#
# Copyright (C) 2015 The Gravitee team (http://gravitee.io)
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#         http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

openapi: 3.0.1
info:
  contact:
    email: team-gko@graviteesource.com
    name: DevX team
    url: https://www.gravitee.io/
  description: |-
    Declarative, idempotent management of Gravitee Access Management resources.

    Each resource is identified by a stable, immutable `key` that you choose. Applying a resource with `PUT` creates it on first use and updates it on subsequent applies, so the same request can be replayed safely to converge on a desired state.

    The API only sees and manages resources it owns (those marked as managed by the Automation API). Resources created through the Management API or console are invisible to these endpoints and cannot be read, updated, or deleted here; conversely, resources created here are fully owned by the Automation API.

    Domains are the top-level resource; certificates, identity providers, and reporters are managed as sub-resources of a domain. Deleting a domain cascades to its Automation-managed sub-resources. Some sub-resources support a `system` flag identifying the domain's built-in default; the flag is immutable once set.

    This API complements the Management API, which remains the interactive, full-featured management surface.
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0.html
  title: Gravitee.io AM - Automation API
  version: 4.13.0-alpha.8
servers:
- url: http://localhost:8093/automation
security:
- BearerAuth: []
tags:
- description: Certificates configured under a domain to sign and verify tokens.
  name: Certificates
- description: Data planes configured under an environment to store the runtime data
    of its domains.
  name: Data Planes
- description: "Security domains: the top-level container for an authentication and\
    \ authorization configuration. Create, read, update, and delete domains, and reach\
    \ their sub-resources."
  name: Domains
- description: Identity providers configured under a domain to authenticate users.
  name: Identity Providers
- description: Reporters configured under a domain to persist audit events to a backend.
  name: Reporters
paths:
  /organizations/{orgId}/environments/{envId}/dataplanes:
    get:
      description: Returns all data planes managed by the Automation API in the environment.
        Data planes provisioned outside the Automation API are not returned.
      operationId: automationListDataPlanes
      parameters:
      - description: Identifier of the organization that owns the environment.
        example: DEFAULT
        in: path
        name: orgId
        required: true
        schema:
          type: string
      - description: Identifier of the environment the resource belongs to.
        example: DEFAULT
        in: path
        name: envId
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              examples:
                DataPlaneList:
                  description: DataPlaneList
                  value:
                  - id: acme-eu
                    name: ACME EU data plane
                    type: mongodb
                    gatewayUrl: https://gateway-eu.example.com
                    database: gravitee-am-acme
                    hosts:
                    - mongo:27017
                    organizationId: DEFAULT
                    environmentId: DEFAULT
                    createdAt: 2026-01-15T09:30:00.000Z
                    updatedAt: 2026-01-15T09:30:00.000Z
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/AutomationDataPlane"
          description: List of data planes
        "403":
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 403
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: Permission denied
        default:
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 500
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: Unexpected error
      summary: List an environment's data planes
      tags:
      - Data Planes
    put:
      description: "Idempotent create-or-update. Uses the id field in the body to\
        \ identify the data plane within the environment. The type is immutable, and\
        \ the organization and environment come from the path. An id: reference updates\
        \ a data plane the Automation API does not manage, and cannot create one."
      operationId: automationCreateOrUpdateDataPlane
      parameters:
      - description: Identifier of the organization that owns the environment.
        example: DEFAULT
        in: path
        name: orgId
        required: true
        schema:
          type: string
      - description: Identifier of the environment the resource belongs to.
        example: DEFAULT
        in: path
        name: envId
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              DataPlane:
                description: A MongoDB data plane
                value:
                  id: acme-eu
                  name: ACME EU data plane
                  type: mongodb
                  gatewayUrl: https://gateway-eu.example.com
                  configuration:
                    mongodb:
                      dbname: gravitee-am-acme
                      host: mongo
                      port: 27017
            schema:
              $ref: "#/components/schemas/AutomationDataPlane"
        description: Desired state of the data plane.
        required: true
      responses:
        "200":
          content:
            application/json:
              examples:
                DataPlane:
                  description: DataPlane
                  value:
                    id: acme-eu
                    name: ACME EU data plane
                    type: mongodb
                    gatewayUrl: https://gateway-eu.example.com
                    database: gravitee-am-acme
                    hosts:
                    - mongo:27017
                    organizationId: DEFAULT
                    environmentId: DEFAULT
                    createdAt: 2026-01-15T09:30:00.000Z
                    updatedAt: 2026-01-15T09:30:00.000Z
              schema:
                $ref: "#/components/schemas/AutomationDataPlane"
          description: The created or updated data plane
        "400":
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 400
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: "Invalid request: a missing required field, an unknown data\
            \ plane type, a configuration the type's plugin rejects, an id reserved\
            \ by the node's gravitee.yml, or an attempt to change an immutable field"
        "403":
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 403
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: Permission denied
        "404":
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 404
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: "An id: reference naming a data plane that does not exist in\
            \ this environment"
        "409":
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 409
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: The id is already taken by a data plane the Automation API
            does not manage
      summary: Create or update a data plane
      tags:
      - Data Planes
  /organizations/{orgId}/environments/{envId}/dataplanes/{dataPlaneId}:
    delete:
      description: Deletes an Automation-managed data plane by its id. Deleting a
        data plane that does not exist also returns 204.
      operationId: automationDeleteDataPlane
      parameters:
      - description: Identifier of the organization that owns the environment.
        example: DEFAULT
        in: path
        name: orgId
        required: true
        schema:
          type: string
      - description: Identifier of the environment the resource belongs to.
        example: DEFAULT
        in: path
        name: envId
        required: true
        schema:
          type: string
      - description: Id of the data plane within the environment.
        example: acme-eu
        in: path
        name: dataPlaneId
        required: true
        schema:
          type: string
      responses:
        "204":
          description: Data plane successfully deleted
        "403":
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 403
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: Permission denied
        "409":
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 409
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: At least one domain still references the data plane
      summary: Delete a data plane
      tags:
      - Data Planes
    get:
      description: Retrieves a single Automation-managed data plane by its id.
      operationId: automationGetDataPlane
      parameters:
      - description: Identifier of the organization that owns the environment.
        example: DEFAULT
        in: path
        name: orgId
        required: true
        schema:
          type: string
      - description: Identifier of the environment the resource belongs to.
        example: DEFAULT
        in: path
        name: envId
        required: true
        schema:
          type: string
      - description: Id of the data plane within the environment.
        example: acme-eu
        in: path
        name: dataPlaneId
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              examples:
                DataPlane:
                  description: DataPlane
                  value:
                    id: acme-eu
                    name: ACME EU data plane
                    type: mongodb
                    gatewayUrl: https://gateway-eu.example.com
                    database: gravitee-am-acme
                    hosts:
                    - mongo:27017
                    organizationId: DEFAULT
                    environmentId: DEFAULT
                    createdAt: 2026-01-15T09:30:00.000Z
                    updatedAt: 2026-01-15T09:30:00.000Z
              schema:
                $ref: "#/components/schemas/AutomationDataPlane"
          description: The data plane
        "403":
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 403
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: Permission denied
        "404":
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 404
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: "Data plane not found in this environment, or not managed by\
            \ the Automation API"
      summary: Get a data plane
      tags:
      - Data Planes
  /organizations/{orgId}/environments/{envId}/domains:
    get:
      description: Returns all security domains within the specified environment.
      operationId: automationListDomains
      parameters:
      - description: Identifier of the organization that owns the environment.
        example: DEFAULT
        in: path
        name: orgId
        required: true
        schema:
          type: string
      - description: Identifier of the environment the resource belongs to.
        example: DEFAULT
        in: path
        name: envId
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              examples:
                AutomationDomainList:
                  value:
                  - key: example-domain
                    name: Example domain
                    description: An example authentication domain
                    enabled: true
                    path: /example-domain
                    dataPlaneId: default
                    tags:
                    - eu
                    - production
                    accountSettings:
                      inherited: false
                      loginAttemptsDetectionEnabled: true
                      maxLoginAttempts: 10
                      accountBlockedDuration: 7200
                    oidc:
                      redirectUriStrictMatching: true
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/AutomationDomain"
          description: List of domains
        "403":
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 403
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: Permission denied
        default:
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 500
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: Unexpected error
      summary: List all domains
      tags:
      - Domains
    put:
      description: "Idempotent create-or-update. Uses the key field in the body to\
        \ identify the domain. On first apply the domain is created; subsequent applies\
        \ update it. dataPlaneId is optional at creation, resolved from the environment's\
        \ data planes when omitted, and immutable afterwards. When dryRun is true,\
        \ the endpoint validates the payload without persisting; the returned domain\
        \ carries a dryRunErrors list (empty on success, populated with validation\
        \ errors otherwise)."
      operationId: automationCreateOrUpdateDomain
      parameters:
      - description: Identifier of the organization that owns the environment.
        example: DEFAULT
        in: path
        name: orgId
        required: true
        schema:
          type: string
      - description: Identifier of the environment the resource belongs to.
        example: DEFAULT
        in: path
        name: envId
        required: true
        schema:
          type: string
      - description: "When true, validates the payload without persisting. The returned\
          \ domain includes a dryRunErrors field."
        in: query
        name: dryRun
        schema:
          type: boolean
          default: false
      requestBody:
        content:
          application/json:
            examples:
              Domain:
                description: A domain with common settings
                value:
                  key: example-domain
                  name: Example domain
                  description: An example authentication domain
                  enabled: true
                  path: /example-domain
                  dataPlaneId: default
                  tags:
                  - eu
                  - production
                  accountSettings:
                    inherited: false
                    loginAttemptsDetectionEnabled: true
                    maxLoginAttempts: 10
                    accountBlockedDuration: 7200
                  oidc:
                    redirectUriStrictMatching: true
            schema:
              $ref: "#/components/schemas/AutomationDomain"
        description: Desired state of the domain.
        required: true
      responses:
        "200":
          content:
            application/json:
              examples:
                Domain:
                  description: A domain with common settings
                  value:
                    key: example-domain
                    name: Example domain
                    description: An example authentication domain
                    enabled: true
                    path: /example-domain
                    dataPlaneId: default
                    tags:
                    - eu
                    - production
                    accountSettings:
                      inherited: false
                      loginAttemptsDetectionEnabled: true
                      maxLoginAttempts: 10
                      accountBlockedDuration: 7200
                    oidc:
                      redirectUriStrictMatching: true
              schema:
                $ref: "#/components/schemas/AutomationDomain"
          description: The created or updated domain. When dryRun is true the domain
            includes a dryRunErrors field with any validation errors.
        "400":
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 400
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: "Invalid request: validation failure, an immutable field change,\
            \ or a key that already exists for a domain not managed by the Automation\
            \ API"
        "403":
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 403
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: Permission denied
      summary: Create or update a domain
      tags:
      - Domains
  /organizations/{orgId}/environments/{envId}/domains/{domainKey}:
    delete:
      description: "Deletes an Automation-managed domain. Deletion cascades to the\
        \ domain's sub-resources (certificates, identity providers, and reporters).\
        \ Deleting a domain that does not exist also returns 204."
      operationId: automationDeleteDomain
      parameters:
      - description: Identifier of the organization that owns the environment.
        example: DEFAULT
        in: path
        name: orgId
        required: true
        schema:
          type: string
      - description: Identifier of the environment the resource belongs to.
        example: DEFAULT
        in: path
        name: envId
        required: true
        schema:
          type: string
      - description: "Key of the domain: its stable, immutable Automation identifier\
          \ within the environment."
        example: example-domain
        in: path
        name: domainKey
        required: true
        schema:
          type: string
      responses:
        "204":
          description: Domain successfully deleted
        "403":
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 403
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: Permission denied
        default:
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 500
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: Unexpected error
      summary: Delete a domain
      tags:
      - Domains
    get:
      description: Retrieves a single Automation-managed security domain by its key.
      operationId: automationGetDomain
      parameters:
      - description: Identifier of the organization that owns the environment.
        example: DEFAULT
        in: path
        name: orgId
        required: true
        schema:
          type: string
      - description: Identifier of the environment the resource belongs to.
        example: DEFAULT
        in: path
        name: envId
        required: true
        schema:
          type: string
      - description: "Key of the domain: its stable, immutable Automation identifier\
          \ within the environment."
        example: example-domain
        in: path
        name: domainKey
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              examples:
                Domain:
                  description: A domain with common settings
                  value:
                    key: example-domain
                    name: Example domain
                    description: An example authentication domain
                    enabled: true
                    path: /example-domain
                    dataPlaneId: default
                    tags:
                    - eu
                    - production
                    accountSettings:
                      inherited: false
                      loginAttemptsDetectionEnabled: true
                      maxLoginAttempts: 10
                      accountBlockedDuration: 7200
                    oidc:
                      redirectUriStrictMatching: true
              schema:
                $ref: "#/components/schemas/AutomationDomain"
          description: The domain
        "403":
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 403
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: Permission denied
        "404":
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 404
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: "Domain not found, or not managed by the Automation API"
      summary: Get a domain
      tags:
      - Domains
  /organizations/{orgId}/environments/{envId}/domains/{domainKey}/certificates:
    get:
      description: Returns all certificates managed by the Automation API under the
        domain. Certificates created outside the Automation API are not returned.
      operationId: automationListCertificates
      parameters:
      - description: Identifier of the organization that owns the environment.
        example: DEFAULT
        in: path
        name: orgId
        required: true
        schema:
          type: string
      - description: Identifier of the environment the resource belongs to.
        example: DEFAULT
        in: path
        name: envId
        required: true
        schema:
          type: string
      - description: "Key of the domain: its stable, immutable Automation identifier\
          \ within the environment."
        example: example-domain
        in: path
        name: domainKey
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              examples:
                AutomationCertificateList:
                  value:
                  - key: signing-cert
                    name: Signing certificate
                    type: javakeystore-am-certificate
                    configuration: "{\"jks\":{\"content\":\"...\",\"name\":\"keystore.jks\"\
                      },\"storepass\":\"secret\",\"alias\":\"mykey\",\"keypass\":\"\
                      secret\"}"
                  - key: default
                    system: true
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/AutomationCertificate"
          description: List of certificates
        "403":
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 403
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: Permission denied
        "404":
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 404
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: "Domain not found, or not managed by the Automation API"
      summary: List a domain's certificates
      tags:
      - Certificates
      - Domains
    put:
      description: "Idempotent create-or-update. Uses the key field in the body to\
        \ identify the certificate within the domain. Re-applying an unchanged definition\
        \ is a no-op. The system flag is immutable; changing it requires deleting\
        \ and recreating the certificate. When dryRun is true, the endpoint validates\
        \ the payload without persisting; the returned certificate carries a dryRunErrors\
        \ list (empty on success, populated with validation errors otherwise)."
      operationId: automationCreateOrUpdateCertificate
      parameters:
      - description: Identifier of the organization that owns the environment.
        example: DEFAULT
        in: path
        name: orgId
        required: true
        schema:
          type: string
      - description: Identifier of the environment the resource belongs to.
        example: DEFAULT
        in: path
        name: envId
        required: true
        schema:
          type: string
      - description: "Key of the domain: its stable, immutable Automation identifier\
          \ within the environment."
        example: example-domain
        in: path
        name: domainKey
        required: true
        schema:
          type: string
      - description: "When true, validates the payload without persisting. The returned\
          \ certificate includes a dryRunErrors field."
        in: query
        name: dryRun
        schema:
          type: boolean
          default: false
      requestBody:
        content:
          application/json:
            examples:
              Certificate:
                description: A fully specified certificate
                value:
                  key: signing-cert
                  name: Signing certificate
                  type: javakeystore-am-certificate
                  configuration: "{\"jks\":{\"content\":\"...\",\"name\":\"keystore.jks\"\
                    },\"storepass\":\"secret\",\"alias\":\"mykey\",\"keypass\":\"\
                    secret\"}"
              System certificate:
                description: The domain's system certificate; only system and key
                  are needed
                value:
                  key: default
                  system: true
            schema:
              $ref: "#/components/schemas/AutomationCertificate"
        description: "Desired state of the certificate. For a system certificate,\
          \ supply only system: true and key."
        required: true
      responses:
        "200":
          content:
            application/json:
              examples:
                Certificate:
                  description: A fully specified certificate
                  value:
                    key: signing-cert
                    name: Signing certificate
                    type: javakeystore-am-certificate
                    configuration: "{\"jks\":{\"content\":\"...\",\"name\":\"keystore.jks\"\
                      },\"storepass\":\"secret\",\"alias\":\"mykey\",\"keypass\":\"\
                      secret\"}"
                System certificate:
                  description: The domain's system certificate; only system and key
                    are needed
                  value:
                    key: default
                    system: true
              schema:
                $ref: "#/components/schemas/AutomationCertificate"
          description: The created or updated certificate. When dryRun is true the
            certificate includes a dryRunErrors field with any validation errors.
        "400":
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 400
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: "Invalid request: a key conflict, a missing required field\
            \ for a non-system certificate, an attempt to change the immutable system\
            \ flag, or a second system certificate for the domain"
        "403":
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 403
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: Permission denied
        "404":
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 404
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: "Domain not found, or not managed by the Automation API"
      summary: Create or update a certificate
      tags:
      - Certificates
      - Domains
  /organizations/{orgId}/environments/{envId}/domains/{domainKey}/certificates/{certKey}:
    delete:
      description: "Deletes an Automation-managed certificate by its key. A domain\
        \ that names it by key in saml.certificate or certificateSettings.fallbackCertificate\
        \ keeps the reference, which resolves again once a certificate with the same\
        \ key is created. Deleting a certificate that does not exist also returns\
        \ 204."
      operationId: automationDeleteCertificate
      parameters:
      - description: Identifier of the organization that owns the environment.
        example: DEFAULT
        in: path
        name: orgId
        required: true
        schema:
          type: string
      - description: Identifier of the environment the resource belongs to.
        example: DEFAULT
        in: path
        name: envId
        required: true
        schema:
          type: string
      - description: "Key of the domain: its stable, immutable Automation identifier\
          \ within the environment."
        example: example-domain
        in: path
        name: domainKey
        required: true
        schema:
          type: string
      - description: Key of the certificate within the domain.
        example: signing-cert
        in: path
        name: certKey
        required: true
        schema:
          type: string
      responses:
        "204":
          description: Certificate successfully deleted
        "403":
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 403
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: Permission denied
        default:
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 500
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: Unexpected error
      summary: Delete a certificate
      tags:
      - Certificates
      - Domains
    get:
      description: Retrieves a single Automation-managed certificate by its key.
      operationId: automationGetCertificate
      parameters:
      - description: Identifier of the organization that owns the environment.
        example: DEFAULT
        in: path
        name: orgId
        required: true
        schema:
          type: string
      - description: Identifier of the environment the resource belongs to.
        example: DEFAULT
        in: path
        name: envId
        required: true
        schema:
          type: string
      - description: "Key of the domain: its stable, immutable Automation identifier\
          \ within the environment."
        example: example-domain
        in: path
        name: domainKey
        required: true
        schema:
          type: string
      - description: Key of the certificate within the domain.
        example: signing-cert
        in: path
        name: certKey
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              examples:
                Certificate:
                  description: A fully specified certificate
                  value:
                    key: signing-cert
                    name: Signing certificate
                    type: javakeystore-am-certificate
                    configuration: "{\"jks\":{\"content\":\"...\",\"name\":\"keystore.jks\"\
                      },\"storepass\":\"secret\",\"alias\":\"mykey\",\"keypass\":\"\
                      secret\"}"
                System certificate:
                  description: The domain's system certificate; only system and key
                    are needed
                  value:
                    key: default
                    system: true
              schema:
                $ref: "#/components/schemas/AutomationCertificate"
          description: The certificate
        "403":
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 403
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: Permission denied
        "404":
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 404
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: "Domain or certificate not found, or not managed by the Automation\
            \ API"
      summary: Get a certificate
      tags:
      - Certificates
      - Domains
  /organizations/{orgId}/environments/{envId}/domains/{domainKey}/identities:
    get:
      description: Returns all identity providers managed by the Automation API under
        the domain. Identity providers created outside the Automation API are not
        returned.
      operationId: automationListIdentityProviders
      parameters:
      - description: Identifier of the organization that owns the environment.
        example: DEFAULT
        in: path
        name: orgId
        required: true
        schema:
          type: string
      - description: Identifier of the environment the resource belongs to.
        example: DEFAULT
        in: path
        name: envId
        required: true
        schema:
          type: string
      - description: "Key of the domain: its stable, immutable Automation identifier\
          \ within the environment."
        example: example-domain
        in: path
        name: domainKey
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              examples:
                AutomationIdentityProviderList:
                  value:
                  - key: corporate-ldap
                    name: Corporate LDAP
                    type: inline-am-idp
                    configuration: "{\"users\":[{\"username\":\"admin\",\"password\"\
                      :\"...\"}]}"
                    mappers:
                      sub: username
                      email: email
                    roleMapper:
                      role-id:
                      - username=admin
                    groupMapper:
                      group-id:
                      - username=admin
                    domainWhitelist:
                    - example.com
                  - key: default
                    system: true
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/AutomationIdentityProvider"
          description: List of identity providers
        "403":
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 403
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: Permission denied
        "404":
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 404
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: "Domain not found, or not managed by the Automation API"
      summary: List a domain's identity providers
      tags:
      - Identity Providers
      - Domains
    put:
      description: "Idempotent create-or-update. Uses the key field in the body to\
        \ identify the identity provider within the domain. On first apply the identity\
        \ provider is created; subsequent applies update it. The system flag is immutable;\
        \ changing it requires deleting and recreating the identity provider. When\
        \ dryRun is true, the endpoint validates the payload without persisting; the\
        \ returned identity provider carries a dryRunErrors list (empty on success,\
        \ populated with validation errors otherwise)."
      operationId: automationCreateOrUpdateIdentityProvider
      parameters:
      - description: Identifier of the organization that owns the environment.
        example: DEFAULT
        in: path
        name: orgId
        required: true
        schema:
          type: string
      - description: Identifier of the environment the resource belongs to.
        example: DEFAULT
        in: path
        name: envId
        required: true
        schema:
          type: string
      - description: "Key of the domain: its stable, immutable Automation identifier\
          \ within the environment."
        example: example-domain
        in: path
        name: domainKey
        required: true
        schema:
          type: string
      - description: "When true, validates the payload without persisting. The returned\
          \ identity provider includes a dryRunErrors field."
        in: query
        name: dryRun
        schema:
          type: boolean
          default: false
      requestBody:
        content:
          application/json:
            examples:
              Identity provider:
                description: A fully specified identity provider
                value:
                  key: corporate-ldap
                  name: Corporate LDAP
                  type: inline-am-idp
                  configuration: "{\"users\":[{\"username\":\"admin\",\"password\"\
                    :\"...\"}]}"
                  mappers:
                    sub: username
                    email: email
                  roleMapper:
                    role-id:
                    - username=admin
                  groupMapper:
                    group-id:
                    - username=admin
                  domainWhitelist:
                  - example.com
              System identity provider:
                description: The domain's system identity provider; only system and
                  key are needed
                value:
                  key: default
                  system: true
            schema:
              $ref: "#/components/schemas/AutomationIdentityProvider"
        description: "Desired state of the identity provider. For a system identity\
          \ provider, supply only system: true and key."
        required: true
      responses:
        "200":
          content:
            application/json:
              examples:
                Identity provider:
                  description: A fully specified identity provider
                  value:
                    key: corporate-ldap
                    name: Corporate LDAP
                    type: inline-am-idp
                    configuration: "{\"users\":[{\"username\":\"admin\",\"password\"\
                      :\"...\"}]}"
                    mappers:
                      sub: username
                      email: email
                    roleMapper:
                      role-id:
                      - username=admin
                    groupMapper:
                      group-id:
                      - username=admin
                    domainWhitelist:
                    - example.com
                System identity provider:
                  description: The domain's system identity provider; only system
                    and key are needed
                  value:
                    key: default
                    system: true
              schema:
                $ref: "#/components/schemas/AutomationIdentityProvider"
          description: The created or updated identity provider. When dryRun is true
            the identity provider includes a dryRunErrors field with any validation
            errors.
        "400":
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 400
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: "Invalid request: a key conflict, a missing required field\
            \ (name or type) for a non-system identity provider, an attempt to change\
            \ the immutable system flag, or a second system identity provider for\
            \ the domain"
        "403":
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 403
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: Permission denied
        "404":
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 404
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: "Domain not found, or not managed by the Automation API"
      summary: Create or update an identity provider
      tags:
      - Identity Providers
      - Domains
  /organizations/{orgId}/environments/{envId}/domains/{domainKey}/identities/{identityKey}:
    delete:
      description: "Deletes an Automation-managed identity provider by its key. A\
        \ domain that names it in accountSettings.defaultIdentityProviderForRegistration\
        \ keeps the reference, which resolves again once an identity provider with\
        \ the same key is created. Deleting an identity provider that does not exist\
        \ also returns 204."
      operationId: automationDeleteIdentityProvider
      parameters:
      - description: Identifier of the organization that owns the environment.
        example: DEFAULT
        in: path
        name: orgId
        required: true
        schema:
          type: string
      - description: Identifier of the environment the resource belongs to.
        example: DEFAULT
        in: path
        name: envId
        required: true
        schema:
          type: string
      - description: "Key of the domain: its stable, immutable Automation identifier\
          \ within the environment."
        example: example-domain
        in: path
        name: domainKey
        required: true
        schema:
          type: string
      - description: Key of the identity within the domain.
        example: corporate-ldap
        in: path
        name: identityKey
        required: true
        schema:
          type: string
      responses:
        "204":
          description: Identity provider successfully deleted
        "403":
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 403
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: Permission denied
        default:
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 500
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: Unexpected error
      summary: Delete an identity provider
      tags:
      - Identity Providers
      - Domains
    get:
      description: Retrieves a single Automation-managed identity provider by its
        key.
      operationId: automationGetIdentityProvider
      parameters:
      - description: Identifier of the organization that owns the environment.
        example: DEFAULT
        in: path
        name: orgId
        required: true
        schema:
          type: string
      - description: Identifier of the environment the resource belongs to.
        example: DEFAULT
        in: path
        name: envId
        required: true
        schema:
          type: string
      - description: "Key of the domain: its stable, immutable Automation identifier\
          \ within the environment."
        example: example-domain
        in: path
        name: domainKey
        required: true
        schema:
          type: string
      - description: Key of the identity within the domain.
        example: corporate-ldap
        in: path
        name: identityKey
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              examples:
                Identity provider:
                  description: A fully specified identity provider
                  value:
                    key: corporate-ldap
                    name: Corporate LDAP
                    type: inline-am-idp
                    configuration: "{\"users\":[{\"username\":\"admin\",\"password\"\
                      :\"...\"}]}"
                    mappers:
                      sub: username
                      email: email
                    roleMapper:
                      role-id:
                      - username=admin
                    groupMapper:
                      group-id:
                      - username=admin
                    domainWhitelist:
                    - example.com
                System identity provider:
                  description: The domain's system identity provider; only system
                    and key are needed
                  value:
                    key: default
                    system: true
              schema:
                $ref: "#/components/schemas/AutomationIdentityProvider"
          description: The identity provider
        "403":
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 403
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: Permission denied
        "404":
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 404
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: "Domain or identity provider not found, or not managed by the\
            \ Automation API"
      summary: Get an identity provider
      tags:
      - Identity Providers
      - Domains
  /organizations/{orgId}/environments/{envId}/domains/{domainKey}/reporters:
    get:
      description: Returns all reporters managed by the Automation API under the domain.
        Reporters created outside the Automation API are not returned.
      operationId: automationListReporters
      parameters:
      - description: Identifier of the organization that owns the environment.
        example: DEFAULT
        in: path
        name: orgId
        required: true
        schema:
          type: string
      - description: Identifier of the environment the resource belongs to.
        example: DEFAULT
        in: path
        name: envId
        required: true
        schema:
          type: string
      - description: "Key of the domain: its stable, immutable Automation identifier\
          \ within the environment."
        example: example-domain
        in: path
        name: domainKey
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              examples:
                AutomationReporterList:
                  value:
                  - key: audit-kafka
                    name: Audit events to Kafka
                    type: reporter-am-kafka
                    enabled: true
                    configuration: "{\"bootstrapServers\":\"kafka:9092\",\"topic\"\
                      :\"audit\"}"
                  - key: default
                    system: true
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/AutomationReporter"
          description: List of reporters
        "403":
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 403
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: Permission denied
        "404":
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 404
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: "Domain not found, or not managed by the Automation API"
      summary: List a domain's reporters
      tags:
      - Reporters
      - Domains
    put:
      description: "Idempotent create-or-update. Uses the key field in the body to\
        \ identify the reporter within the domain. On first apply the reporter is\
        \ created; subsequent applies update it. The system flag is immutable; changing\
        \ it requires deleting and recreating the reporter. When dryRun is true, the\
        \ endpoint validates the payload without persisting; the returned reporter\
        \ carries a dryRunErrors list (empty on success, populated with validation\
        \ errors otherwise)."
      operationId: automationCreateOrUpdateReporter
      parameters:
      - description: Identifier of the organization that owns the environment.
        example: DEFAULT
        in: path
        name: orgId
        required: true
        schema:
          type: string
      - description: Identifier of the environment the resource belongs to.
        example: DEFAULT
        in: path
        name: envId
        required: true
        schema:
          type: string
      - description: "Key of the domain: its stable, immutable Automation identifier\
          \ within the environment."
        example: example-domain
        in: path
        name: domainKey
        required: true
        schema:
          type: string
      - description: "When true, validates the payload without persisting. The returned\
          \ reporter includes a dryRunErrors field."
        in: query
        name: dryRun
        schema:
          type: boolean
          default: false
      requestBody:
        content:
          application/json:
            examples:
              Reporter:
                description: A fully specified reporter
                value:
                  key: audit-kafka
                  name: Audit events to Kafka
                  type: reporter-am-kafka
                  enabled: true
                  configuration: "{\"bootstrapServers\":\"kafka:9092\",\"topic\":\"\
                    audit\"}"
              System reporter:
                description: The domain's system reporter; only system and key are
                  needed
                value:
                  key: default
                  system: true
            schema:
              $ref: "#/components/schemas/AutomationReporter"
        description: "Desired state of the reporter. For a system reporter, supply\
          \ only system: true and key."
        required: true
      responses:
        "200":
          content:
            application/json:
              examples:
                Reporter:
                  description: A fully specified reporter
                  value:
                    key: audit-kafka
                    name: Audit events to Kafka
                    type: reporter-am-kafka
                    enabled: true
                    configuration: "{\"bootstrapServers\":\"kafka:9092\",\"topic\"\
                      :\"audit\"}"
                System reporter:
                  description: The domain's system reporter; only system and key are
                    needed
                  value:
                    key: default
                    system: true
              schema:
                $ref: "#/components/schemas/AutomationReporter"
          description: The created or updated reporter. When dryRun is true the reporter
            includes a dryRunErrors field with any validation errors.
        "400":
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 400
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: "Invalid request: a key conflict, a missing required field\
            \ (name, type, or configuration) for a non-system reporter, an attempt\
            \ to change the immutable system flag, or a second system reporter for\
            \ the domain"
        "403":
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 403
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: Permission denied
        "404":
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 404
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: "Domain not found, or not managed by the Automation API"
      summary: Create or update a reporter
      tags:
      - Reporters
      - Domains
  /organizations/{orgId}/environments/{envId}/domains/{domainKey}/reporters/{reporterKey}:
    delete:
      description: Deletes an Automation-managed reporter by its key. Deleting a reporter
        that does not exist also returns 204.
      operationId: automationDeleteReporter
      parameters:
      - description: Identifier of the organization that owns the environment.
        example: DEFAULT
        in: path
        name: orgId
        required: true
        schema:
          type: string
      - description: Identifier of the environment the resource belongs to.
        example: DEFAULT
        in: path
        name: envId
        required: true
        schema:
          type: string
      - description: "Key of the domain: its stable, immutable Automation identifier\
          \ within the environment."
        example: example-domain
        in: path
        name: domainKey
        required: true
        schema:
          type: string
      - description: Key of the reporter within the domain.
        example: audit-kafka
        in: path
        name: reporterKey
        required: true
        schema:
          type: string
      responses:
        "204":
          description: Reporter successfully deleted
        "403":
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 403
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: Permission denied
        default:
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 500
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: Unexpected error
      summary: Delete a reporter
      tags:
      - Reporters
      - Domains
    get:
      description: Retrieves a single Automation-managed reporter by its key.
      operationId: automationGetReporter
      parameters:
      - description: Identifier of the organization that owns the environment.
        example: DEFAULT
        in: path
        name: orgId
        required: true
        schema:
          type: string
      - description: Identifier of the environment the resource belongs to.
        example: DEFAULT
        in: path
        name: envId
        required: true
        schema:
          type: string
      - description: "Key of the domain: its stable, immutable Automation identifier\
          \ within the environment."
        example: example-domain
        in: path
        name: domainKey
        required: true
        schema:
          type: string
      - description: Key of the reporter within the domain.
        example: audit-kafka
        in: path
        name: reporterKey
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              examples:
                Reporter:
                  description: A fully specified reporter
                  value:
                    key: audit-kafka
                    name: Audit events to Kafka
                    type: reporter-am-kafka
                    enabled: true
                    configuration: "{\"bootstrapServers\":\"kafka:9092\",\"topic\"\
                      :\"audit\"}"
                System reporter:
                  description: The domain's system reporter; only system and key are
                    needed
                  value:
                    key: default
                    system: true
              schema:
                $ref: "#/components/schemas/AutomationReporter"
          description: The reporter
        "403":
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 403
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: Permission denied
        "404":
          content:
            application/json:
              examples:
                error:
                  value:
                    http_status: 404
                    message: A human-readable description of the error
              schema:
                $ref: "#/components/schemas/Error"
          description: "Domain or reporter not found, or not managed by the Automation\
            \ API"
      summary: Get a reporter
      tags:
      - Reporters
      - Domains
components:
  schemas:
    AutomationAccountSettings:
      type: object
      description: "User account settings for the domain: brute-force protection,\
        \ registration, password reset, remember-me, and MFA challenge behavior."
      properties:
        accountBlockedDuration:
          type: integer
          format: int32
          description: "Duration, in seconds, for which the account remains blocked\
            \ after too many failed login attempts."
          example: 7200
        autoLoginAfterRegistration:
          type: boolean
          default: false
          description: Whether the user is automatically logged in after completing
            registration.
        autoLoginAfterResetPassword:
          type: boolean
          default: false
          description: Whether the user is automatically logged in after a password
            reset.
        completeRegistrationWhenResetPassword:
          type: boolean
          default: false
          description: Whether resetting a password also completes a pending registration.
        defaultIdentityProviderForRegistration:
          type: string
          description: "Key of an identity provider managed under this domain, used\
            \ as the default for user registration. The reference is not checked against\
            \ existing identity providers: it can name one created after the domain\
            \ or since deleted, and resolves whenever an identity provider with that\
            \ key exists."
          example: users-idp
        deletePasswordlessDevicesAfterResetPassword:
          type: boolean
          default: false
          description: Whether passwordless (WebAuthn) devices are deleted when the
            password is reset.
        dynamicUserRegistration:
          type: boolean
          default: false
          description: Whether dynamic (self-service) user registration is enabled.
        inherited:
          type: boolean
          default: true
          description: "Whether account settings are inherited from the parent (domain).\
            \ When true, the other fields are ignored. Has no effect when applied\
            \ to domains."
        loginAttemptsDetectionEnabled:
          type: boolean
          default: false
          description: Whether brute-force authentication attempts are detected and
            blocked.
        loginAttemptsResetTime:
          type: integer
          format: int32
          description: "Time, in seconds, after which the login attempt counter is\
            \ reset when the maximum has not been reached."
          example: 600
        maxLoginAttempts:
          type: integer
          format: int32
          description: Maximum number of failed login attempts before the account
            is blocked.
          example: 10
        mfaChallengeAttemptsDetectionEnabled:
          type: boolean
          default: false
          description: Whether failed MFA challenge attempts are detected and blocked.
        mfaChallengeAttemptsResetTime:
          type: integer
          format: int32
          description: "Time, in seconds, after which the MFA challenge attempt counter\
            \ is reset."
          example: 600
        mfaChallengeMaxAttempts:
          type: integer
          format: int32
          description: Maximum number of failed MFA challenge attempts before the
            user is blocked.
          example: 3
        mfaChallengeSendVerifyAlertEmail:
          type: boolean
          default: false
          description: Whether to send an alert email after too many failed MFA challenge
            attempts.
        redirectUriAfterRegistration:
          type: string
          description: URL the user is redirected to after registration.
          example: https://app.example.com/welcome
        redirectUriAfterResetPassword:
          type: string
          description: URL the user is redirected to after a password reset.
          example: https://app.example.com/signin
        rememberMe:
          type: boolean
          default: false
          description: Whether users can remain logged in for a fixed duration (remember-me).
        rememberMeDuration:
          type: integer
          format: int32
          description: "Duration, in seconds, for which a remembered session stays\
            \ valid."
          example: 604800
        resetPasswordConfirmIdentity:
          type: boolean
          default: false
          description: Whether the user must confirm their identity before resetting
            a password.
        resetPasswordCustomForm:
          type: boolean
          default: false
          description: Whether a custom form is used for the password-reset step.
        resetPasswordCustomFormFields:
          type: array
          description: Custom fields rendered on the password-reset form.
          items:
            $ref: "#/components/schemas/FormField"
        resetPasswordInvalidateTokens:
          type: boolean
          default: false
          description: Whether existing tokens are invalidated when the password is
            reset.
        sendRecoverAccountEmail:
          type: boolean
          default: false
          description: Whether to send an account-recovery email.
        sendVerifyRegistrationAccountEmail:
          type: boolean
          default: false
          description: Whether to send a registration-verification email.
      title: Account settings
    AutomationCIBASettings:
      type: object
      description: "Client-Initiated Backchannel Authentication (CIBA) settings for\
        \ the domain. CIBA lets a relying party initiate end-user authentication from\
        \ a separate consumption device, without redirecting the user through the\
        \ browser. Authentication device notifiers are not managed by the Automation\
        \ API and are not exposed here."
      properties:
        authReqExpiry:
          type: integer
          format: int32
          default: 600
          description: "Default validity period, in seconds, of the issued auth_req_id."
        bindingMessageLength:
          type: integer
          format: int32
          default: 256
          description: Maximum number of characters accepted for the binding_message
            parameter.
        enabled:
          type: boolean
          default: false
          description: Whether Client-Initiated Backchannel Authentication is enabled
            for the domain.
        tokenReqInterval:
          type: integer
          format: int32
          default: 5
          description: "Minimum delay, in seconds, that a client must wait between\
            \ two polls of the token endpoint for the same auth_req_id (POLL or PING\
            \ delivery mode)."
      title: CIBA settings
    AutomationCertificate:
      type: object
      description: "A certificate managed under a domain by the Automation API. The\
        \ key field is the stable, immutable identity used for idempotent create-or-update."
      properties:
        configuration:
          type: string
          description: "Plugin-specific configuration as a JSON-encoded string. Its\
            \ shape is defined by the selected certificate type. Sensitive values,\
            \ as flagged by the plugin, are returned as ******** in every response;\
            \ an unset sensitive value is omitted. Sending ******** back on update\
            \ keeps the stored value; sending it on create is rejected. The uploaded\
            \ keystore file is masked too; sending ******** back keeps it."
          example: "{\"jks\":{\"content\":\"...\",\"name\":\"keystore.jks\"},\"storepass\"\
            :\"secret\",\"alias\":\"mykey\",\"keypass\":\"secret\"}"
        createdAt:
          type: string
          format: date-time
          description: "Creation timestamp (ISO-8601 / RFC 3339, UTC). Read-only."
          readOnly: true
        dryRunErrors:
          type: array
          description: Validation errors returned when dryRun is true. Absent when
            validation succeeds.
          items:
            $ref: "#/components/schemas/DryRunError"
          readOnly: true
        expiresAt:
          type: string
          format: date-time
          description: "Expiry timestamp (ISO-8601 / RFC 3339, UTC), when known for\
            \ the certificate type. Read-only."
          readOnly: true
        key:
          type: string
          description: "Stable, immutable identifier for the certificate within its\
            \ domain. Lowercase alphanumeric and hyphens, starting and ending with\
            \ an alphanumeric character. Used to identify the certificate on create-or-update."
          example: signing-cert
          maxLength: 255
          minLength: 1
          title: Key
        name:
          type: string
          description: Human-readable name of the certificate.
          example: Signing certificate
          maxLength: 255
          minLength: 1
        system:
          type: boolean
          default: false
          description: "Whether this is the domain's system certificate. Immutable\
            \ after creation. When true, only key is required; the certificate is\
            \ built from the domains.certificates.default.* system settings and the\
            \ name, type, and configuration fields are ignored."
        type:
          type: string
          description: Certificate plugin type identifier. Immutable after creation.
          example: javakeystore-am-certificate
          maxLength: 2147483647
          minLength: 1
        updatedAt:
          type: string
          format: date-time
          description: "Last-update timestamp (ISO-8601 / RFC 3339, UTC). Read-only."
          readOnly: true
      required:
      - key
      title: Certificate
    AutomationCertificateSettings:
      type: object
      description: Domain-level certificate settings.
      properties:
        fallbackCertificate:
          type: string
          description: "Key of a certificate managed under this domain, used as the\
            \ fallback certificate when a client does not specify one. The reference\
            \ is not checked against existing certificates: it can name one created\
            \ after the domain or since deleted, and resolves whenever a certificate\
            \ with that key exists."
          example: default
      title: Certificate settings
    AutomationClientRegistrationSettings:
      type: object
      description: OpenID Connect Dynamic Client Registration configuration for the
        domain.
      properties:
        allowHttpSchemeRedirectUri:
          type: boolean
          default: false
          description: Whether the unsecured http scheme is permitted in redirect
            URIs.
        allowLocalhostRedirectUri:
          type: boolean
          default: false
          description: Whether localhost is permitted as a redirect URI host.
        allowRedirectUriParamsExpressionLanguage:
          type: boolean
          default: false
          description: Whether expression language is permitted in redirect URI parameters.
        allowWildCardRedirectUri:
          type: boolean
          default: false
          description: Whether wildcards are permitted in redirect URIs.
        allowedScopes:
          type: array
          description: Scopes permitted on client registration requests when the allowed
            list is enabled.
          items:
            type: string
            description: Scopes permitted on client registration requests when the
              allowed list is enabled.
        allowedScopesEnabled:
          type: boolean
          default: false
          description: Whether registered client scopes are restricted to an allowed
            list.
        clientTemplateEnabled:
          type: boolean
          default: false
          description: Whether a client may be used as a template for dynamic client
            registration.
        defaultScopes:
          type: array
          description: Default scopes added to every client registration request.
          items:
            type: string
            description: Default scopes added to every client registration request.
        dynamicClientRegistrationEnabled:
          type: boolean
          default: false
          description: Whether Dynamic Client Registration is enabled for the domain.
        openDynamicClientRegistrationEnabled:
          type: boolean
          default: false
          description: Whether open (unauthenticated) Dynamic Client Registration
            is enabled for the domain.
      title: Client registration settings
    AutomationDataPlane:
      type: object
      description: "A data plane managed by the Automation API. Data planes store\
        \ the runtime data of the domains bound to them. The id field is the stable,\
        \ immutable identity used for idempotent create-or-update."
      properties:
        configuration:
          type: object
          description: "Connection settings. Write-only: it can hold credentials."
          example:
            mongodb:
              dbname: gravitee-am-acme
              host: mongo
              port: 27017
          writeOnly: true
        createdAt:
          type: string
          format: date-time
          description: "Creation timestamp (ISO-8601 / RFC 3339, UTC). Read-only."
          readOnly: true
        database:
          type: string
          description: Name of the database the configuration points at. Read-only.
          example: gravitee-am-acme
          readOnly: true
        environmentId:
          type: string
          description: Identifier of the environment the data plane belongs to. Read-only.
          example: DEFAULT
          readOnly: true
        gatewayUrl:
          type: string
          description: Base URL of the gateway serving the domains bound to this data
            plane. Must be an absolute http(s) URL with a lowercase scheme; omitted
            or empty leaves it unset.
          example: https://gateway-eu.example.com
          maxLength: 256
          minLength: 0
          pattern: ^\s*$|^https?://.+
        hosts:
          type: array
          description: "Hosts the configuration points at, as host:port. Read-only."
          example:
          - mongo:27017
          items:
            type: string
            description: "Hosts the configuration points at, as host:port. Read-only."
            example: "[\"mongo:27017\"]"
            readOnly: true
          readOnly: true
        id:
          type: string
          description: "Stable, immutable identifier for the data plane within its\
            \ environment. Lowercase alphanumeric and hyphens, starting and ending\
            \ with an alphanumeric character. This is the value a domain's dataPlaneId\
            \ refers to."
          example: acme-eu
          maxLength: 64
          minLength: 1
        name:
          type: string
          description: Human-readable name of the data plane.
          example: ACME EU data plane
          maxLength: 128
          minLength: 1
        organizationId:
          type: string
          description: Identifier of the organization the data plane belongs to. Read-only.
          example: DEFAULT
          readOnly: true
        type:
          type: string
          description: "Data plane plugin type identifier, matching the dataplane-am-<type>\
            \ plugin. Immutable after creation."
          example: mongodb
        updatedAt:
          type: string
          format: date-time
          description: "Last-update timestamp (ISO-8601 / RFC 3339, UTC). Read-only."
          readOnly: true
      required:
      - id
      title: Data plane
    AutomationDomain:
      type: object
      description: "A security domain managed by the Automation API. The key field\
        \ is the stable, immutable identity used for idempotent create-or-update.\
        \ Certificates, identity providers, and reporters are not embedded; they are\
        \ managed via the domain's sub-resource endpoints and referenced here by key."
      properties:
        accountSettings:
          $ref: "#/components/schemas/AutomationAccountSettings"
        alertEnabled:
          type: boolean
          default: false
          description: Whether alerting is enabled for the domain.
        certificateSettings:
          $ref: "#/components/schemas/AutomationCertificateSettings"
        corsSettings:
          $ref: "#/components/schemas/CorsSettings"
        createdAt:
          type: string
          format: date-time
          description: "Creation timestamp (ISO-8601 / RFC 3339, UTC). Read-only."
          readOnly: true
        dataPlaneId:
          type: string
          description: "Identifier of the data plane this domain is connected to.\
            \ Optional at creation and resolved from the environment's data planes\
            \ when omitted. Immutable afterwards: an apply that names a different\
            \ one is rejected."
          example: default
          maxLength: 255
          minLength: 0
        description:
          type: string
          description: Human-readable description of the domain.
          example: An example authentication domain
        dryRunErrors:
          type: array
          description: Validation errors returned when dryRun is true. Absent when
            validation succeeds.
          items:
            $ref: "#/components/schemas/DryRunError"
          readOnly: true
        enabled:
          type: boolean
          default: true
          description: Whether the domain handles incoming authentication and authorization
            requests.
        key:
          type: string
          description: "Stable, immutable identifier for the domain within its environment.\
            \ Lowercase alphanumeric and hyphens, starting and ending with an alphanumeric\
            \ character. Used to identify the domain on create-or-update."
          example: example-domain
          maxLength: 255
          minLength: 1
          title: Key
        keyRetrievalSettings:
          $ref: "#/components/schemas/KeyRetrievalSettings"
        loginSettings:
          $ref: "#/components/schemas/LoginSettings"
        master:
          type: boolean
          default: false
          description: Whether this is the master domain of its environment. A master
            domain may perform cross-domain token introspection.
        name:
          type: string
          description: Human-readable name of the domain.
          example: Example domain
          maxLength: 255
          minLength: 1
        oidc:
          $ref: "#/components/schemas/AutomationOidcSettings"
        passwordSettings:
          $ref: "#/components/schemas/PasswordSettings"
        path:
          type: string
          description: "Context path the domain is served under, relative to the gateway.\
            \ Must start with a slash."
          example: /example-domain
          maxLength: 255
          minLength: 1
          pattern: ^/.*
        saml:
          $ref: "#/components/schemas/AutomationSamlSettings"
        scim:
          $ref: "#/components/schemas/SCIMSettings"
        secretExpirationSettings:
          $ref: "#/components/schemas/SecretExpirationSettings"
        selfServiceAccountManagementSettings:
          $ref: "#/components/schemas/SelfServiceAccountManagementSettings"
        tags:
          type: array
          description: Sharding tags that control which gateways deploy this domain.
          example:
          - eu
          - production
          items:
            type: string
            description: Sharding tags that control which gateways deploy this domain.
            example: "[\"eu\",\"production\"]"
          uniqueItems: true
        tokenExchangeSettings:
          $ref: "#/components/schemas/TokenExchangeSettings"
        uma:
          $ref: "#/components/schemas/UMASettings"
        updatedAt:
          type: string
          format: date-time
          description: "Last-update timestamp (ISO-8601 / RFC 3339, UTC). Read-only."
          readOnly: true
        vhostMode:
          type: boolean
          default: false
          description: "Whether the domain is exposed through its virtual hosts rather\
            \ than the default context path. When true, vhosts must be supplied."
        vhosts:
          type: array
          description: "Virtual hosts the domain is exposed on, overriding the default\
            \ context path."
          items:
            $ref: "#/components/schemas/VirtualHost"
        webAuthnSettings:
          $ref: "#/components/schemas/WebAuthnSettings"
        webProtectionSettings:
          $ref: "#/components/schemas/WebProtectionSettings"
      required:
      - key
      - name
      - path
      title: Domain
    AutomationIdentityProvider:
      type: object
      description: "An identity provider managed under a domain by the Automation\
        \ API. The key field is the stable, immutable identity used for idempotent\
        \ create-or-update."
      properties:
        configuration:
          type: string
          description: "Plugin-specific configuration as a JSON-encoded string. Its\
            \ shape is defined by the selected identity provider type. Sensitive values,\
            \ as flagged by the plugin, are returned as ******** in every response;\
            \ an unset sensitive value is omitted. Sending ******** back on update\
            \ keeps the stored value; sending it on create is rejected."
          example: "{\"users\":[{\"username\":\"admin\",\"password\":\"...\"}]}"
        createdAt:
          type: string
          format: date-time
          description: "Creation timestamp (ISO-8601 / RFC 3339, UTC). Read-only."
          readOnly: true
        domainWhitelist:
          type: array
          default: []
          description: "Email domains allowed to authenticate through this identity\
            \ provider. When set, users whose email domain is not listed are rejected."
          example:
          - example.com
          items:
            type: string
        dryRunErrors:
          type: array
          description: Validation errors returned when dryRun is true. Absent when
            validation succeeds.
          items:
            $ref: "#/components/schemas/DryRunError"
          readOnly: true
        groupMapper:
          type: object
          additionalProperties:
            type: array
            items:
              type: string
          default: {}
          description: "Group mapper: assigns AM groups based on provider attribute\
            \ values. Each entry maps a group to the user attribute expressions that\
            \ grant it."
        key:
          type: string
          description: "Stable, immutable identifier for the identity provider within\
            \ its domain. Lowercase alphanumeric and hyphens, starting and ending\
            \ with an alphanumeric character. Used to identify the identity provider\
            \ on create-or-update."
          example: corporate-ldap
          maxLength: 255
          minLength: 1
          title: Key
        mappers:
          type: object
          additionalProperties:
            type: string
          default: {}
          description: "Attribute mappers: maps provider claims to AM user profile\
            \ attributes."
          example:
            email: email
            sub: username
        name:
          type: string
          description: Human-readable name of the identity provider.
          example: Corporate LDAP
          maxLength: 255
          minLength: 1
        roleMapper:
          type: object
          additionalProperties:
            type: array
            items:
              type: string
          default: {}
          description: "Role mapper: assigns AM roles based on provider attribute\
            \ values. Each entry maps a role to the user attribute expressions that\
            \ grant it."
        system:
          type: boolean
          default: false
          description: "Whether this is the domain's system identity provider. Immutable\
            \ after creation. When true, only key is required; the identity provider\
            \ is built from the domains.identities.default.* system settings and the\
            \ name, type, and configuration fields are ignored."
        type:
          type: string
          description: Identity provider plugin type identifier. Immutable after creation.
          example: inline-am-idp
        updatedAt:
          type: string
          format: date-time
          description: "Last-update timestamp (ISO-8601 / RFC 3339, UTC). Read-only."
          readOnly: true
      required:
      - key
      title: Identity provider
    AutomationOidcSettings:
      type: object
      description: OpenID Connect settings for the domain. CIMD (client identity metadata
        document) settings are not exposed by the Automation API and are reset on
        update.
      properties:
        cibaSettings:
          $ref: "#/components/schemas/AutomationCIBASettings"
        clientRegistrationSettings:
          $ref: "#/components/schemas/AutomationClientRegistrationSettings"
        postLogoutRedirectUris:
          type: array
          description: URLs the user may be redirected to after sign-out (post_logout_redirect_uri).
          items:
            type: string
            description: URLs the user may be redirected to after sign-out (post_logout_redirect_uri).
        redirectUriStrictMatching:
          type: boolean
          default: false
          description: Whether redirect_uri and post_logout_redirect_uri values are
            matched strictly during OpenID Connect flows.
        requestUris:
          type: array
          description: Allowed request_uri values for passing OpenID Connect request
            objects by reference.
          items:
            type: string
            description: Allowed request_uri values for passing OpenID Connect request
              objects by reference.
        securityProfileSettings:
          $ref: "#/components/schemas/SecurityProfileSettings"
        workloadIdentitySettings:
          $ref: "#/components/schemas/SpiffeDomainSettings"
      title: OpenID Connect settings
    AutomationReporter:
      type: object
      description: "A reporter managed under a domain by the Automation API. Reporters\
        \ persist audit events to a backend. The key field is the stable, immutable\
        \ identity used for idempotent create-or-update."
      properties:
        attributeMappingEventTypes:
          type: array
          description: Audit event types the attribute mappings apply to. Empty means
            every event type. Ignored when system is true.
          items:
            type: string
            description: Audit event types the attribute mappings apply to. Empty
              means every event type. Ignored when system is true.
          uniqueItems: true
        attributeMappings:
          type: array
          description: Additional attributes exported alongside the regular audit
            payload. Each entry pairs an expression read from the audit context with
            the field name its value is exported under. Ignored when system is true;
            a system reporter exports no additional attributes.
          items:
            $ref: "#/components/schemas/ReporterAttributeMapping"
        configuration:
          type: string
          description: "Plugin-specific configuration as a JSON-encoded string. Its\
            \ shape is defined by the selected reporter type. Sensitive values, as\
            \ flagged by the plugin, are returned as ******** in every response; an\
            \ unset sensitive value is omitted. Sending ******** back on update keeps\
            \ the stored value; sending it on create is rejected."
          example: "{\"bootstrapServers\":\"kafka:9092\",\"topic\":\"audit\"}"
        createdAt:
          type: string
          format: date-time
          description: "Creation timestamp (ISO-8601 / RFC 3339, UTC). Read-only."
          readOnly: true
        dataType:
          type: string
          description: "Category of data the reporter handles, derived from its type.\
            \ Read-only."
          readOnly: true
        dryRunErrors:
          type: array
          description: Validation errors returned when dryRun is true. Absent when
            validation succeeds.
          items:
            $ref: "#/components/schemas/DryRunError"
          readOnly: true
        enabled:
          type: boolean
          default: true
          description: Whether the reporter is enabled.
        key:
          type: string
          description: "Stable, immutable identifier for the reporter within its domain.\
            \ Lowercase alphanumeric and hyphens, starting and ending with an alphanumeric\
            \ character. Used to identify the reporter on create-or-update."
          example: audit-kafka
          maxLength: 255
          minLength: 1
          title: Key
        name:
          type: string
          description: Human-readable name of the reporter.
          example: Audit events to Kafka
          maxLength: 255
          minLength: 1
        system:
          type: boolean
          default: false
          description: "Whether this is the domain's system reporter. Immutable after\
            \ creation. When true, only key is required; the reporter is built from\
            \ the domains.reporters.default.* and repository system settings and the\
            \ name, type, configuration, attributeMappings and attributeMappingEventTypes\
            \ fields are ignored."
        type:
          type: string
          description: Reporter plugin type identifier. Immutable after creation.
          example: reporter-am-kafka
        updatedAt:
          type: string
          format: date-time
          description: "Last-update timestamp (ISO-8601 / RFC 3339, UTC). Read-only."
          readOnly: true
      required:
      - key
      title: Reporter
    AutomationSamlSettings:
      type: object
      description: Settings for the domain acting as a SAML 2.0 identity provider
        (IdP).
      properties:
        certificate:
          type: string
          description: "Key of a certificate managed under this domain, used to sign\
            \ SAML responses. The reference is not checked against existing certificates:\
            \ it can name one created after the domain or since deleted, and resolves\
            \ whenever a certificate with that key exists."
          example: signing-cert
        enabled:
          type: boolean
          default: false
          description: Whether the domain exposes the SAML 2.0 IdP protocol.
        entityId:
          type: string
          description: URL or URN that uniquely identifies this IdP (the SAML entity
            ID).
          example: https://auth.example.com/saml2/idp/entity
      title: SAML 2.0 settings
    CorsSettings:
      type: object
      description: Cross-Origin Resource Sharing configuration controlling which web
        origins may call the domain's endpoints from a browser.
      properties:
        allowCredentials:
          type: boolean
          default: false
          description: "Whether the browser may send credentials (cookies, authorization\
            \ headers) with cross-origin requests."
        allowedHeaders:
          type: array
          description: Request headers permitted on cross-origin requests.
          example:
          - Authorization
          - Content-Type
          items:
            type: string
            description: Request headers permitted on cross-origin requests.
            example: "[\"Authorization\",\"Content-Type\"]"
          uniqueItems: true
        allowedMethods:
          type: array
          description: HTTP methods permitted on cross-origin requests.
          example:
          - GET
          - POST
          - PUT
          - DELETE
          items:
            type: string
            description: HTTP methods permitted on cross-origin requests.
            example: "[\"GET\",\"POST\",\"PUT\",\"DELETE\"]"
          uniqueItems: true
        allowedOrigins:
          type: array
          description: Origins permitted to make cross-origin requests. Use "*" to
            allow any origin.
          example:
          - https://app.example.com
          items:
            type: string
            description: Origins permitted to make cross-origin requests. Use "*"
              to allow any origin.
            example: "[\"https://app.example.com\"]"
          uniqueItems: true
        enabled:
          type: boolean
          default: false
          description: Whether CORS handling is enabled for the domain when not inherited.
        inherited:
          type: boolean
          default: true
          description: "Whether CORS settings are inherited from the gateway defaults\
            \ (gravitee.yml). When null, legacy behaviour applies: enabled=true overrides\
            \ and enabled=false inherits."
        maxAge:
          type: integer
          format: int32
          default: 86400
          description: "How long, in seconds, a browser may cache the result of a\
            \ preflight request."
      title: CORS settings
    CspSettings:
      type: object
      description: Content Security Policy configuration for the domain's login and
        consent pages.
      properties:
        directives:
          type: array
          description: "CSP directives, one per entry, in the form \"directive-name\
            \ value\". A trailing semicolon is optional. Directive names must be valid\
            \ CSP tokens and must not repeat; values are not interpreted. Directives\
            \ that take no value, such as \"upgrade-insecure-requests\", may be supplied\
            \ on their own. When reportOnly is enabled, a \"report-uri\" or \"report-to\"\
            \ directive is required."
          example:
          - default-src 'self'
          - script-src 'self'
          - upgrade-insecure-requests
          items:
            type: string
            description: "CSP directives, one per entry, in the form \"directive-name\
              \ value\". A trailing semicolon is optional. Directive names must be\
              \ valid CSP tokens and must not repeat; values are not interpreted.\
              \ Directives that take no value, such as \"upgrade-insecure-requests\"\
              , may be supplied on their own. When reportOnly is enabled, a \"report-uri\"\
              \ or \"report-to\" directive is required."
            example: "[\"default-src 'self'\",\"script-src 'self'\",\"upgrade-insecure-requests\"\
              ]"
        enabled:
          type: boolean
          default: false
          description: Whether CSP is enabled for the domain when not inherited.
        inherited:
          type: boolean
          default: true
          description: "Whether CSP settings are inherited from the gateway defaults\
            \ (gravitee.yml). When null, legacy behaviour applies: enabled=true overrides\
            \ and enabled=false inherits."
        reportOnly:
          type: boolean
          default: false
          description: "When true, the policy is delivered as Content-Security-Policy-Report-Only."
        scriptInlineNonce:
          type: boolean
          default: true
          description: Whether inline scripts are allowed via a per-request nonce.
      title: CSP settings
    DryRunError:
      type: object
      description: Validation errors returned when dryRun is true. Absent when validation
        succeeds.
      properties:
        message:
          type: string
        severity:
          $ref: "#/components/schemas/Severity"
      readOnly: true
    Error:
      type: object
      description: Error response body returned for failed requests.
      properties:
        http_status:
          type: integer
          format: int32
          description: HTTP status code of the error response.
          example: 400
        message:
          type: string
          description: Human-readable description of the error.
    FormField:
      type: object
      description: "A single field shown on a user-facing form, such as registration."
      properties:
        key:
          type: string
          description: "Identifier of the field, mapped to a user attribute."
          example: email
        label:
          type: string
          description: Label displayed for the field.
          example: Email
        type:
          type: string
          description: Input type of the field.
          example: email
      title: Form field
    IdJagSettings:
      type: object
      description: ID-JAG issuance behavior of token exchange.
      properties:
        laxValidation:
          type: boolean
          default: false
          description: "Lax validation: also accept an access token as the subject\
            \ token. By default only an ID token is accepted. The access token must\
            \ be issued to the requesting client or, when an MCP server requests,\
            \ have that MCP server as audience."
      title: ID-JAG settings
    KeyRetrievalSettings:
      type: object
      description: "Fetch, SSRF and cache limits applied to every trusted domain in\
        \ the security domain."
      properties:
        allowPrivateIpAddress:
          type: boolean
          default: false
          description: Whether key material can be fetched from private IP addresses.
        allowUnsecuredHttpUri:
          type: boolean
          default: false
          description: Whether key material can be fetched over unsecured HTTP URIs.
        cacheMaxEntries:
          type: integer
          format: int32
          default: 50
          description: Maximum number of key material entries retained in the cache.
        cacheTtlSeconds:
          type: integer
          format: int32
          default: 300
          description: "Time-to-live, in seconds, for cached key material."
        fetchTimeoutMs:
          type: integer
          format: int32
          default: 5000
          description: "Timeout, in milliseconds, for fetching key material."
        maxResponseSizeKb:
          type: integer
          format: int32
          default: 32
          description: "Maximum key material response size, in kilobytes."
      title: Trusted domain key retrieval settings
    LoginSettings:
      type: object
      description: Configuration of the domain's login flow and the features offered
        on the sign-in page.
      properties:
        certificateBasedAuthEnabled:
          type: boolean
          default: false
          description: Whether certificate-based authentication is offered.
        certificateBasedAuthUrl:
          type: string
          description: URL used for certificate-based authentication.
        forgotPasswordEnabled:
          type: boolean
          default: false
          description: Whether users can initiate a forgot-password flow from the
            login page.
        hideForm:
          type: boolean
          default: false
          description: Whether the login form is hidden (for example when only social
            or identifier-first login is offered).
        identifierFirstEnabled:
          type: boolean
          default: false
          description: "Whether identifier-first login is enabled, prompting for the\
            \ username before the password."
        inherited:
          type: boolean
          default: true
          description: "Whether these login settings are inherited from a parent scope\
            \ rather than defined here. When true, the other fields are ignored."
        magicLinkAuthEnabled:
          type: boolean
          default: false
          description: Whether magic-link authentication is offered.
        passwordlessDeviceNamingEnabled:
          type: boolean
          default: false
          description: Whether users can name their passwordless devices.
        passwordlessEnabled:
          type: boolean
          default: false
          description: Whether passwordless (WebAuthn) authentication is offered.
        passwordlessEnforcePasswordEnabled:
          type: boolean
          default: false
          description: Whether a password is still required alongside passwordless
            authentication.
        passwordlessEnforcePasswordMaxAge:
          type: integer
          format: int32
          description: "Period, in seconds, after which the user's credentials must\
            \ be re-entered to keep using passwordless authentication."
        passwordlessRememberDeviceEnabled:
          type: boolean
          default: false
          description: Whether a passwordless device can be remembered to skip future
            challenges.
        registerEnabled:
          type: boolean
          default: false
          description: Whether users can self-register from the login page.
        rememberMeEnabled:
          type: boolean
          default: false
          description: Whether the login page offers a remember-me option.
        resetPasswordOnExpiration:
          type: boolean
          description: Whether the user is forced to reset their password once it
            expires.
      title: Login settings
    PasswordSettings:
      type: object
      description: "Password policy applied to users of the domain: complexity requirements,\
        \ expiry, and history."
      properties:
        excludePasswordsInDictionary:
          type: boolean
          description: Whether passwords found in a common-password dictionary are
            rejected.
        excludeUserProfileInfoInPassword:
          type: boolean
          description: Whether passwords containing the user's profile information
            are rejected.
        expiryDuration:
          type: integer
          format: int32
          description: Number of days after which a password expires and must be changed.
        includeNumbers:
          type: boolean
          description: Whether a password must contain at least one number.
        includeSpecialCharacters:
          type: boolean
          description: Whether a password must contain at least one special character.
        inherited:
          type: boolean
          default: true
          description: "Whether these password settings are inherited from a parent\
            \ scope rather than defined here. When true, the other fields are ignored."
        lettersInMixedCase:
          type: boolean
          description: Whether a password must contain both uppercase and lowercase
            letters.
        maxConsecutiveLetters:
          type: integer
          format: int32
          description: Maximum number of identical consecutive characters allowed
            in a password.
        maxLength:
          type: integer
          format: int32
          default: 128
          description: Maximum number of characters a password may contain.
        minLength:
          type: integer
          format: int32
          default: 8
          description: Minimum number of characters a password must contain.
        oldPasswords:
          type: integer
          format: int32
          description: Number of previous passwords retained in history and barred
            from reuse.
        passwordHistoryEnabled:
          type: boolean
          default: false
          description: Whether password history is enforced to prevent reuse of recent
            passwords.
      title: Password settings
    ReporterAttributeMapping:
      type: object
      description: "Exports one additional attribute, read from the audit context\
        \ by expression, under a chosen field name."
      properties:
        exportedName:
          type: string
          description: The name the evaluated value takes on the exported payload.
          example: user_sub
        expression:
          type: string
          description: Expression evaluated against the audit context.
          example: "{#context.attributes['user'].additionalInformation['sub']}"
      title: Reporter attribute mapping
    ResetPasswordSettings:
      type: object
      description: Rules applied to a self-service password reset.
      properties:
        oldPasswordRequired:
          type: boolean
          default: false
          description: Whether the user must supply their current password to set
            a new one.
        tokenAge:
          type: integer
          format: int32
          description: "Lifetime, in seconds, of the password-reset token."
      title: Reset-password settings
    SCIMSettings:
      type: object
      description: Configuration of the domain's SCIM 2.0 provisioning endpoints.
      properties:
        enabled:
          type: boolean
          default: false
          description: Whether the SCIM provisioning API is enabled for the domain.
        idpSelectionEnabled:
          type: boolean
          default: false
          description: Whether an identity provider is selected for SCIM-provisioned
            users using a selection rule.
        idpSelectionRule:
          type: string
          description: Expression that selects the identity provider for a SCIM-provisioned
            user.
      title: SCIM settings
    SecretExpirationSettings:
      type: object
      description: Controls whether client secrets in the domain expire and after
        how long.
      properties:
        enabled:
          type: boolean
          description: Whether client-secret expiration is enabled.
        expiryTimeSeconds:
          type: integer
          format: int64
          description: "Lifetime, in seconds, of a client secret before it expires."
          example: 7776000
      title: Secret expiration settings
    SecurityProfileSettings:
      type: object
      description: Financial-grade API (FAPI) security profile configuration for the
        domain.
      properties:
        enableFapiBrazil:
          type: boolean
          default: false
          description: Whether the Open Banking Brasil Financial-grade API security
            profile (version 1.0) is applied.
        enablePlainFapi:
          type: boolean
          default: false
          description: Whether the standard Financial-grade API security profile (version
            1.0) is applied.
      title: Security profile settings
    SelfServiceAccountManagementSettings:
      type: object
      description: "Controls whether end users can manage their own account (for example,\
        \ reset their password) and the rules that apply."
      properties:
        enabled:
          type: boolean
          default: false
          description: Whether self-service account management is enabled for end
            users.
        resetPassword:
          $ref: "#/components/schemas/ResetPasswordSettings"
      title: Self-service account management settings
    Severity:
      type: string
      enum:
      - error
      - warning
    SpiffeDomainSettings:
      type: object
      description: Workload identity (SPIFFE) settings for the domain.
      properties:
        allowPrivateIpAddress:
          type: boolean
          deprecated: true
          description: "Deprecated: moved to keyRetrievalSettings.allowPrivateIpAddress."
        allowUnsecuredHttpUri:
          type: boolean
          deprecated: true
          description: "Deprecated: moved to keyRetrievalSettings.allowUnsecuredHttpUri."
        cacheMaxEntries:
          type: integer
          format: int32
          deprecated: true
          description: "Deprecated: moved to keyRetrievalSettings.cacheMaxEntries."
        cacheTtlSeconds:
          type: integer
          format: int32
          deprecated: true
          description: "Deprecated: moved to keyRetrievalSettings.cacheTtlSeconds."
        clockSkewSeconds:
          type: integer
          format: int32
          default: 30
          description: "Allowed clock skew, in seconds, when validating JWT temporal\
            \ claims."
        defaultAllowedAlgorithms:
          type: array
          default:
          - RS256
          - RS384
          - RS512
          - ES256
          - ES384
          - ES512
          - EdDSA
          description: Default allowlist of signature algorithms accepted for SPIFFE
            JWT validation.
          items:
            type: string
        enabled:
          type: boolean
          default: false
          description: Whether SPIFFE workload identity support is enabled for the
            domain.
        fetchTimeoutMs:
          type: integer
          format: int32
          deprecated: true
          description: "Deprecated: moved to keyRetrievalSettings.fetchTimeoutMs."
        maxJwtLifetimeSeconds:
          type: integer
          format: int32
          default: 300
          description: "Maximum accepted JWT lifetime, in seconds, computed as exp\
            \ minus iat."
        maxResponseSizeKb:
          type: integer
          format: int32
          deprecated: true
          description: "Deprecated: moved to keyRetrievalSettings.maxResponseSizeKb."
    TokenExchangeOAuthSettings:
      type: object
      description: "OAuth-specific token-exchange behavior, such as how scopes are\
        \ handled, with optional inheritance from domain defaults."
      properties:
        inherited:
          type: boolean
          default: true
          description: Whether these settings are inherited from the domain defaults
            rather than defined here.
        scopeHandling:
          type: string
          default: downscoping
          description: How scopes are handled when issuing the exchanged token. DOWNSCOPING
            restricts the issued token to a subset of the original scopes.
          enum:
          - downscoping
          - permissive
      title: Token exchange OAuth settings
    TokenExchangeSettings:
      type: object
      description: "OAuth 2.0 Token Exchange (RFC 8693) configuration for the domain,\
        \ covering impersonation and delegation."
      properties:
        allowDelegation:
          type: boolean
          default: false
          description: "Whether delegation is allowed, where an actor acts on behalf\
            \ of the subject and an \"act\" claim is added to the issued token. At\
            \ least one of allowImpersonation or allowDelegation must be enabled."
        allowImpersonation:
          type: boolean
          default: true
          description: "Whether impersonation is allowed, where the issued token represents\
            \ the subject directly. At least one of allowImpersonation or allowDelegation\
            \ must be enabled."
        allowedActorTokenTypes:
          type: array
          description: Token types accepted as the actor token when delegating.
          example:
          - urn:ietf:params:oauth:token-type:access_token
          - urn:ietf:params:oauth:token-type:id_token
          items:
            type: string
            description: Token types accepted as the actor token when delegating.
            example: "[\"urn:ietf:params:oauth:token-type:access_token\",\"urn:ietf:params:oauth:token-type:id_token\"\
              ]"
        allowedRequestedTokenTypes:
          type: array
          description: Token types that may be requested as the result of an exchange.
          example:
          - urn:ietf:params:oauth:token-type:access_token
          - urn:ietf:params:oauth:token-type:id_token
          items:
            type: string
            description: Token types that may be requested as the result of an exchange.
            example: "[\"urn:ietf:params:oauth:token-type:access_token\",\"urn:ietf:params:oauth:token-type:id_token\"\
              ]"
        allowedSubjectTokenTypes:
          type: array
          description: Token types accepted as the subject token in an exchange.
          example:
          - urn:ietf:params:oauth:token-type:access_token
          - urn:ietf:params:oauth:token-type:id_token
          items:
            type: string
            description: Token types accepted as the subject token in an exchange.
            example: "[\"urn:ietf:params:oauth:token-type:access_token\",\"urn:ietf:params:oauth:token-type:id_token\"\
              ]"
        enabled:
          type: boolean
          default: false
          description: Whether token exchange is enabled for the domain.
        idJagSettings:
          $ref: "#/components/schemas/IdJagSettings"
        maxDelegationDepth:
          type: integer
          format: int32
          default: 25
          description: Maximum depth of the delegation chain (nested "act" claims).
            Range 1–100.
          maximum: 100
          minimum: 1
        tokenExchangeOAuthSettings:
          $ref: "#/components/schemas/TokenExchangeOAuthSettings"
        trustedIssuers:
          type: array
          deprecated: true
          description: "Deprecated: use the trusted-domains API instead. External\
            \ issuers whose JWTs may be accepted as subject or actor tokens. A projection\
            \ over the security domain's token-exchange trusted domains; a write replaces\
            \ the list, so an omitted issuer is no longer trusted."
          items:
            $ref: "#/components/schemas/TrustedIssuer"
      title: Token exchange settings
    TrustedIssuer:
      type: object
      deprecated: true
      description: "An external token issuer whose JWTs are accepted as subject or\
        \ actor tokens during token exchange, validated with the configured key material."
      properties:
        certificate:
          type: string
          description: PEM-encoded X.509 certificate. Required when keyResolutionMethod
            is PEM.
        issuer:
          type: string
          description: Expected value of the "iss" claim in the external JWT.
          example: https://issuer.example.com
        jwksUri:
          type: string
          description: JWKS endpoint URL. Required when keyResolutionMethod is JWKS_URL.
          example: https://issuer.example.com/.well-known/jwks.json
        keyResolutionMethod:
          type: string
          description: How the issuer's signing key is resolved. JWKS_URL fetches
            keys from a JWKS endpoint; PEM uses an inline X.509 certificate.
          enum:
          - jwks_url
          - pem
        scopeMappings:
          type: object
          additionalProperties:
            type: string
            description: One-to-one mapping from external scope to domain scope. Unmapped
              issuer scopes are dropped (fail-closed).
          description: One-to-one mapping from external scope to domain scope. Unmapped
            issuer scopes are dropped (fail-closed).
        userBindingCriteria:
          type: array
          description: Criteria used to locate a domain user when user binding is
            enabled. All criteria are combined with AND.
          items:
            $ref: "#/components/schemas/UserBindingCriterion"
        userBindingEnabled:
          type: boolean
          default: false
          description: "Whether the external JWT subject is resolved to a single domain\
            \ user using the user binding criteria. When false, a virtual user is\
            \ built from the token claims only."
      title: Trusted issuer
    UMASettings:
      type: object
      description: Configuration of the domain's User-Managed Access (UMA 2.0) authorization
        features.
      properties:
        enabled:
          type: boolean
          default: false
          description: Whether User-Managed Access is enabled for the domain.
      title: UMA settings
    UserBindingCriterion:
      type: object
      description: A single rule that matches a domain user attribute against a value
        derived from the external token claims.
      properties:
        attribute:
          type: string
          description: Domain user attribute used for the lookup. Must match a field
            supported by the user repository search.
          example: emails.value
        expression:
          type: string
          description: Expression evaluated against the validated token claims (variable
            "token") to produce the value to match.
          example: "{#token['email']}"
      title: User binding criterion
    VirtualHost:
      type: object
      description: A host and path the domain is exposed on. The host and path combination
        must be unique across all domains.
      properties:
        host:
          type: string
          description: Hostname the domain is served on.
          example: auth.example.com
        overrideEntrypoint:
          type: boolean
          default: false
          description: Whether this virtual host overrides the organization entry
            point.
        path:
          type: string
          description: Context path the domain is served under on this host.
          example: /customers
      title: Virtual host
    WebAuthnSettings:
      type: object
      description: WebAuthn (FIDO2) relying-party configuration governing passwordless
        and multi-factor authentication for the domain.
      properties:
        attestationConveyancePreference:
          type: string
          default: none
          description: "Relying-party preference for attestation conveyance during\
            \ credential creation. NONE requests no attestation, INDIRECT allows anonymized\
            \ attestation, and DIRECT requests the authenticator's attestation statement."
          enum:
          - none
          - indirect
          - direct
        authenticatorAttachment:
          type: string
          description: Preferred authenticator attachment. PLATFORM selects authenticators
            bound to the device (such as a fingerprint reader); CROSS_PLATFORM selects
            roaming authenticators (such as a security key).
          enum:
          - cross_platform
          - platform
        certificates:
          type: object
          additionalProperties:
            type: string
            description: "Trusted device-attestation X.509 certificates, keyed by\
              \ name."
          description: "Trusted device-attestation X.509 certificates, keyed by name."
        enforceAuthenticatorIntegrity:
          type: boolean
          default: false
          description: Whether to periodically re-verify that registered authenticators
            remain valid against the FIDO2 Metadata Service.
        enforceAuthenticatorIntegrityMaxAge:
          type: integer
          format: int32
          description: "Maximum elapsed time, in seconds, since an authenticator was\
            \ last verified before it is re-checked on the next passwordless login."
        forceRegistration:
          type: boolean
          default: false
          description: Whether to reject registration of a credential already registered
            to a different user.
        origin:
          type: string
          description: Relying-party origin; must match the browser's window.location.origin
            during registration and authentication ceremonies.
          example: https://auth.example.com
        relyingPartyId:
          type: string
          description: "Relying-party identifier: a domain string that scopes credentials\
            \ to this entity. A credential can only be used with the relying party\
            \ it was registered against."
          example: auth.example.com
        relyingPartyName:
          type: string
          description: Human-readable relying-party name shown to users during ceremonies.
          example: Example Inc.
        requireResidentKey:
          type: boolean
          default: false
          description: Whether the authenticator must create a client-side resident
            (discoverable) credential.
        userVerification:
          type: string
          default: preferred
          description: "Relying-party requirement regarding user verification during\
            \ a ceremony. REQUIRED enforces verification, PREFERRED requests it when\
            \ available, and DISCOURAGED avoids it."
          enum:
          - required
          - preferred
          - discouraged
      title: WebAuthn settings
    WebProtectionSettings:
      type: object
      description: HTTP security headers applied to the domain's login and consent
        pages.
      properties:
        csp:
          $ref: "#/components/schemas/CspSettings"
        xframe:
          $ref: "#/components/schemas/XFrameSettings"
        xss:
          $ref: "#/components/schemas/XssProtectionSettings"
      title: Web protection settings
    XFrameSettings:
      type: object
      description: Controls whether the domain's pages may be embedded in frames on
        other origins.
      properties:
        action:
          type: string
          description: X-Frame-Options action. Omit to leave the header out.
          enum:
          - DENY
          - SAMEORIGIN
          example: DENY
        enabled:
          type: boolean
          default: false
          description: Whether X-Frame-Options is enabled for the domain when not
            inherited.
        inherited:
          type: boolean
          default: true
          description: "Whether X-Frame-Options settings are inherited from the gateway\
            \ defaults (gravitee.yml). When null, legacy behaviour applies: enabled=true\
            \ overrides and enabled=false inherits."
      title: X-Frame-Options settings
    XssProtectionSettings:
      type: object
      description: Controls the legacy X-XSS-Protection response header.
      properties:
        action:
          type: string
          description: Value of the X-XSS-Protection header.
          example: 1; mode=block
        enabled:
          type: boolean
          default: false
          description: Whether X-XSS-Protection is enabled for the domain when not
            inherited.
        inherited:
          type: boolean
          default: true
          description: "Whether X-XSS-Protection settings are inherited from the gateway\
            \ defaults (gravitee.yml). When null, legacy behaviour applies: enabled=true\
            \ overrides and enabled=false inherits."
      title: XSS protection settings
  securitySchemes:
    BearerAuth:
      description: "Authentication uses a bearer token: a JWT, or an opaque user service-account\
        \ access token. Every operation is additionally permission-gated against the\
        \ target organization, environment, and resource; a caller lacking the required\
        \ permission receives a 403 response."
      scheme: bearer
      type: http