# Generated with protoc-gen-openapi # https://github.com/google/gnostic/tree/master/cmd/protoc-gen-openapi openapi: 3.0.3 info: title: SSOReadyService API version: 0.0.1 paths: /v1/organizations: get: tags: - SSOReadyService description: Gets a list of organizations. operationId: SSOReadyService_ListOrganizations parameters: - name: pageToken in: query description: Pagination token. Leave empty to get the first page of results. schema: type: string responses: "200": description: OK content: application/json: schema: $ref: '#/components/schemas/ListOrganizationsResponse' default: description: Default error response content: application/json: schema: $ref: '#/components/schemas/Status' post: tags: - SSOReadyService description: Creates an organization. operationId: SSOReadyService_CreateOrganization requestBody: content: application/json: schema: $ref: '#/components/schemas/Organization' required: true responses: "200": description: OK content: application/json: schema: $ref: '#/components/schemas/CreateOrganizationResponse' default: description: Default error response content: application/json: schema: $ref: '#/components/schemas/Status' /v1/organizations/{id}: get: tags: - SSOReadyService description: Gets an organization. operationId: SSOReadyService_GetOrganization parameters: - name: id in: path description: ID of the organization to get. required: true schema: type: string responses: "200": description: OK content: application/json: schema: $ref: '#/components/schemas/GetOrganizationResponse' default: description: Default error response content: application/json: schema: $ref: '#/components/schemas/Status' patch: tags: - SSOReadyService description: Updates an organization. operationId: SSOReadyService_UpdateOrganization parameters: - name: id in: path description: ID of the organization to update. required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/Organization' required: true responses: "200": description: OK content: application/json: schema: $ref: '#/components/schemas/UpdateOrganizationResponse' default: description: Default error response content: application/json: schema: $ref: '#/components/schemas/Status' /v1/saml-connections: get: tags: - SSOReadyService description: Lists SAML connections in an organization. operationId: SSOReadyService_ListSAMLConnections parameters: - name: organizationId in: query description: The organization the SAML connections belong to. schema: type: string - name: pageToken in: query description: Pagination token. Leave empty to get the first page of results. schema: type: string responses: "200": description: OK content: application/json: schema: $ref: '#/components/schemas/ListSAMLConnectionsResponse' default: description: Default error response content: application/json: schema: $ref: '#/components/schemas/Status' post: tags: - SSOReadyService description: Creates a SAML connection. operationId: SSOReadyService_CreateSAMLConnection requestBody: content: application/json: schema: $ref: '#/components/schemas/SAMLConnection' required: true responses: "200": description: OK content: application/json: schema: $ref: '#/components/schemas/CreateSAMLConnectionResponse' default: description: Default error response content: application/json: schema: $ref: '#/components/schemas/Status' /v1/saml-connections/{id}: get: tags: - SSOReadyService description: Gets a SAML connection. operationId: SSOReadyService_GetSAMLConnection parameters: - name: id in: path description: ID of the SAML connection to get. required: true schema: type: string responses: "200": description: OK content: application/json: schema: $ref: '#/components/schemas/GetSAMLConnectionResponse' default: description: Default error response content: application/json: schema: $ref: '#/components/schemas/Status' patch: tags: - SSOReadyService description: Updates a SAML connection. operationId: SSOReadyService_UpdateSAMLConnection parameters: - name: id in: path description: The ID of the SAML connection to update. required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/SAMLConnection' required: true responses: "200": description: OK content: application/json: schema: $ref: '#/components/schemas/UpdateSAMLConnectionResponse' default: description: Default error response content: application/json: schema: $ref: '#/components/schemas/Status' /v1/saml/redeem: post: tags: - SSOReadyService description: Exchanges a SAML access code for details about your user's SAML login details. operationId: SSOReadyService_RedeemSAMLAccessCode requestBody: content: application/json: schema: $ref: '#/components/schemas/RedeemSAMLAccessCodeRequest' required: true responses: "200": description: OK content: application/json: schema: $ref: '#/components/schemas/RedeemSAMLAccessCodeResponse' default: description: Default error response content: application/json: schema: $ref: '#/components/schemas/Status' /v1/saml/redirect: post: tags: - SSOReadyService description: Gets a SAML initiation URL to redirect your users to. operationId: SSOReadyService_GetSAMLRedirectURL requestBody: content: application/json: schema: $ref: '#/components/schemas/GetSAMLRedirectURLRequest' required: true responses: "200": description: OK content: application/json: schema: $ref: '#/components/schemas/GetSAMLRedirectURLResponse' default: description: Default error response content: application/json: schema: $ref: '#/components/schemas/Status' /v1/scim-directories: get: tags: - SSOReadyService description: Gets a list of SCIM directories in an organization. operationId: SSOReadyService_ListSCIMDirectories parameters: - name: organizationId in: query description: The organization the SCIM directories belong to. schema: type: string - name: pageToken in: query description: Pagination token. Leave empty to get the first page of results. schema: type: string responses: "200": description: OK content: application/json: schema: $ref: '#/components/schemas/ListSCIMDirectoriesResponse' default: description: Default error response content: application/json: schema: $ref: '#/components/schemas/Status' post: tags: - SSOReadyService description: Creates a SCIM directory. operationId: SSOReadyService_CreateSCIMDirectory requestBody: content: application/json: schema: $ref: '#/components/schemas/SCIMDirectory' required: true responses: "200": description: OK content: application/json: schema: $ref: '#/components/schemas/CreateSCIMDirectoryResponse' default: description: Default error response content: application/json: schema: $ref: '#/components/schemas/Status' /v1/scim-directories/{id}: get: tags: - SSOReadyService description: Gets a SCIM directory. operationId: SSOReadyService_GetSCIMDirectory parameters: - name: id in: path description: The ID of the SCIM directory. required: true schema: type: string responses: "200": description: OK content: application/json: schema: $ref: '#/components/schemas/GetSCIMDirectoryResponse' default: description: Default error response content: application/json: schema: $ref: '#/components/schemas/Status' patch: tags: - SSOReadyService description: Updates a SCIM directory. operationId: SSOReadyService_UpdateSCIMDirectory parameters: - name: id in: path description: The ID of the SCIM directory to update. required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/SCIMDirectory' required: true responses: "200": description: OK content: application/json: schema: $ref: '#/components/schemas/UpdateSCIMDirectoryResponse' default: description: Default error response content: application/json: schema: $ref: '#/components/schemas/Status' /v1/scim-directories/{id}/rotate-bearer-token: post: tags: - SSOReadyService description: |- Rotates a SCIM directory's bearer token. Every SCIM directory has a bearer token that SSOReady uses to authenticate requests sent from your customer's Identity Provider. These bearer tokens are assigned by SSOReady, and are secret. Newly-created SCIM directories do not have any bearer token at all; you must use this endpoint to get an initial value. Rotating a SCIM directory bearer token immediately invalidates the previous bearer token, if any. Your customer will need to update their SCIM configuration with the new value to make SCIM syncing work again. SSOReady only stores the hash of these bearer tokens. If your customer has lost their copy, you must use this endpoint to generate a new one. operationId: SSOReadyService_RotateSCIMDirectoryBearerToken parameters: - name: id in: path description: The ID of the SCIM directory whose bearer token to rotate. required: true schema: type: string responses: "200": description: OK content: application/json: schema: $ref: '#/components/schemas/RotateSCIMDirectoryBearerTokenResponse' default: description: Default error response content: application/json: schema: $ref: '#/components/schemas/Status' /v1/scim/groups: get: tags: - SSOReadyService description: Gets a list of SCIM groups in a SCIM directory. operationId: SSOReadyService_ListSCIMGroups parameters: - name: scimDirectoryId in: query description: |- The SCIM directory to list from. One of `scimDirectoryId`, `organizationId`, or `organizationExternalId` must be specified. schema: type: string - name: organizationId in: query description: |- The ID of the organization to list from. The primary SCIM directory of this organization is used. One of `scimDirectoryId`, `organizationId`, or `organizationExternalId` must be specified. schema: type: string - name: organizationExternalId in: query description: |- The `externalId` of the organization to list from. The primary SCIM directory of this organization is used. One of `scimDirectoryId`, `organizationId`, or `organizationExternalId` must be specified. schema: type: string - name: pageToken in: query description: Pagination token. Leave empty to get the first page of results. schema: type: string responses: "200": description: OK content: application/json: schema: $ref: '#/components/schemas/ListSCIMGroupsResponse' default: description: Default error response content: application/json: schema: $ref: '#/components/schemas/Status' /v1/scim/groups/{id}: get: tags: - SSOReadyService description: Gets a SCIM group in a SCIM directory. operationId: SSOReadyService_GetSCIMGroup parameters: - name: id in: path description: ID of the SCIM group to get. required: true schema: type: string responses: "200": description: OK content: application/json: schema: $ref: '#/components/schemas/GetSCIMGroupResponse' default: description: Default error response content: application/json: schema: $ref: '#/components/schemas/Status' /v1/scim/users: get: tags: - SSOReadyService description: Gets a list of SCIM users in a SCIM directory. operationId: SSOReadyService_ListSCIMUsers parameters: - name: scimDirectoryId in: query description: |- The SCIM directory to list from. One of `scimDirectoryId`, `organizationId`, or `organizationExternalId` must be specified. schema: type: string - name: organizationId in: query description: |- The ID of the organization to list from. The primary SCIM directory of this organization is used. One of `scimDirectoryId`, `organizationId`, or `organizationExternalId` must be specified. schema: type: string - name: organizationExternalId in: query description: |- The `externalId` of the organization to list from. The primary SCIM directory of this organization is used. One of `scimDirectoryId`, `organizationId`, or `organizationExternalId` must be specified. schema: type: string - name: scimGroupId in: query description: If specified, only users that are members of this SCIM group are returned. schema: type: string - name: pageToken in: query description: Pagination token. Leave empty to get the first page of results. schema: type: string responses: "200": description: OK content: application/json: schema: $ref: '#/components/schemas/ListSCIMUsersResponse' default: description: Default error response content: application/json: schema: $ref: '#/components/schemas/Status' /v1/scim/users/{id}: get: tags: - SSOReadyService description: Gets a SCIM user. operationId: SSOReadyService_GetSCIMUser parameters: - name: id in: path description: ID of the SCIM user to get. required: true schema: type: string responses: "200": description: OK content: application/json: schema: $ref: '#/components/schemas/GetSCIMUserResponse' default: description: Default error response content: application/json: schema: $ref: '#/components/schemas/Status' /v1/setup-urls: post: tags: - SSOReadyService description: |- Creates a short-lived self-serve setup URL that you can send to your customer. Setup URLs let your customer configure their SAML settings, SCIM settings, or both. operationId: SSOReadyService_CreateSetupURL requestBody: content: application/json: schema: $ref: '#/components/schemas/CreateSetupURLRequest' required: true responses: "200": description: OK content: application/json: schema: $ref: '#/components/schemas/CreateSetupURLResponse' default: description: Default error response content: application/json: schema: $ref: '#/components/schemas/Status' components: schemas: CreateOrganizationResponse: type: object properties: organization: allOf: - $ref: '#/components/schemas/Organization' description: The created organization. CreateSAMLConnectionResponse: type: object properties: samlConnection: allOf: - $ref: '#/components/schemas/SAMLConnection' description: The created SAML connection. CreateSCIMDirectoryResponse: type: object properties: scimDirectory: allOf: - $ref: '#/components/schemas/SCIMDirectory' description: The updated SCIM directory. CreateSetupURLRequest: type: object properties: organizationId: type: string description: The organization that the setup URL is for. canManageSaml: type: boolean description: Whether the setup URL lets the user manage SAML connections. canManageScim: type: boolean description: Whether the setup URL lets the user manage SCIM directories. CreateSetupURLResponse: type: object properties: url: type: string description: |- The one-time, short-lived self-serve setup URL. Do not log or store this URL. Because this URL is one-time, loading it yourself means your customer will not be able to load it after you. GetOrganizationResponse: type: object properties: organization: allOf: - $ref: '#/components/schemas/Organization' description: The requested organization. GetSAMLConnectionResponse: type: object properties: samlConnection: allOf: - $ref: '#/components/schemas/SAMLConnection' description: The requested SAML connection. GetSAMLRedirectURLRequest: type: object properties: samlConnectionId: type: string description: |- The SAML connection to start a SAML login for. One of `samlConnectionId`, `organizationId`, or `organizationExternalId` must be specified. organizationId: type: string description: |- The ID of the organization to start a SAML login for. The primary SAML connection in this organization will be used for logins. One of `samlConnectionId`, `organizationId`, or `organizationExternalId` must be specified. organizationExternalId: type: string description: |- The `externalId` of the organization to start a SAML login for. The primary SAML connection in this organization will be used for logins. One of `samlConnectionId`, `organizationId`, or `organizationExternalId` must be specified. state: type: string description: |- This string will be returned back to you when you redeem this login's SAML access code. You can do anything you like with this `state`, but the most common use-case is to keep track of where to redirect your user back to after logging in with SAML. GetSAMLRedirectURLResponse: type: object properties: redirectUrl: type: string description: Redirect your user to this URL to start a SAML login. GetSCIMDirectoryResponse: type: object properties: scimDirectory: allOf: - $ref: '#/components/schemas/SCIMDirectory' description: The requested SCIM directory. GetSCIMGroupResponse: type: object properties: scimGroup: allOf: - $ref: '#/components/schemas/SCIMGroup' description: The requested SCIM group. GetSCIMUserResponse: type: object properties: scimUser: allOf: - $ref: '#/components/schemas/SCIMUser' description: The requested SCIM user. GoogleProtobufAny: type: object properties: '@type': type: string description: The type of the serialized message. additionalProperties: true description: Contains an arbitrary serialized message along with a @type that describes the type of the serialized message. ListOrganizationsResponse: type: object properties: organizations: type: array items: $ref: '#/components/schemas/Organization' description: List of organizations. nextPageToken: type: string description: Value to use as `pageToken` for the next page of data. Empty if there is no more data. ListSAMLConnectionsResponse: type: object properties: samlConnections: type: array items: $ref: '#/components/schemas/SAMLConnection' description: The list of SAML connections. nextPageToken: type: string description: Value to use as `pageToken` for the next page of data. Empty if there is no more data. ListSCIMDirectoriesResponse: type: object properties: scimDirectories: type: array items: $ref: '#/components/schemas/SCIMDirectory' description: The list of SCIM directories. nextPageToken: type: string description: Value to use as `pageToken` for the next page of data. Empty if there is no more data. ListSCIMGroupsResponse: type: object properties: scimGroups: type: array items: $ref: '#/components/schemas/SCIMGroup' description: List of SCIM groups. nextPageToken: type: string description: Value to use as `pageToken` for the next page of data. Empty if there is no more data. ListSCIMUsersResponse: type: object properties: scimUsers: type: array items: $ref: '#/components/schemas/SCIMUser' description: List of SCIM users. nextPageToken: type: string description: Value to use as `pageToken` for the next page of data. Empty if there is no more data. Organization: type: object properties: id: type: string description: Unique identifier for this organization. environmentId: type: string description: The environment this organization belongs to. displayName: type: string description: An optional human-friendly name for this organization. externalId: type: string description: |- An identifier you can attach to an organization. Meant to be used to correlate an SSOReady organization to your internal equivalent concept. External IDs are unique within an environment. No two organizations in the same environment can have the same external ID. domains: type: array items: type: string description: |- A list of domains that users from this organization use. SAML connections and SCIM directories within this organization will only produce users whose email are included in `domains`. SSOReady will reject SAML and SCIM users that do not fall within `domains`. RedeemSAMLAccessCodeRequest: type: object properties: samlAccessCode: type: string description: The SAML access code to redeem. RedeemSAMLAccessCodeResponse: type: object properties: email: type: string description: The user's email address. state: type: string description: |- The `state` you provided when getting a SAML initiation URL, if any. If your user logged in to your product using Identity Provider-initiated SAML (e.g. they clicked on your app inside their corporate Okta dashboard), then `state` will be empty. SSOReady validates the authenticity of non-empty `state` values. You do not need to implement your own CSRF on top of it, but doing so anyway will have no bad consequences. attributes: type: object additionalProperties: type: string description: |- Arbitrary key-value pairs the Identity Provider included about the user. Typically, these `attributes` are used to pass along the user's first/last name, or whether they should be considered an admin within their company. organizationId: type: string description: The ID of the organization this user belongs to. organizationExternalId: type: string description: The `externalId`, if any, of the organization this user belongs to. samlFlowId: type: string description: |- A unique identifier of this particular SAML login. It is not a secret. You can safely log it. SSOReady maintains an audit log of every SAML login. Use this SAML flow ID to find this login in the audit logs. RotateSCIMDirectoryBearerTokenResponse: type: object properties: bearerToken: type: string description: |- The new, updated bearer token. Do not log or store this bearer token. It is an authentication token that your customer should securely input into their Identity Provider. SAMLConnection: type: object properties: id: type: string description: Unique identifier for this SAML connection. organizationId: type: string description: The organization this SAML connection belongs to. primary: type: boolean description: Whether this is the primary SAML connection for the organization. idpRedirectUrl: type: string description: |- URL to redirect to when initiating SAML flows. IDP redirect URLs are assigned by an Identity Provider, and need to be inputted into SSOReady. idpCertificate: type: string description: |- Certificate to authenticate SAML assertions. This is a PEM-encoded X.509 certificate. IDP certificates are assigned by an Identity Provider, and need to be inputted into SSOReady. idpEntityId: type: string description: |- Identifier for the identity provider when handling SAML operations. IDP entity IDs are assigned by an Identity Provider, and need to be inputted into SSOReady. spEntityId: type: string description: |- Identifier for the SAML connection when handling SAML operations. SP entity IDs are assigned by SSOReady, and need to be inputted into your customer's Identity Provider. spAcsUrl: type: string description: |- URL the Identity Provider redirects to when transmitting SAML assertions. Stands for "Service Provider Assertion Consumer Service" URL. SP ACS URLs are assigned by SSOReady, and need to be inputted into your customer's Identity Provider. SCIMDirectory: type: object properties: id: type: string description: Unique identifier for this SCIM directory. organizationId: type: string description: The organization this SCIM directory belongs to. primary: type: boolean description: Whether this is the primary SCIM directory for the organization. scimBaseUrl: type: string description: |- Base URL the Identity Provider uses to perform SCIM HTTP requests. SCIM base URLs are assigned by SSOReady, and need to be inputted into your customer's Identity Provider. hasClientBearerToken: type: boolean description: |- Whether this SCIM directory has a bearer token assigned. SSOReady only stores a hash of the bearer token. To get a bearer token value, you must rotate this SCIM directory's bearer token. SCIMGroup: type: object properties: id: type: string description: Unique identifier for this SCIM group. scimDirectoryId: type: string description: SCIM directory this SCIM group belongs to. displayName: type: string description: A human-friendly name for the SCIM group. deleted: type: boolean description: |- Whether the SCIM group has been deleted or deprovisioned from its SCIM directory. Identity Providers are inconsistent about reliably deleting SCIM groups. Many Identity Providers will deprovision the users inside a group, but not the group itself. For this reason, it's typical to ignore this field until a specific need arises. attributes: type: object description: |- Arbitrary, potentially nested, attributes the Identity Provider included about the group. Identity Providers are inconsistent about supporting sending custom attributes on groups. For this reason, it's typical to not rely on them until a specific need arises. SCIMUser: type: object properties: id: type: string description: Unique identifier for this SCIM user. scimDirectoryId: type: string description: SCIM directory this SCIM user belongs to. email: type: string description: The SCIM user's email address. deleted: type: boolean description: Whether the SCIM user has been deleted or deprovisioned from its SCIM directory. attributes: type: object description: |- Arbitrary, potentially nested, attributes the Identity Provider included about the user. Typically, these `attributes` are used to pass along the user's first/last name, or whether they should be considered an admin within their company. Status: type: object properties: code: type: integer description: The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. format: int32 message: type: string description: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. details: type: array items: $ref: '#/components/schemas/GoogleProtobufAny' description: A list of messages that carry the error details. There is a common set of message types for APIs to use. description: 'The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).' UpdateOrganizationResponse: type: object properties: organization: allOf: - $ref: '#/components/schemas/Organization' description: The updated organization. UpdateSAMLConnectionResponse: type: object properties: samlConnection: allOf: - $ref: '#/components/schemas/SAMLConnection' description: The updated SAML connection. UpdateSCIMDirectoryResponse: type: object properties: scimDirectory: allOf: - $ref: '#/components/schemas/SCIMDirectory' description: The updated SCIM directory. tags: - name: SSOReadyService