'
        description:
          type: string
        permissions:
          type: array
          items:
            $ref: '#/components/schemas/PermissionName'
      required:
      - name
    APIPagination:
      type: object
      required:
      - limit
      - offset
      - total_count
      properties:
        limit:
          type: integer
        offset:
          type: integer
        total_count:
          type: integer
          format: int64
    ExportedTOTPCredential:
      type: object
      allOf:
      - $ref: '#/components/schemas/ExportedCredentialBase'
      - type: object
        properties:
          type:
            $ref: '#/components/schemas/CredentialType'
          params:
            $ref: '#/components/schemas/ExportedTOTPCredentialParams'
          label:
            type: string
        required:
        - type
        - params
    WebhookPatchResponse:
      $ref: '#/components/schemas/Webhook'
    OAuth2ClientAccessTokenDuration:
      description: 'How long (in seconds) access tokens should be valid for. If unspecified, this defaults to 24 hours (86,400 seconds). For OIDC flows, this value is also used as the ID token duration.

        '
      type: integer
      example: 3600
    RoleName:
      type: string
      pattern: ^[A-Za-z0-9]{1}[\w.\-:]*[A-Za-z0-9]$
      maxLength: 100
      description: "The Role name must be unique within your organization; is case-sensitive; and must conform to the following:\n  - must be at least 2 characters long\n  - may be at most 100 characters long\n  - may contain only the characters `A-Z a-z 0-9 - _ . :`\n  - must start and end with an alphanumeric character (`A-Z a-z 0-9`)\n\nRoles needs to have their name prefixed with `{org_id}/`.\nOrganization ID is not counted to the length limit.\n"
      example: 064b7b63-ea43-76e5-b208-1900795bc5b7/billing-viewer
    PutPersonGroupsReq:
      type: object
      properties:
        groups:
          type: array
          items:
            $ref: '#/components/schemas/GroupName'
    PatchRoleRequest:
      type: object
      properties:
        description:
          type: string
        permissions:
          type: array
          items:
            $ref: '#/components/schemas/PermissionName'
    SyncHookTrigger:
      type: object
      properties:
        trigger_type:
          $ref: '#/components/schemas/TriggerType'
        trigger_name:
          $ref: '#/components/schemas/SyncHookName'
      required:
      - trigger_type
      - trigger_name
    CredentialType:
      type: string
      description: The type of the credential
      enum:
      - public-key
      - password
      - totp
    PublicKeyCredential:
      type: object
      properties:
        type:
          $ref: '#/components/schemas/CredentialType'
        params:
          $ref: '#/components/schemas/PublicKeyCredentialParams'
        label:
          type: string
      required:
      - type
      - params
    OAuth2ClientWithSecret:
      allOf:
      - $ref: '#/components/schemas/OAuth2Client'
      - $ref: '#/components/schemas/OAuth2ClientSecretResponse'
    RevokeAllOAuth2TokensRequest:
      type: object
      required:
      - person_id
      properties:
        person_id:
          $ref: '#/components/schemas/PersonID'
        until:
          type: string
          format: date-time
    EventTrigger:
      type: object
      properties:
        trigger_type:
          $ref: '#/components/schemas/TriggerType'
        trigger_name:
          $ref: '#/components/schemas/EventName'
      required:
      - trigger_type
      - trigger_name
    OAuthClientUIConfiguration:
      type: object
      additionalProperties: true
      properties:
        dynamicFlowConfig:
          type: object
          description: Configuration for dynamic flow
          additionalProperties: true
        dynamicFlowEnabled:
          type: boolean
          description: Whether dynamic flow is enabled
        handleTypes:
          type: array
          description: The types of handles that can be used to authenticate
          items:
            type: string
        logoUrl:
          type: string
          description: The URL of the logo to display in the login form
        pageBackgroundColor:
          type: string
          description: The background color of the page
        showBadge:
          type: boolean
          description: Whether to show the SlashID badge
        storeLastFactor:
          type: boolean
          description: Whether to store the last factor used for authentication
        supportURL:
          type: string
          description: If set, the support link will be displayed in the error state
        alternativeAuthURL:
          type: string
          description: If set, the alternative auth link will be displayed in the self-registration-not-allowed error state
        faviconUrl:
          type: string
          description: The URL of the favicon to display in the browser tab
        pageTitle:
          type: string
          description: The title of the page
        themeVars:
          type: object
          description: The SlashID theme CSS variables
          additionalProperties:
            type: string
        textOverrides:
          type: object
          description: Text keys and overriden values
          additionalProperties:
            type: string
    PostOAuth2TokenResponseAuthorizationCode:
      type: object
      required:
      - access_token
      - token_type
      - expires_in
      properties:
        access_token:
          type: string
        refresh_token:
          type: string
        id_token:
          type: string
        expires_in:
          type: integer
          description: Number of seconds until the token expires.
        scope:
          $ref: '#/components/schemas/OAuth2ScopesSpaceDelimited'
        token_type:
          $ref: '#/components/schemas/OAuth2AuthTokenType'
    GetBucketedAttributesResp:
      $ref: '#/components/schemas/BucketedAttributes'
    ExportedCredentialBase:
      type: object
      properties:
        id:
          type: string
          description: The ID of the credential
        last_used:
          type: string
          format: date-time
          description: The time when the credential was last used to authenticate successfully
      required:
      - id
    Webhook:
      type: object
      allOf:
      - type: object
        properties:
          id:
            type: string
        required:
        - id
      - $ref: '#/components/schemas/WebhookConfiguration'
    APIMeta:
      type: object
      properties:
        pagination:
          $ref: '#/components/schemas/APIPagination'
        cursor_pagination:
          $ref: '#/components/schemas/APICursorPagination'
    GetAttributesResp:
      $ref: '#/components/schemas/Attributes'
    GroupName:
      type: string
      pattern: ^[A-Za-z0-9]{1}[\w\.\-]*[A-Za-z0-9]$
      maxLength: 100
    OAuthOktaProviderOptions:
      type: object
      properties:
        authorize_scopes:
          type: array
          items:
            type: string
          default:
          - openid
          - email
          - profile
          description: 'The scopes of access granted by the access_token expressed as a list of space-delimited, case-sensitive strings.


            Read [Okta''s documentation]https://help.okta.com/en-us/content/topics/apps/apps_app_integration_wizard_oidc.htm) to know more.


            Note: scopes `openid`, `email`, `profile` are always requested.'
        organization_url:
          type: string
          default: ''
          description: 'The organization URL for Okta.


            Read [Okta''s documentation](https://help.okta.com/en-us/content/topics/apps/apps_app_integration_wizard_oidc.htm) to know more.'
    OAuthGitlabProviderOptions:
      type: object
      properties:
        authorize_scopes:
          type: array
          items:
            type: string
          default:
          - read_user
          description: 'The scopes of access granted by the access_token expressed as a list of space-delimited, case-sensitive strings.


            Read [GitLab''s documentation](https://docs.gitlab.com/ee/integration/oauth_provider.html#view-all-authorized-applications) to know more.


            Note: scope `read_user` is always requested.'
    SsoOidcTokensQueryReq:
      required:
      - person_id
      type: object
      properties:
        person_id:
          $ref: '#/components/schemas/PersonID'
        authentication_ids:
          type: array
          description: 'The IDs of the SSO OIDC authentications that issued the OIDC tokens.

            If not provided, all OIDC tokens for this person matching the specified types will be returned.

            '
          items:
            type: string
        token_types:
          type: array
          description: 'The types of tokens to be returned.

            If not provided, all OIDC tokens for this person issued during the specified authentication(s) will be returned.

            '
          items:
            $ref: '#/components/schemas/OIDCTokenType'
    ExportedPublicKeyCredential:
      type: object
      allOf:
      - $ref: '#/components/schemas/ExportedCredentialBase'
      - $ref: '#/components/schemas/PublicKeyCredential'
    PermissionName:
      type: string
      pattern: ^[A-Za-z0-9]{1}[\w./\\\-:]*[A-Za-z0-9]$
      description: "The permission name must be unique within your organization; is case-sensitive; and must conform to the following:\n  - must be at least 2 characters long\n  - may be at most 1024 characters long\n  - may contain only the characters `A-Z a-z 0-9 - _ . : / \\`\n  - must start and end with an alphanumeric character (`A-Z a-z 0-9`)\n"
      example: billing.invoices.list
      maxLength: 1024
    OrganizationsPutAPIKeyResponse:
      type: object
      required:
      - api_key
      properties:
        api_key:
          type: string
    OAuthClientUIConfigurationPutRequest:
      $ref: '#/components/schemas/OAuthClientUIConfiguration'
    PersonRet:
      type: object
      properties:
        active:
          type: boolean
          description: A flag indicating whether the person is active or not
        person_id:
          type: string
          description: The ID of the person
        person_type:
          $ref: '#/components/schemas/PersonType'
        region:
          $ref: '#/components/schemas/Region'
        handles:
          $ref: '#/components/schemas/PersonHandlesResponse'
        groups:
          $ref: '#/components/schemas/PersonGroupsResponse'
        attributes:
          $ref: '#/components/schemas/BucketedAttributes'
      required:
      - active
      - person_id
      - person_type
      - region
      description: Abridged person structure
    PostPermissionRequest:
      type: object
      properties:
        name:
          $ref: '#/components/schemas/PermissionName'
        description:
          type: string
      required:
      - name
    ExternalProvider:
      type: string
      enum:
      - google
      - onfido
      - shopify
      - generic
    OAuth2Client:
      type: object
      required:
      - client_id
      - client_name
      - grant_types
      - response_types
      - scopes
      - public
      properties:
        client_id:
          $ref: '#/components/schemas/OAuth2ClientID'
        client_name:
          $ref: '#/components/schemas/OAuth2ClientName'
        grant_types:
          $ref: '#/components/schemas/OAuth2ClientGrantTypes'
        response_types:
          $ref: '#/components/schemas/OAuth2ClientResponseTypes'
        scopes:
          $ref: '#/components/schemas/OAuth2ClientScopes'
        access_token_duration:
          $ref: '#/components/schemas/OAuth2ClientAccessTokenDuration'
        refresh_token_duration:
          $ref: '#/components/schemas/OAuth2ClientRefreshTokenDuration'
        public:
          $ref: '#/components/schemas/OAuth2ClientPublic'
        redirect_uris:
          $ref: '#/components/schemas/OAuth2ClientRedirectURIs'
        created_at:
          type: string
          format: date-time
        last_used:
          type: string
          format: date-time
    OAuth2ClientRedirectURIs:
      description: The client's allowed redirect URIs.
      type: array
      items:
        type: string
        format: uri
      example:
      - https://example.com/redirect
    PasswordResetPostReq:
      type: object
      properties:
        force_change:
          type: boolean
          description: Delete the existing password for a person, forcing a new password to be set before the next password authentication.
        reset_handle:
          $ref: '#/components/schemas/PersonHandle'
    GDPRConsent:
      type: object
      required:
      - consent_level
      - created_at
      properties:
        consent_level:
          $ref: '#/components/schemas/GDPRConsentLevel'
        created_at:
          type: string
          format: date-time
          description: Time when this consent was first created for this person
    ValidateTokenResponse:
      type: object
      required:
      - valid
      properties:
        valid:
          description: True if token is genuine and has not expired yet, false otherwise.
          type: boolean
        invalidity_reason:
          description: If the token is invalid, this field contains the reason.
          type: string
          enum:
          - invalid_token_content
          - expired
          - invalid_issuer
          - not_enough_factors
          - person_not_active
        expires_in_seconds:
          description: JWT token validity. This value is not present if the token is not valid (valid field == false).
          type: integer
        expires_at:
          description: Token expiration time in UTC. This value is not present if token is not valid (valid field == false) or expired.
          type: string
          format: date-time
    RevokeOAuth2TokenRequest:
      type: object
      required:
      - token
      properties:
        token:
          type: string
        token_type_hint:
          $ref: '#/components/schemas/OAuth2TokenType'
    ExternalCredential:
      type: object
      required:
      - external_cred_id
      - organization_id
      - extcred_provider
      - extcred_type
      - extcred_label
      properties:
        external_cred_id:
          $ref: '#/components/schemas/ExternalCredID'
        organization_id:
          $ref: '#/components/schemas/OrganizationID'
        extcred_provider:
          $ref: '#/components/schemas/ExternalProvider'
        extcred_label:
          type: string
        extcred_type:
          $ref: '#/components/schemas/ExternalCredTypes'
        json_blob:
          $ref: '#/components/schemas/ExternalCredentialContent'
    PostOAuth2TokenRequest:
      oneOf:
      - $ref: '#/components/schemas/PostOAuth2TokenRequestClientCredentials'
      - $ref: '#/components/schemas/PostOAuth2TokenRequestAuthorizationCode'
      - $ref: '#/components/schemas/PostOAuth2TokenRequestRefreshToken'
      discriminator:
        propertyName: grant_type
        mapping:
          client_credentials: '#/components/schemas/PostOAuth2TokenRequestClientCredentials'
          authorization_code: '#/components/schemas/PostOAuth2TokenRequestAuthorizationCode'
          refresh_token: '#/components/schemas/PostOAuth2TokenRequestRefreshToken'
    TokenTemplate:
      description: Template for user tokens emitted on authentication.
      type: object
      properties:
        content:
          type: string
          description: The token claims [mustache](https://mustache.github.io/mustache.5.html) template. Must render to a valid JSON object.
          example: '{ "my_custom_org_name": "custom_prefix-{{ organization.name }}" }'
      required:
      - content
    ExportedCredential:
      oneOf:
      - $ref: '#/components/schemas/ExportedPublicKeyCredential'
      - $ref: '#/components/schemas/ExportedPasswordCredential'
      - $ref: '#/components/schemas/ExportedTOTPCredential'
      discriminator:
        propertyName: type
        mapping:
          public-key: '#/components/schemas/ExportedPublicKeyCredential'
          password: '#/components/schemas/ExportedPasswordCredential'
          totp: '#/components/schemas/ExportedTOTPCredential'
    OAuthFacebookProviderOptions:
      type: object
      properties:
        authorize_scopes:
          type: array
          items:
            type: string
          default:
          - email
          - public_profile
          description: 'The scopes of access granted by the access_token expressed as a list of space-delimited, case-sensitive strings.


            Read [Facebook''s documentation](https://developers.facebook.com/docs/permissions/reference) to know more.


            Note: scopes `email` and `public_profile` are always requested.'
    GDPRConsentLevel:
      type: string
      enum:
      - none
      - necessary
      - analytics
      - marketing
      - retargeting
      - tracking
    SAMLProviderCredentialsGetResponse:
      $ref: '#/components/schemas/SAMLProviderCredentials'
    GDPRConsentRequest:
      type: object
      required:
      - consent_levels
      properties:
        consent_levels:
          type: array
          items:
            $ref: '#/components/schemas/GDPRConsentLevel'
    PostRBACCheckResp:
      type: object
      properties:
        granted:
          type: boolean
      required:
      - granted
    DirectID:
      $ref: '#/components/schemas/Bytes'
    RevokeTokenReq:
      required:
      - token
      type: object
      properties:
        token:
          $ref: '#/components/schemas/TokenText'
    PersonHandleType:
      type: string
      enum:
      - email_address
      - phone_number
      - username
      example: email_address
    OAuthAppleProviderOptions:
      type: object
      description: See https://developer.apple.com/documentation/accountorganizationaldatasharing/creating-a-client-secret
      required:
      - private_key
      - team_id
      - key_id
      - secret_lifetime
      properties:
        authorize_scopes:
          type: array
          items:
            type: string
          default:
          - openid
          - email
          - name
          description: 'The scopes of access granted by the access_token expressed as a list of space-delimited, case-sensitive strings.


            Note: scopes `openid`, `email`, `name` are always requested.'
        private_key:
          type: string
          description: An ES256 private key downloaded from your Apple developer account in PKCS8 format.
        team_id:
          type: string
          description: The 10-character Team ID associated with your Apple developer account. This will be used as the issuer claim in client secret JWTs.
        key_id:
          type: string
          description: A 10-character key identifier generated for the Account and Organizational Data Sharing private key associated with your developer account.
        secret_lifetime:
          type: string
          description: 'The lifetime of each generated client secret. The value provided should be a string that can be parsed as a [Golang `time.Duration`](https://pkg.go.dev/time#Duration); for example, "1m" (one minute), "24h" (24 hours). The lifetime may not be less than 5 minutes (300 seconds), and may not be more than 15,777,000 seconds (6 months). If not set, defaults to 30 days.

            '
    OAuth2ClientID:
      description: The client identifier.
      type: string
      example: b9a747fb-150e-44e5-b2d6-afa69e671853
    PutAttributesReq:
      $ref: '#/components/schemas/Attributes'
    GetPermissionResponse:
      type: object
      properties:
        name:
          $ref: '#/components/schemas/PermissionName'
        description:
          type: string
        created:
          type: string
          format: date-time
      required:
      - name
      - created
    PersonPermissionsResponse:
      type: array
      items:
        $ref: '#/components/schemas/PermissionName'
    SAMLProviderCredentialsPostRequest:
      type: object
      description: Request to create a new SAML provider credential
      properties:
        label:
          description: A friendly free-form label to help you identify this set of SAML provider credentials.
          type: string
        idp_metadata_url:
          description: The SAML IdP's metadata URL.
          type: string
        email_claims:
          description: The names of the claims in the SAML response containing the users' email addresses. The first match is added to the person's set of handles.
          type: array
          items:
            type: string
          maxItems: 3
        enable_in_slashid_oidc_authz_server:
          type: boolean
          description: Indicates whether these credentials can be used for SSO authentication during an OIDC flow in which SlashID acts as the Authorization Server.
      required:
      - idp_metadata_url
    PersonsBulkImportRequest:
      type: object
      properties:
        persons:
          description: File in CSV format that contains the persons to import.
          type: string
          format: binary
      required:
      - persons
    OAuthClientID:
      type: string
    OrganizationConfig:
      type: object
      description: Configuration values for an organization. Note that some values are read-only.
      properties:
        pricing_tier:
          $ref: '#/components/schemas/PricingTier'
        from_email:
          type: string
          description: 'The email address from which authentication emails are sent.


            Empty means SlashID''s default e-mail address will be used.


            This is set during onboarding.

            '
        from_phone_number_sms:
          type: string
          description: 'The phone number from which authentication SMS messages are sent.


            Empty means SlashID''s default phone numbers will be used.


            This is set during onboarding.

            '
        token_duration:
          type: integer
          description: The number of seconds before a token expires.
        groups_claim_name:
          type: string
          description: The name of the JWT claim holding the list of groups for the authenticated user identified in the token.
          example: dev.slashid.groups
        requires_manual_approval:
          type: boolean
          description: If true, new users are deactivated until the organization admin sets the person's `active` field.
        deny_self_registration:
          type: boolean
          description: If true, new users can only be created by the organization admin
        allowed_factor_methods:
          type: array
          description: 'Only allow authentication using the specified factor methods.


            Empty means all supported factors are enabled.


            This configuration doesn''t affect API and DirectID authentications.

            '
          example:
          - sms_link
          - email_link
          - webauthn
          items:
            $ref: '#/components/schemas/FactorMethod'
        authn_link_allowed_redirect_uris:
          type: array
          maxItems: 8
          description: 'The URIs to which users can be redirected after authenticating with an email/SMS link.


            It can''t be an IP, nor contain query parameters or fragments. We advise that it''s an

            HTTPS URI but we don''t require it. Custom schemes are allowed.

            '
          example:
          - https://slashid.com
          - http://localhost:8080/a-path
          - com.slashid://example
          items:
            type: string
        new_person_handle_patterns:
          type: array
          description: Only allow registration of new persons with a handle matching one of the patterns.
          example:
          - '*@example.com'
          - +1*
          items:
            $ref: '#/components/schemas/GlobPattern'
        sudo_mode_duration:
          type: integer
          description: The number of seconds, after users authenticate, during which they can perform sensitive actions.
        authn_redirect_page_ui_config:
          $ref: '#/components/schemas/AuthnRedirectPageUIConfig'
        canonical_identity_ai_matching_enabled:
          type: boolean
          description: 'If true (default), uses AI-based matching for canonical identities which provides

            higher accuracy through fuzzy matching and semantic analysis.

            If false, uses deterministic field-level matching based on exact email/identifier matches,

            which may result in more missed matches and require more manual management.

            '
          default: true
      required:
      - from_email
      - from_phone_number_sms
      - token_duration
      - groups_claim_name
      - requires_manual_approval
      - deny_self_registration
      - allowed_factor_methods
      - authn_link_allowed_redirect_uris
      - new_person_handle_patterns
      - sudo_mode_duration
    PostOAuth2TokenRequestAuthorizationCode:
      type: object
      required:
      - grant_type
      - code
      - redirect_uri
      - client_id
      properties:
        grant_type:
          $ref: '#/components/schemas/OAuth2GrantType'
        code:
          type: string
        redirect_uri:
          type: string
        client_id:
          $ref: '#/components/schemas/OAuth2ClientID'
        client_secret:
          $ref: '#/components/schemas/OAuth2ClientSecret'
        code_challenge:
          type: string
    Region:
      type: string
      enum:
      - us-iowa
      - europe-belgium
      - asia-japan
      - europe-england
      - australia-sydney
    PersonHandlesResponse:
      type: array
      items:
        $ref: '#/components/schemas/PersonHandle'
    GDPRConsentResponse:
      type: object
      required:
      - consents
      properties:
        consents:
          type: array
          items:
            $ref: '#/components/schemas/GDPRConsent'
    BucketedAttributes:
      type: object
      description: 'Attributes divided into named buckets. Bucket names are top level keys; attributes are values. Attributes consist of key-value pairs. Attribute names (keys) may be at most 70 bytes long. Attribute values must be JSON-serializable and are limited to 64KiB.

        '
      additionalProperties:
        $ref: '#/components/schemas/Attributes'
      example:
        person_pool-end_user_read_write:
          card_number: '1234'
          expiry: 07/25
        end_user_read_only:
          address_line_1: New Street
          city: New York
    OAuth2ClientGrantTypes:
      description: The client's allowed grant types.
      type: array
      items:
        $ref: '#/components/schemas/OAuth2GrantType'
      example:
      - client_credentials
      - authorization_code
    AttributeBucket:
      type: object
      description: An attribute bucket with access settings
      required:
      - name
      - sharing_scope
      - end_user_permissions
      properties:
        name:
          type: string
          description: The name of the attribute bucket
        sharing_scope:
          $ref: '#/components/schemas/AttributeSharingScope'
        owner_organization_id:
          $ref: '#/components/schemas/OrganizationID'
        end_user_permissions:
          $ref: '#/components/schemas/AttributePermissions'
    OAuthTokenRevokeReq:
      required:
      - client_id
      - token
      - token_type
      type: object
      properties:
        client_id:
          description: The client ID originally used to obtain the token from the IdP
          type: string
        token:
          description: The token to be revoked
          type: string
        token_type:
          description: The type of token being revoked, either access or refresh
          type: string
          enum:
          - access_token
          - refresh_token
    WebhookConfiguration:
      type: object
      properties:
        name:
          type: string
          description: 'Human-readable name for this webhook. This does not need to be unique, but it is recommended that you choose a name that can be used to distinguish this webhook from others.

            '
        description:
          type: string
          description: 'A description of this webhook. This can be used to associate additional information with this webhook for future reference.

            '
        target_url:
          type: string
          description: 'The target URL for this webhook. This URL must include the protocol, and the protocol must be HTTPS. A target URL can be registered at most once per organization, but each target URL can have multiple triggers.

            '
        custom_headers:
          type: object
          additionalProperties:
            type: array
            items:
              type: string
          description: 'A set of custom HTTP headers that will be included in requests to this webhook, provided as key-value pairs.

            '
        timeout:
          type: string
          description: The timeout that will be applied when calling this webhook.
      required:
      - name
      - target_url
    SAMLProviderCredentialsPatchRequest:
      type: object
      description: Request to modify an existing SAML provider credential
      properties:
        label:
          description: A friendly free-form label to help you identify this set of SAML provider credentials.
          type: string
        idp_metadata_url:
          description: The SAML IdP's metadata URL.
          type: string
        email_claims:
          description: The names of the claims in the SAML response containing the users' email addresses. The first match is added to the person's set of handles.
          type: array
          items:
            type: string
          maxItems: 3
        enable_in_slashid_oidc_authz_server:
          type: boolean
          description: Indicates whether these credentials can be used for SSO authentication during an OIDC flow in which SlashID acts as the Authorization Server.
    AuthnRedirectPageUIConfig:
      type: object
      additionalProperties: true
      description: UI configuration for the hosted page users are redirected to after clicking a magic link or password reset link.
    ExternalCredentialPostRequest:
      type: object
      description: Request to create a new external credential
      required:
      - extcred_provider
      - json_blob
      - extcred_type
      properties:
        extcred_provider:
          $ref: '#/components/schemas/ExternalProvider'
        extcred_type:
          $ref: '#/components/schemas/ExternalCredTypes'
        extcred_label:
          type: string
        json_blob:
          $ref: '#/components/schemas/ExternalCredentialContent'
    PersonID:
      type: string
      description: Person ID
      example: 064b7b63-ea43-76e5-b208-1900795bc5b7
    Organization:
      type: object
      properties:
        id:
          $ref: '#/components/schemas/OrganizationID'
        parent_id:
          $ref: '#/components/schemas/OrganizationID'
        org_name:
          type: string
        tenant_name:
          type: string
      required:
      - id
      - org_name
      - tenant_name
    TriggerType:
      type: string
      enum:
      - event
      - sync_hook
    OrganizationDomainsPatchRequest:
      type: object
      properties:
        domains:
          type: array
          description: List of domain patterns
          items:
            $ref: '#/components/schemas/OrganizationDomainPattern'
      example:
        domains:
        - ok.com
        - '*.ok.com'
        - my?site.org
        - a[0-9].my?site.org
    Bytes:
      type: string
    IntrospectOAuth2TokenRequest:
      type: object
      required:
      - token
      properties:
        token:
          type: string
        token_type_hint:
          $ref: '#/components/schemas/OAuth2TokenType'
        scope:
          $ref: '#/components/schemas/OAuth2ScopesSpaceDelimited'
    PersonsPostResponse:
      $ref: '#/components/schemas/PersonRet'
    SAMLProviderCredentials:
      type: object
      description: A SAML provider credential
      properties:
        id:
          $ref: '#/components/schemas/SAMLProviderCredentialsID'
        label:
          description: A friendly free-form label to help you identify this set of SAML provider credentials.
          type: string
        idp_metadata_url:
          description: The SAML IdP's metadata URL.
          type: string
        email_claims:
          description: The names of the claims in the SAML response containing the users' email addresses. The first match is added to the person's set of handles.
          type: array
          items:
            type: string
          maxItems: 3
        enable_in_slashid_oidc_authz_server:
          type: boolean
          description: Indicates whether these credentials can be used for SSO authentication during an OIDC flow in which SlashID acts as the Authorization Server.
      required:
      - id
      - idp_metadata_url
    TOTPCredentialParams:
      type: object
      required:
      - key_uri
      - recovery_codes_total
      - unused_recovery_codes
      properties:
        key_uri:
          type: string
          description: "The TOTP key URI of the authenticator you wish to import, in Google Authenticator / Yubico format:\n```\notpauth://totp/[Issuer]:[Account name]?secret=[Secret key]&issuer=[Issuer]&algorithm=[Algorithm]&digits=[Digits number]&period=[Period in seconds]\n```\nwhere:\n  - `Issuer`: a string value indicating the provider or service this account is associated with, URL-encoded according to RFC 3986. When users register TOTP authenticators with SlashID this value is the Organization name. It is **strongly recommended** that the same value is used in both the `Account name` prefix and in the `issuer` parameter to maximize compatibility across different authenticator apps/devices.\n  - `Account name`: a string value usually diplayed by authenticators to end users to help them distinguish between their TOTP keys. When users register TOTP authenticators with SlashID this value is the handle (e-mail address or phone number) the user authenticated with when they registered the TOTP credential.\n  - `Secret key`: an arbitrary key value encoded in Base32 according to RFC 3548. The padding specified in RFC 3548 section 2.2 is not required and should be omitted.\n  - `Algorithm` (optional): the hashing algorithm to use. Valid values are `SHA1`, `SHA256`, `SHA512`. Defaults to `SHA1`.\n  - `Digits number` (optional): determines the length of the one-time passcode displayed to the user. Valid values are `6`, `8`. Defaults to `6`.\n  - `Period in seconds` (optional): defines the period that a TOTP code will be valid for, in seconds. Defaults to `30`.\n\nAn example with all optional parameters supplied:\n```\notpauth://totp/ACME%20Co:john.doe@email.com?secret=HXDMVJECJJWSRB3HWIZR4IFUGFTMXBOZ&issuer=ACME%20Co&algorithm=SHA1&digits=6&period=30\n```\n"
          example: otpauth://totp/ACME%20Co:john.doe@email.com?secret=HXDMVJECJJWSRB3HWIZR4IFUGFTMXBOZ&issuer=ACME%20Co&algorithm=SHA1&digits=6&period=30
        recovery_codes_total:
          type: integer
          minimum: 0
          description: The total number of recovery codes originally issued to the given person.
        unused_recovery_codes:
          type: array
          items:
            type: string
          description: The list of recovery codes the given person can still use in the future in place of TOTP codes. Once imported these codes will be treated as single-use.
    OAuthGithubProviderOptions:
      type: object
      properties:
        authorize_scopes:
          type: array
          items:
            type: string
          default:
          - read:user
          - user:email
          description: 'The scopes of access granted by the access_token expressed as a list of space-delimited, case-sensitive strings.


            Read [GitHub''s documentation](https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps) to know more.


            Note: scopes `read:user` and `user:email` are always requested.'
    OrganizationDetails:
      allOf:
      - $ref: '#/components/schemas/Organization'
      - type: object
        properties:
          managed_organizations:
            type: array
            items:
              $ref: '#/components/schemas/Organization'
    PostOAuth2TokenRequestRefreshToken:
      type: object
      required:
      - grant_type
      - refresh_token
      properties:
        grant_type:
          $ref: '#/components/schemas/OAuth2GrantType'
        refresh_token:
          type: string
        scope:
          $ref: '#/components/schemas/OAuth2ScopesSpaceDelimited'
    OAuthLineProviderOptions:
      type: object
      properties:
        authorize_scopes:
          type: array
          items:
            type: string
          default:
          - openid
          - email
          - profile
          description: 'The scopes of access granted by the access_token expressed as a list of space-delimited, case-sensitive strings.


            Read [Line''s documentation](https://developers.line.biz/en/docs/line-login/integrate-line-login/#scopes) to know more.


            Note: scopes `openid`, `email`, and `profile` are always requested.'
    UserinfoOAuth2Response:
      type: object
      required:
      - sub
      - iss
      - aud
      - org_id
      properties:
        sub:
          type: string
          description: The subject granted to the token, as a person ID.
        iss:
          type: string
          description: The access token issuer.
        aud:
          type: string
          description: The audience granted to th token, that is, the OAuth2 client ID.
        org_id:
          type: string
          description: The SlashID organization ID granted to the token.
        email:
          type: string
          description: The email address of the person. Only present if the authorization request included scope `email`.
        email_verified:
          type: boolean
          description: Is `true` if the ownership of the email address was verified. `false` otherwise.
        phone_number:
          type: string
          description: The phone number of the person. Only present if the authorization request included scope `phone`.
        phone_number_verified:
          type: boolean
          description: Is `true` if the ownership of the phone number was verified. `false` otherwise.
        username:
          type: string
          description: The username of the person. Only present if the authorization request included scope `username`.
    PersonCreateReq:
      allOf:
      - $ref: '#/components/schemas/PersonPatchReq'
      - type: object
        properties:
          attributes:
            $ref: '#/components/schemas/BucketedAttributes'
          handles:
            type: array
            description: the list of handles for the user
            items:
              $ref: '#/components/schemas/PersonHandle'
          groups:
            type: array
            description: A list of group names to assign the person to. Previous groups are overwritten. Groups must already exist.
            items:
              $ref: '#/components/schemas/GroupName'
          region:
            $ref: '#/components/schemas/Region'
          credentials:
            type: array
            items:
              $ref: '#/components/schemas/Credential'
        description: Structure to create a person
    SsoOidcTokenDetail:
      type: object
      properties:
        token:
          type: string
          description: OIDC token value
        token_type:
          $ref: '#/components/schemas/OIDCTokenType'
        expiry:
          type: string
          format: date-time
          description: Token expiry date
        provider:
          $ref: '#/components/schemas/OAuthProvider'
        client_id:
          type: string
          description: The client ID used to obtain the token
        authentication_id:
          type: string
          description: Authentication ID
        person_id:
          $ref: '#/components/schemas/PersonID'
        organization_id:
          $ref: '#/components/schemas/OrganizationID'
        extra_callback_values:
          description: 'Set of additional key-value pairs passed by the provider on callback, together with the authorization code.

            '
          type: object
          additionalProperties: true
      required:
      - token
      - token_type
      - expiry
      - provider
      - client_id
      - authentication_id
      - person_id
      - organization_id
    OAuth2ClientScopes:
      description: The scopes this client is allowed to request.
      type: array
      items:
        $ref: '#/components/schemas/OAuth2Scope'
      example:
      - admin
      - user
    PostOAuth2ClientRequest:
      type: object
      required:
      - client_name
      - scopes
      - grant_types
      properties:
        client_name:
          $ref: '#/components/schemas/OAuth2ClientName'
        scopes:
          $ref: '#/components/schemas/OAuth2ClientScopes'
        grant_types:
          $ref: '#/components/schemas/OAuth2ClientGrantTypes'
        access_token_duration:
          $ref: '#/components/schemas/OAuth2ClientAccessTokenDuration'
        refresh_token_duration:
          $ref: '#/components/schemas/OAuth2ClientRefreshTokenDuration'
        redirect_uris:
          $ref: '#/components/schemas/OAuth2ClientRedirectURIs'
        public:
          $ref: '#/components/schemas/OAuth2ClientPublic'
    OIDCTokenType:
      type: string
      enum:
      - access
      - refresh
      - id
    SsoOidcTokensGetResponse:
      type: array
      items:
        $ref: '#/components/schemas/SsoOidcTokenDetail'
    UserTokenText:
      type: string
    PostOAuth2TokenRequestClientCredentials:
      type: object
      required:
      - grant_type
      properties:
        scope:
          $ref: '#/components/schemas/OAuth2ScopesSpaceDelimited'
        grant_type:
          $ref: '#/components/schemas/OAuth2GrantType'
    OAuthGoogleProviderOptions:
      type: object
      properties:
        authorize_scopes:
          type: array
          items:
            type: string
          default:
          - openid
          - email
          - profile
          description: 'The scopes of access granted by the access_token expressed as a list of space-delimited, case-sensitive strings.


            Read [Google''s documentation](https://developers.google.com/identity/protocols/oauth2/scopes) to know more.


            Note: scopes `openid`, `email`, and `profile` are always requested.'
    PasswordCredential:
      type: object
      properties:
        type:
          $ref: '#/components/schemas/CredentialType'
        params:
          $ref: '#/components/schemas/PasswordCredentialParams'
        label:
          type: string
      required:
      - type
      - params
    PatchOAuth2ClientRequest:
      type: object
      properties:
        client_name:
          $ref: '#/components/schemas/OAuth2ClientName'
        grant_types:
          $ref: '#/components/schemas/OAuth2ClientGrantTypes'
        scopes:
          $ref: '#/components/schemas/OAuth2ClientScopes'
        access_token_duration:
          $ref: '#/components/schemas/OAuth2ClientAccessTokenDuration'
        refresh_token_duration:
          $ref: '#/components/schemas/OAuth2ClientRefreshTokenDuration'
        redirect_uris:
          $ref: '#/components/schemas/OAuth2ClientRedirectURIs'
    OrganizationKYCConfigPatchRequest:
      $ref: '#/components/schemas/OrganizationKYCConfig'
    EventName:
      type: string
      enum:
      - AuthenticationSucceeded_v1
      - AuthenticationFailed_v1
      - PersonCreated_v1
      - AnonymousPersonCreated_v1
      - PersonDeleted_v1
      - VirtualPageLoaded_v1
      - SlashIDSDKLoaded_v1
      - PersonIdentified_v1
      - PersonLoggedOut_v1
      - TokenMinted_v1
      - AnonymousTokenMinted_v1
      - PasswordChanged_v1
      - GdprConsentsChanged_v1
      - GateServerStarted_v1
      - GateRequestHandled_v1
      - GateRequestCredentialFound_v1
      - PermissionCreated_InRegion_v1
      - PermissionCreated_v1
      - PermissionDeleted_InRegion_v1
      - PermissionDeleted_v1
      - RoleCreated_InRegion_v1
      - RoleCreated_v1
      - RoleDeleted_InRegion_v1
      - RoleDeleted_v1
      - RoleUpdated_InRegion_v1
      - RoleUpdated_v1
      - RolesSetToPerson_InRegion_v1
      - RolesSetToPerson_v1
      - PermissionsSetToPerson_InRegion_v1
      - PermissionsSetToPerson_v1
      - MitmAttackDetected_v1
      - PermissionUpdated_InRegion_v1
      - PermissionUpdated_v1
      - SuborganizationCreated_InRegion_v1
      - SuborganizationCreated_v1
      - OAuth2ClientCreated_InRegion_v1
      - OAuth2ClientCreated_v1
      - AWSIAMUserCreated_v1
      - AWSIAMRoleCreated_v1
      - AWSIAMRoleInlinePoliciesUpdated_v1
      - AWSIAMRoleManagedPoliciesUpdated_v1
      - AWSIAMRoleAssumeRolePolicyUpdated_v1
      - AWSIAMRolePermissionsBoundaryUpdated_v1
      - AWSIAMRoleDeleted_v1
      - GCPServiceAccountCreated_v1
      - GCPRoleCreated_v1
      - GCPIAMPolicyBindingUpdated_v1
      - GCPServiceAccountDeleted_v1
      - ActiveDirectorySPNCreated_v1
      - ActiveDirectorySPNRoleUpdated_v1
      - ActiveDirectorySPNDeleted_v1
      - ActiveDirectoryUserCreated_v1
    GlobPattern:
      type: string
      description: A glob pattern
      example: '*@example.com'
    WebhookTrigger:
      oneOf:
      - $ref: '#/components/schemas/EventTrigger'
      - $ref: '#/components/schemas/SyncHookTrigger'
      discriminator:
        propertyName: trigger_type
        mapping:
          event: '#/components/schemas/EventTrigger'
          sync_hook: '#/components/schemas/SyncHookTrigger'
    OAuth2ClientSecret:
      description: The client secret key.
      type: string
      example: LQZzYPf8h/7Tpf9I+lCSulcOYMo=
    ListPermissionsResponse:
      type: array
      items:
        $ref: '#/components/schemas/PermissionName'
    PostGroupPersonsReq:
      type: object
      properties:
        persons:
          type: array
          description: List of person IDs to add to the group
          items:
            $ref: '#/components/schemas/PersonID'
      required:
      - persons
    TOTPCredential:
      type: object
      properties:
        type:
          $ref: '#/components/schemas/CredentialType'
        params:
          $ref: '#/components/schemas/TOTPCredentialParams'
        label:
          type: string
      required:
      - type
      - params
    PostOAuth2TokenResponse:
      oneOf:
      - $ref: '#/components/schemas/PostOAuth2TokenResponseClientCredentials'
      - $ref: '#/components/schemas/PostOAuth2TokenResponseAuthorizationCode'
      - $ref: '#/components/schemas/PostOAuth2TokenResponseRefreshToken'
    OAuthAzureADProviderOptions:
      type: object
      properties:
        authorize_scopes:
          type: array
          items:
            type: string
          default:
          - openid
          - email
          - profile
          - User.Read
          description: 'The scopes of access granted by the access_token expressed as a list of space-delimited, case-sensitive strings.


            Read [Azure AD''s documentation](https://learn.microsoft.com/en-us/graph/permissions-reference) to know more.


            Note: scopes `openid`, `email`, `profile`, and `User.Read` are always requested.'
        tenant:
          type: string
          default: common
          description: 'The tenant ID of the Azure AD tenant (a GUID), its tenant domain, or one of the pseudo tenants: `common`, `organizations` or `consumer`.


            Read [Azure AD''s documentation](https://learn.microsoft.com/en-us/azure/active-directory/develop/msal-client-application-configuration#authority) to know more.'
    OrganizationCreateResponse:
      allOf:
      - $ref: '#/components/schemas/Organization'
      - type: object
        required:
        - api_key
        properties:
          api_key:
            $ref: '#/components/schemas/Bytes'
    WebhookPostRequest:
      $ref: '#/components/schemas/WebhookConfiguration'
    OAuthClientUIConfigurationGetResponse:
      $ref: '#/components/schemas/OAuthClientUIConfiguration'
    OAuth2Scope:
      description: OAuth2 scope
      type: string
      example:
      - admin
    Attributes:
      type: object
      additionalProperties: true
      description: 'Clear-text person attributes as key-value pairs. Attribute names (keys) may be at most 70 bytes long. Attribute values must be JSON-serializable and are limited to 64KiB.

        '
      example:
        attr1: value1
        attr2: 2
        attr3: true
        attr_4:
        - 1
        - 2
        - 3
        - 4
        attr_5:
          nested: 5
    TemplateName:
      description: "Identifier for an e-mail/SMS message template\n\nThe following templates are available for customization:\n  - `email_authn_challenge`: E-mail template with magic link;\n  - `email_otp_message`: E-mail template with OTP code;\n  - `text_authn_challenge`: SMS template with magic link;\n  - `text_otp_message`: SMS template with OTP code;"
      type: string
      enum:
      - email_authn_challenge
      - email_otp_message
      - text_authn_challenge
      - text_otp_message
      - email_password_reset
      - email_password_change_notify
      - text_password_reset
      - text_password_change_notify
    PatchAttributesReq:
      $ref: '#/components/schemas/Attributes'
    OAuth2ClientResponseTypes:
      description: The client's allowed response types. All allowed combinations of response types have to be listed.
      type: array
      items:
        type: array
        items:
          $ref: '#/components/schemas/OAuth2ResponseType'
      example:
      - - code
      - - token
      - - code
        - token
    SsoOidcTokensRevokeV2Req:
      required:
      - person_id
      - authentication_id
      type: object
      properties:
        person_id:
          $ref: '#/components/schemas/PersonID'
        authentication_id:
          type: string
          description: 'The ID of the SSO OIDC authentication that issued the OIDC token(s) to be revoked.

            '
        token_types:
          type: array
          description: 'The type of OIDC token being revoked.

            If not provided, all OIDC tokens matching the provided authentication ID will be revoked.

            '
          items:
            $ref: '#/components/schemas/OIDCTokenType'
    PostGroupReq:
      type: object
      properties:
        name:
          $ref: '#/components/schemas/GroupName'
        description:
          type: string
      required:
      - name
    OAuth2ResponseType:
      type: string
      enum:
      - code
      - id_token
      - token
    PatchPermissionRequest:
      type: object
      properties:
        description:
          type: string
    SAMLProviderCredentialsID:
      type: string
    OrganizationConfigPatchRequest:
      type: object
      description: Request for updating organization configuration values.
      properties:
        token_duration:
          type: integer
          description: The number of seconds before a token expires
        groups_claim_name:
          type: string
          description: The name of the JWT claim holding the list of groups for the authenticated user identified in the token
          example: dev.slashid.groups
        requires_manual_approval:
          type: boolean
          description: If true, new users are deactivated until the organization admin sets the person's `active` field.
        deny_self_registration:
          type: boolean
          description: If true, new users can only be created by the organization admin
        allowed_factor_methods:
          type: array
          description: 'Only allow authentication using the specified factor methods.


            Empty means all supported factors are enabled.


            This configuration doesn''t affect API and DirectID authentications.

            '
          example:
          - sms_link
          - email_link
          - webauthn
          items:
            $ref: '#/components/schemas/FactorMethod'
        authn_link_allowed_redirect_uris:
          type: array
          description: 'The URIs to where users can be redirected after authenticating with an email/SMS link.

            '
          items:
            type: string
        new_person_handle_patterns:
          type: array
          description: Only allow registration of new persons with a handle matching one of the patterns
          example:
          - '*@example.com'
          - +1*
          items:
            $ref: '#/components/schemas/GlobPattern'
        sudo_mode_duration:
          type: integer
          description: The number of seconds, after users authenticate, during which they can perform sensitive actions. Negative values will revert this property to its default (15 minutes).
        authn_redirect_page_ui_config:
          $ref: '#/components/schemas/AuthnRedirectPageUIConfig'
        canonical_identity_ai_matching_enabled:
          type: boolean
          description: 'Enable or disable AI-based canonical identity matching.

            When disabled, falls back to deterministic field-level matching.

            '
    PersonRolesResponse:
      type: array
      items:
        $ref: '#/components/schemas/RoleName'
    SsoOidcTokensQueryResp:
      type: array
      items:
        $ref: '#/components/schemas/SsoOidcTokenDetail'
    OAuth2GrantType:
      type: string
      enum:
      - client_credentials
      - authorization_code
      - refresh_token
    PostMintTokenRequest:
      type: object
      properties:
        custom_claims:
          description: 'Set of custom claims to be added to the JWT payload, as key-value pairs.

            '
          type: object
          additionalProperties: true
          example:
            custom_attribute_1: 42
            custom_attribute_2:
              sub_attr: 24
    WebhookPatchRequest:
      type: object
      properties:
        name:
          type: string
          description: 'Human-readable name for this webhook. This does not need to be unique, but it is recommended that you choose a name that can be used to distinguish this webhook from others.

            '
        description:
          type: string
          description: 'A description of this webhook. This can be used to associate additional information with this webhook for future reference.

            '
        target_url:
          type: string
          description: 'The target URL for this webhook. This URL must include the protocol, and the protocol must be HTTPS. A target URL can be registered at most once per organization, but each target URL can have multiple triggers.

            '
        custom_headers:
          type: object
          additionalProperties:
            type: array
            items:
              type: string
          description: 'A set of custom HTTP headers that will be included in requests to this webhook, provided as key-value pairs. If set, will overwrite existing custom headers.

            '
        timeout:
          type: string
          description: The timeout that will be applied when calling this webhook.
    MessageTemplate:
      description: Template for E-mail or SMS messages. Empty fields fall back to default value.
      type: object
      properties:
        sender_name:
          type: string
          description: Sender name (not address). Must be empty for SMS templates.
          example: SlashID
        subject:
          type: string
          description: E-mail subject. Must be empty for SMS templates.
          example: Confirm Your Login with SlashID
        body:
          type: string
          description: Message body. Must be HTML for e-mail templates and plain text for SMS
          example: Your security code is {{otp_code}}
  parameters:
    GroupNamePathParam:
      in: path
      required: true
      name: group_name
      schema:
        $ref: '#/components/schemas/GroupName'
      description: The name of a group
    GetPersonsPersonIdOrganizationsFilterQueryParam:
      in: query
      name: filter
      schema:
        type: string
      description: A filter to be applied to the result list, using the [SCIM 2.0 Filter syntax](https://www.rfc-editor.org/rfc/rfc7644#section-3.4.2.2).
      examples:
        permission_write:
          summary: Returns only persons with 'write' permission.
          value: permission eq "write"
    RedirectURIQueryParam:
      in: query
      name: redirect_uri
      schema:
        type: string
      required: true
    LimitQueryParam:
      in: query
      name: limit
      schema:
        type: integer
        maximum: 1000
      description: The maximum number of items to return in the result. Maximum value is 1000.
    IfMatchHeader:
      name: If-Match
      in: header
      description: 'The value of the `ETag` header from the GET response. If the value of the `ETag` header from the last response does not match the value of this header, the server will respond with a `412 Precondition Failed` status code. If-Match is not required. If omitted, the server will not check the `ETag` header.

        '
      schema:
        type: string
    OffsetQueryParam:
      in: query
      name: offset
      schema:
        type: integer
      description: The number of the first item to be returned in the result
    MaxAgeQueryParam:
      in: query
      name: max_age
      schema:
        type: integer
        format: int32
      required: false
    WebhookTriggerNameQueryParam:
      in: query
      name: trigger_name
      description: The webhook trigger name (for example, an event name)
      schema:
        type: string
      required: true
    HandleTypesQueryParam:
      in: query
      name: handle_types
      schema:
        type: string
      required: false
    ScopeQueryParam:
      in: query
      name: scope
      schema:
        type: string
      required: true
    SAMLProviderCredentialsIDPathParam:
      name: saml_provider_credentials_id
      description: The SAML provider credentials ID
      in: path
      required: true
      schema:
        $ref: '#/components/schemas/SAMLProviderCredentialsID'
    CodeChallengeMethodQueryParam:
      in: query
      name: code_challenge_method
      schema:
        type: string
      required: false
    LoginHintQueryParam:
      in: query
      name: login_hint
      schema:
        type: string
      required: false
    ResponseModeQueryParam:
      in: query
      name: response_mode
      schema:
        type: string
      required: false
    SdkVersionHeader:
      name: SlashID-SdkVersion
      in: header
      schema:
        type: string
      required: false
      description: SDK version
      example: 1.4.1
    DisplayQueryParam:
      in: query
      name: display
      schema:
        type: string
        enum:
        - page
      required: false
    CredentialIDPathParam:
      name: credential_id
      description: The person's credential ID
      example: 903c1ff9-f2cc-435c-b242-9d8a690fcf0a
      in: path
      required: true
      schema:
        type: string
    RolesNamePathParam:
      in: path
      required: true
      name: role_name
      schema:
        $ref: '#/components/schemas/RoleName'
      description: 'The name of a role. Role name should be URL encoded (so for example: `3b0a8f7e-f26e-4a08-8dae-4d5360a72003%2Frole_name`).'
    StateQueryParam:
      in: query
      name: state
      schema:
        type: string
      required: false
    UILocalesQueryParam:
      in: query
      name: ui_locales
      schema:
        type: string
      required: false
    WebhookTriggerTypeQueryParam:
      in: query
      name: trigger_type
      description: The type of webhook trigger
      example: event
      schema:
        $ref: '#/components/schemas/TriggerType'
      required: true
    PersonIDsQueryParam:
      in: query
      name: ids
      description: A comma-separated list of person IDs
      example:
      - 064d3697-4bf6-781e-9a08-303683b8a5e6,064d3f71-475e-7ea4-9808-6b72d038a43f
      schema:
        type: array
        items:
          type: string
      style: form
      explode: false
    RequiredConsistencyHeader:
      name: SlashID-Required-Consistency
      in: header
      description: 'The consistency level required for this request. If the consistency level is not achieved within the timeout, the request will fail with a 408 Request Timeout error.

        408 Request Timeout error indicates that request was not handled within the timeout, but it may still be handled after request timeout.

        Allowed values: * `local_region`: Wait while the request executes in the local region. * `all_regions`: Wait while the request executes across all regions.

        You can learn more about our replication model on our [Cross-region Replication Model](/docs/access/concepts/replication) page.

        '
      schema:
        type: string
        enum:
        - local_region
        - all_regions
        default: local_region
    OrgIDHeader:
      name: SlashID-OrgID
      in: header
      schema:
        type: string
      required: true
      description: The organization ID
      example: af5fbd30-7ce7-4548-8b30-4cd59cb2aba1
    NonceQueryParam:
      in: query
      name: nonce
      schema:
        type: string
      required: false
    PromptQueryParam:
      in: query
      name: prompt
      schema:
        type: string
        enum:
        - none
        - login
      required: false
    HandlePathParam:
      name: handle
      description: 'Handle in format [handle_type]:[handle]. Supported handle types are ''email_address'', ''phone_number'', and ''username''. This field should be URL-encoded.

        '
      in: path
      required: true
      schema:
        type: string
      examples:
        email_address:
          $ref: '#/components/examples/emailHandleExample'
        phone_number:
          $ref: '#/components/examples/phoneNumberHandleExample'
        username:
          $ref: '#/components/examples/usernameHandleExample'
    CodeChallengeQueryParam:
      in: query
      name: code_challenge
      schema:
        type: string
      required: false
    PersonsFilterQueryParam:
      in: query
      name: filter
      schema:
        type: string
      description: A filter to be applied to the result list, using the [SCIM 2.0 Filter syntax](https://www.rfc-editor.org/rfc/rfc7644#section-3.4.2.2).
      examples:
        person_id:
          summary: Returns only the person with the specified ID
          value: person_id eq "063e2964-ea22-76a2-ae08-3a7173964ae5"
        handle_phone:
          summary: Returns only the person with the phone handle '+1 201 987-6543'
          value: handles eq "phone_number:+12019876543"
        handle_email:
          summary: Returns the person with the email handle 'john.smith@example.com'
          value: handles eq "email_address:john.smith@example.com"
        handle_username:
          summary: Returns the person with the username handle 'john_smith'
          value: handles eq "username:john_smith"
        active:
          summary: Returns only active persons
          value: active eq true
        admin_role:
          summary: Returns only persons with 'admin' role
          value: roles eq "admin"
        source_authoritative_status:
          summary: Returns only persons from a connection of a certain authoritative level (primary, secondary, none)
          value: source_authoritative_status eq "primary"
        permission_write:
          summary: Returns only persons with 'write' permission. Permission can be assigned permission on from person's role.
          value: permissions eq "write"
        additional_permission_write:
          summary: Returns only persons with 'write' permission. It works only with additionally assigned permissions.
          value: additional_permissions eq "write"
        groups_g1:
          summary: Returns only persons in the 'G1' group
          value: groups eq "G1"
        region_us:
          summary: Returns only persons located in the 'us-iowa' region
          value: region eq "us-iowa"
        region_not_us:
          summary: Returns only persons located outside of the 'us-iowa' region
          value: region ne "us-iowa"
        region_us_eu:
          summary: Returns only persons located in 'us-iowa' or 'europe-belgium' regions
          value: region eq "us-iowa" or region eq "europe-belgium"
        attribute_name:
          summary: Returns only persons with the attribute 'myconfig' (in any bucket)
          value: attributes eq "myconfig"
        attribute_prefix:
          summary: Returns only persons with the attribute names starting in 'myprefix'
          value: attributes sw "myprefix"
        attribute_bucket_and_name:
          summary: Returns only persons with the attribute 'myconfig' in the bucket 'mybucket'
          value: attribute_buckets[name eq "mybucket" and attributes eq "myconfig"]
        attribute_in_ro_buckets:
          summary: Returns only persons with any attribute in one of the user-read-only buckets
          value: attribute_buckets[end_user_permissions eq "read_only" and attributes pr]
        attribute_in_pool_buckets:
          summary: Returns only persons with any attribute in one of the person-pool scoped buckets
          value: attribute_buckets[sharing_scope eq "person_pool" and attributes pr]
    PermissionsNamePathParam:
      in: path
      required: true
      name: permission_name
      schema:
        $ref: '#/components/schemas/PermissionName'
      description: 'The name of a permission. Permission name should be URL encoded (so for example: `3b0a8f7e-f26e-4a08-8dae-4d5360a72003%2Fperm_name`).'
    ResponseTypeQueryParam:
      in: query
      name: response_type
      schema:
        type: string
      required: true
    ConfirmationTimestampQueryParam:
      in: query
      name: confirmation_timestamp
      schema:
        type: string
        description: RFC3339 timestamp. Must be between -60s and -10s from the current time to be accepted by the endpoint.
        format: date-time
      required: false
    OAuthProviderQueryParam:
      name: oauth_provider
      in: query
      description: The name of the OAuth provider
      required: false
      schema:
        $ref: '#/components/schemas/OAuthProvider'
    RequiredConsistencyTimeoutHeader:
      name: SlashID-Required-Consistency-Timeout
      in: header
      description: 'The maximum amount of seconds to wait for the requested consistency level to be achieved. If the consistency level is not achieved within this time, the request will fail with a 408 Request Timeout error.

        408 Request Timeout error indicates that request was not handled within the timeout, but it may still be handled after request timeout.

        You can learn more about our replication model on our [Cross-region Replication Model](/docs/access/concepts/replication) page.

        '
      schema:
        type: integer
        default: 30
        maximum: 120
        minimum: 1
    ACRValuesQueryParam:
      in: query
      name: acr_values
      schema:
        type: string
      required: false
    PersonIDPathParam:
      name: person_id
      description: The person ID
      example: 903c1ff9-f2cc-435c-b242-9d8a690fcf0a
      in: path
      required: true
      schema:
        type: string
    ClientIDQueryParam:
      in: query
      name: client_id
      schema:
        type: string
      required: true
    RequiredTokenHeader:
      name: SlashID-Token
      in: header
      schema:
        type: string
      required: true
      description: A valid JWT issued by SlashID
    AttributeBucketNamePathParam:
      in: path
      name: bucket_name
      description: 'The name of an attribute bucket. The bucket `end_user_read_write` exists for all organizations and is suitable for many common use cases. Please refer to our documentation for more information on attribute buckets.

        '
      required: true
      schema:
        type: string
    OptionalSdkVersionHeader:
      name: SlashID-SdkVersion
      in: header
      schema:
        type: string
      required: false
      description: Optional SDK version
      example: 1.4.1
    OAuthClientIDPathParam:
      name: oauth_client_id
      description: An OAuth client ID
      in: path
      required: true
      schema:
        $ref: '#/components/schemas/OAuthClientID'
    AttributeNamesQueryParam:
      in: query
      name: attributes
      description: A comma-separated list of attribute names
      example:
      - address_line_1,address_line_2,city,zip_code
      schema:
        type: array
        items:
          type: string
      style: form
      explode: false
    HandleQueryParam:
      in: query
      name: handle
      schema:
        type: string
      description: Filter by handle in format [handle_type]:[handle]. This field should be url-encoded.
      examples:
        email_address:
          $ref: '#/components/examples/emailHandleExample'
        phone_number:
          $ref: '#/components/examples/phoneNumberHandleExample'
        username:
          $ref: '#/components/examples/usernameHandleExample'
    OrganizationsFilterQueryParam:
      in: query
      name: filter
      schema:
        type: string
      description: A filter to be applied to the result list, using the [SCIM 2.0 Filter syntax](https://www.rfc-editor.org/rfc/rfc7644#section-3.4.2.2).
      examples:
        org_name_eq:
          summary: Returns only organizations named exactly "my_org"
          value: name eq "my_org"
        org_name_co:
          summary: Returns only organizations with the string "some_str" in the name
          value: name co "some_str"
        org_name_sw:
          summary: Returns only organizations with name starting in "my_prefix"
          value: name sw "my_prefix"
        org_id_eq:
          summary: Returns only the organization with the specified ID, if it exists
          value: id eq "0be15c7a-a72d-47c4-ab9a-9a88bac3416d"
        parent_org_id_eq:
          summary: Returns only organizations children of the org with the specified ID
          value: parent_org_id eq "0be15c7a-a72d-47c4-ab9a-9a88bac3416d"
    WebhookIDPathParam:
      in: path
      required: true
      name: webhook_id
      schema:
        type: string
    PersonFieldsQueryParam:
      name: fields
      in: query
      description: Optional fields to include in the response
      schema:
        type: array
        items:
          $ref: '#/components/schemas/PersonFieldName'
      style: form
      explode: false
    DeleteSuborganizationOptionalQueryParam:
      in: query
      name: delete_suborganizations
      schema:
        type: boolean
        description: Whether to delete suborganizations of the organization being deleted. If this option is provided a valid `confirmation_timestamp` param is also required for the operation to proceed.
      required: false
    AttributeBucketsQueryParam:
      in: query
      name: buckets
      description: A comma-separated list of attribute bucket names
      example:
      - person_pool-end_user_read_write,person_pool-end_user_no_access
      schema:
        type: array
        items:
          type: string
      style: form
      explode: false
  examples:
    emailHandleExample:
      value: email_address:user@user.com
    usernameHandleExample:
      value: username:john_smith
    personHandlesExample:
      value:
      - type: email_address
        value: user@user.com
      - type: phone_number
        value: '+13475043201'
      - type: username
        value: john_smith
      summary: Example person handles
    phoneNumberHandleExample:
      value: phone_number:+13475043201
  headers:
    ETagHeader:
      schema:
        type: string
      description: An ETag header. Can be passed as an If-Match header in a subsequent request to avoid lost updates.
  securitySchemes:
    ApiKeyAuth:
      description: Authorizes the request with the organization's API Key.
      x-svc-um-api: true
      type: apiKey
      in: header
      name: SlashID-API-Key
    OAuth2ClientIdSecret:
      description: Authorizes the request with a client ID/client secret pair
      type: http
      scheme: basic
    OAuth2AccessTokenBearer:
      description: Authorizes the request with an Access Token for the current user.
      type: http
      scheme: bearer
      bearerFormat: opaque