--- updatedAt: 2026-06-04T19:58:43.000Z agentTools: projectIndex: https://docs.wristband.dev/llms.txt --- # Create Identity Provider Creates a new identity provider. If the `upsert` query param is set to `true`then, instead of performing a create, the API will switch to performing an upsert. For an upsert request, the following fields are required: **Required Upsert Fields:** * `ownerType` * `ownerId` * `name` When performing an upsert, the above fields will be used to determine whether the identity provider already exists. If the identity provider already exists, then a partial update will be performed; otherwise, a new identity provider will be created. In the response of an upsert request, if a create was performed, then a `201` response code will be returned; otherwise, if an update was performed, then a `200` will be returned. **Note**: enterprise identity providers can only be created with an `ownerType` value of `TENANT`. ### Required Permissions Below is the list of required permissions needed to interact with this API. For each permission, the allowed permission boundaries are also specified. | Permission | Boundary | Description | | --------------------------- | --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | | **identity-provider:write** | Application | The subject can create identity providers under the application that the subject belongs to. | | | Tenant | The subject can create identity providers for the tenant to which the subject belongs. | | | Tenant Inclusion List | The subject can create identity providers for tenants specified in the tenant inclusion list. | | | Tenant Exclusion List | The subject can create identity providers for tenants that belong to the subject's application but are not included in the tenant exclusion list. | # OpenAPI definition ```json { "openapi": "3.1.0", "info": { "title": "Resource Management APIs", "version": "1.0.0", "description": "Resource Management APIs", "license": { "name": "Private", "url": "https://wristband.dev/terms/" }, "termsOfService": "https://wristband.dev/terms/", "contact": { "name": "Wristband Support", "email": "support@wristband.dev", "url": "https://wristband.dev/contact/" } }, "servers": [ { "url": "https://{application_vanity_domain}", "description": "Wristband application scoped URL.", "variables": { "application_vanity_domain": { "default": "yourapp-yourorg.us.wristband.dev", "description": "Wristband vanity domain scoped to a specific application." } } } ], "tags": [ { "name": "Identity Providers", "description": "Identity Providers", "x-displayName": "Identity Providers" } ], "paths": { "/api/v1/identity-providers": { "post": { "summary": "Create Identity Provider", "operationId": "createIdentityProvidersV1", "tags": [ "Identity Providers" ], "parameters": [ { "$ref": "#/components/parameters/Resource_Management_APIs_Upsert" } ], "requestBody": { "description": "JSON representing the identity provider that will be created.", "content": { "application/json": { "schema": { "anyOf": [ { "$ref": "#/components/schemas/Resource_Management_APIs_WristbandIdentityProvider" }, { "$ref": "#/components/schemas/Resource_Management_APIs_AppleIdentityProvider" }, { "$ref": "#/components/schemas/Resource_Management_APIs_BitbucketIdentityProvider" }, { "$ref": "#/components/schemas/Resource_Management_APIs_CustomIdentityProvider" }, { "$ref": "#/components/schemas/Resource_Management_APIs_GitHubIdentityProvider" }, { "$ref": "#/components/schemas/Resource_Management_APIs_GitLabIdentityProvider" }, { "$ref": "#/components/schemas/Resource_Management_APIs_GoogleIdentityProvider" }, { "$ref": "#/components/schemas/Resource_Management_APIs_GoogleWorkspaceIdentityProvider" }, { "$ref": "#/components/schemas/Resource_Management_APIs_MicrosoftIdentityProvider" }, { "$ref": "#/components/schemas/Resource_Management_APIs_MicrosoftEntraIdIdentityProvider" }, { "$ref": "#/components/schemas/Resource_Management_APIs_OktaIdentityProvider" } ] }, "examples": { "Example 1 - Wristband IdP": { "value": { "ownerType": "APPLICATION", "ownerId": "1sor7zaca5bzrmic3w7h2okogw", "type": "WRISTBAND", "loginIdentifiers": [ "EMAIL" ], "loginFactors": [ "PASSWORD", "MAGIC_LINK" ], "primaryLoginFactor": "PASSWORD" } }, "Example 2 - Google IdP": { "value": { "ownerType": "APPLICATION", "ownerId": "1sor7zaca5bzrmic3w7h2okogw", "type": "GOOGLE", "protocol": { "type": "OAUTH2", "clientId": "2c075bd4-5ac9-4e85-a197-d5e3f53b5a77", "clientSecret": "secretValue", "scopes": [] } } } } } } }, "responses": { "200": { "description": "OK", "headers": { "ETag": { "$ref": "#/components/headers/Resource_Management_APIs_ETag" } }, "content": { "application/json": { "schema": { "anyOf": [ { "$ref": "#/components/schemas/Resource_Management_APIs_WristbandIdentityProvider" }, { "$ref": "#/components/schemas/Resource_Management_APIs_AppleIdentityProvider" }, { "$ref": "#/components/schemas/Resource_Management_APIs_BitbucketIdentityProvider" }, { "$ref": "#/components/schemas/Resource_Management_APIs_CustomIdentityProvider" }, { "$ref": "#/components/schemas/Resource_Management_APIs_GitHubIdentityProvider" }, { "$ref": "#/components/schemas/Resource_Management_APIs_GitLabIdentityProvider" }, { "$ref": "#/components/schemas/Resource_Management_APIs_GoogleIdentityProvider" }, { "$ref": "#/components/schemas/Resource_Management_APIs_GoogleWorkspaceIdentityProvider" }, { "$ref": "#/components/schemas/Resource_Management_APIs_MicrosoftIdentityProvider" }, { "$ref": "#/components/schemas/Resource_Management_APIs_MicrosoftEntraIdIdentityProvider" }, { "$ref": "#/components/schemas/Resource_Management_APIs_OktaIdentityProvider" } ] }, "examples": { "Example 1 - Wristband IdP": { "$ref": "#/components/examples/Resource_Management_APIs_WristbandIdentityProvider" }, "Example 2 - Google IdP": { "$ref": "#/components/examples/Resource_Management_APIs_GoogleIdentityProvider" } } } } }, "201": { "description": "Created", "headers": { "Location": { "$ref": "#/components/headers/Resource_Management_APIs_Location" }, "ETag": { "$ref": "#/components/headers/Resource_Management_APIs_ETag" } }, "content": { "application/json": { "schema": { "anyOf": [ { "$ref": "#/components/schemas/Resource_Management_APIs_WristbandIdentityProvider" }, { "$ref": "#/components/schemas/Resource_Management_APIs_AppleIdentityProvider" }, { "$ref": "#/components/schemas/Resource_Management_APIs_BitbucketIdentityProvider" }, { "$ref": "#/components/schemas/Resource_Management_APIs_CustomIdentityProvider" }, { "$ref": "#/components/schemas/Resource_Management_APIs_GitHubIdentityProvider" }, { "$ref": "#/components/schemas/Resource_Management_APIs_GitLabIdentityProvider" }, { "$ref": "#/components/schemas/Resource_Management_APIs_GoogleIdentityProvider" }, { "$ref": "#/components/schemas/Resource_Management_APIs_GoogleWorkspaceIdentityProvider" }, { "$ref": "#/components/schemas/Resource_Management_APIs_MicrosoftIdentityProvider" }, { "$ref": "#/components/schemas/Resource_Management_APIs_MicrosoftEntraIdIdentityProvider" }, { "$ref": "#/components/schemas/Resource_Management_APIs_OktaIdentityProvider" } ] }, "examples": { "Example 1 - Wristband IdP": { "$ref": "#/components/examples/Resource_Management_APIs_WristbandIdentityProvider" }, "Example 2 - Google IdP": { "$ref": "#/components/examples/Resource_Management_APIs_GoogleIdentityProvider" } } } } }, "400": { "$ref": "#/components/responses/Resource_Management_APIs_400-with-message-body" }, "401": { "$ref": "#/components/responses/Resource_Management_APIs_401" }, "403": { "$ref": "#/components/responses/Resource_Management_APIs_403" }, "405": { "$ref": "#/components/responses/Resource_Management_APIs_405" }, "406": { "$ref": "#/components/responses/Resource_Management_APIs_406" }, "415": { "$ref": "#/components/responses/Resource_Management_APIs_415" }, "500": { "$ref": "#/components/responses/Resource_Management_APIs_500" }, "503": { "$ref": "#/components/responses/Resource_Management_APIs_503" } }, "security": [ { "Resource_Management_APIs_BearerAuth": [] } ] } } }, "components": { "securitySchemes": { "Resource_Management_APIs_BearerAuth": { "type": "http", "scheme": "bearer", "bearerFormat": "JWT" } }, "parameters": { "Resource_Management_APIs_Upsert": { "name": "upsert", "in": "query", "required": false, "schema": { "type": "boolean", "default": false }, "description": "Boolean indicating if the operation should be treated as an upsert" } }, "schemas": { "Resource_Management_APIs_id": { "type": "string", "minLength": 1, "maxLength": 26, "example": "pl4a4aa4jzydksmrf3jnu5yfcw", "description": "Globally unique Id of the resource.", "readOnly": true }, "Resource_Management_APIs_api-error": { "title": "ApiError", "type": "object", "description": "API error object", "x-examples": { "Example 1": { "code": "invalid_request", "message": "The request was invalid", "ticket": "11t7n71hi5e6t" } }, "properties": { "type": { "type": "string", "example": "base_error", "minLength": 1, "description": "The type of the API error.", "readOnly": true }, "code": { "type": "string", "example": "invalid_request", "minLength": 1, "description": "A code identifying the error that occurred.", "readOnly": true }, "message": { "type": "string", "example": "The request was invalid", "description": "A free text message describing the error. This error message is only meant to help developers understand the cause of the error. It should not be used for programmatic purposes.", "readOnly": true }, "ticket": { "type": "string", "example": "11t7n71hi5e6t", "description": "Ticket that can help correlate the error to the backend", "readOnly": true }, "details": { "type": "object", "description": "A map of details about the error. The keys are defined by the API.", "additionalProperties": {}, "example": { "attemptsRemaining": 4 } } }, "required": [ "type", "code" ] }, "Resource_Management_APIs_constraint-violations-api-error": { "title": "ConstraintViolationsApiError", "description": "An API error that occurred due to a constraint violation", "allOf": [ { "$ref": "#/components/schemas/Resource_Management_APIs_api-error" }, { "type": "object", "readOnly": true, "required": [ "violations" ], "properties": { "violations": { "type": "object", "readOnly": true, "required": [ "code" ], "properties": { "code": { "type": "string", "description": "A code identifying the constraint violation.", "minLength": 1, "example": "too_long" }, "constraintAttributes": { "type": "object", "description": "A map of constraint attribute values.", "additionalProperties": { "type": "string" }, "example": { "maxLength": "10" } } } } } } ], "x-examples": { "Example 1": { "type": "constraint_violations_error", "code": "message_body_constraint_violations", "message": "The request contained invalid fields", "ticket": "11t7n71hi5e6t", "violations": { "field1": { "code": "too_long", "constraintAttributes": { "maxLength": "10" } }, "field2": { "code": "not_null" } } } } }, "Resource_Management_APIs_upsertOwnerType": { "description": "[Required on Create and Upsert] The type of the owner of the resource.", "type": "string", "enum": [ "APPLICATION", "TENANT" ], "minLength": 1, "maxLength": 30, "example": "APPLICATION" }, "Resource_Management_APIs_upsertOwnerId": { "description": "[Required on Create and Upsert] The ID of the owner of the resource.", "type": "string", "minLength": 1, "maxLength": 26, "example": "d7aml4q5lza3fdi2gavzdliouy" }, "Resource_Management_APIs_version-metadata": { "title": "VersionMetadata", "type": "object", "description": "Version metadata associated to a resource.", "properties": { "version": { "type": "string", "example": "1.0", "description": "The version of the resource", "readOnly": true }, "lastModifiedTime": { "type": "string", "format": "date-time", "example": "2016-06-13T19:49:31.686Z", "description": "The time at which the resource was last modified", "readOnly": true }, "creationTime": { "type": "string", "format": "date-time", "example": "2016-06-13T19:49:31.686Z", "description": "The time at which the resource was created", "readOnly": true } } }, "Resource_Management_APIs_IdentityProvider": { "title": "IdentityProvider", "type": "object", "description": "Identity Provider", "x-tags": [ "Models" ], "required": [ "ownerType", "ownerId", "type" ], "properties": { "id": { "$ref": "#/components/schemas/Resource_Management_APIs_id" }, "ownerType": { "$ref": "#/components/schemas/Resource_Management_APIs_upsertOwnerType" }, "ownerId": { "$ref": "#/components/schemas/Resource_Management_APIs_upsertOwnerId" }, "type": { "type": "string", "enum": [ "WRISTBAND", "APPLE", "BITBUCKET", "CUSTOM", "GITHUB", "GITLAB", "GOOGLE", "GOOGLE_WORKSPACE", "MICROSOFT", "MICROSOFT_ENTRA_ID", "OKTA" ], "example": "WRISTBAND", "minLength": 1, "maxLength": 25, "description": "The type of the IdP" }, "name": { "type": "string", "example": "wristband", "minLength": 1, "maxLength": 70, "description": "[Required on Upsert] The name of the IdP. For enterprise IDPs this value must be provided on creation; however, for non-enterprise IDPs this value will be defaulted based on the identity provider type." }, "displayName": { "type": "string", "example": "Wristband", "minLength": 1, "maxLength": 20, "description": "The display name of the IdP. For enterprise IDPs this value must be provided on creation; however, for non-enterprise IDPs this value wil be defaulted based on the identity provider type." }, "isExternal": { "type": "boolean", "readOnly": true, "example": false, "description": "Boolean indicating if the IdP is externally hosted." }, "status": { "type": "string", "minLength": 1, "maxLength": 45, "description": "The status of the IdP", "enum": [ "ENABLED", "DISABLED", "DELETE_IN_PROGRESS" ], "example": "ENABLED", "default": "ENABLED" }, "metadata": { "$ref": "#/components/schemas/Resource_Management_APIs_version-metadata" } }, "example": { "id": "u9k33onh6nbsjggayhubbef5te", "ownerType": "APPLICATION", "ownerId": "1sor7zaca5bzrmic3w7h2okogw", "type": "WRISTBAND", "name": "wristband", "displayName": "Wristband", "isExternal": false, "status": "ENABLED", "metadata": { "version": "1.0", "lastModifiedTime": "2021-06-13T19:49:31.686Z", "creationTime": "2021-06-13T19:49:31.686Z" } } }, "Resource_Management_APIs_IdentityProviderProtocol": { "title": "IdentityProviderProtocol", "type": "object", "description": "Identity Provider Protocol", "x-tags": [ "Models" ], "required": [ "type" ], "properties": { "type": { "type": "string", "enum": [ "OAUTH2", "SAML2", "SIWA" ], "example": "OAUTH2", "minLength": 1, "maxLength": 60, "description": "The type of the IdP protocol" }, "clientId": { "type": "string", "example": "1234567890-abc123def456.apps.googleusercontent.com", "minLength": 1, "maxLength": 200, "description": "The ID of the OAuth 2 client, required if the protocol type is OAUTH2" }, "clientSecret": { "type": "string", "minLength": 1, "maxLength": 200, "example": "6ae50f72-e7e1-4a9f-a4f4-289ee3ba9bdd", "description": "Secret associated to the OAuth 2 client, required if the protocol type is OAUTH2" }, "scopes": { "description": "Optional list of OAuth 2 scopes that will be sent to the external IdP's authorization endpoint. This can be used to grant additional access privileges to the access tokens issued by the external IdP.\n\nNote, each external IdP has a set of default scopes that will always be sent in the authorization request, regardless of the scope values specified. These default scopes are listed below:\n\n| Identity Provider | Default Scopes | \n| ---------------------------| --------------------------- | \n| Apple | email name |\n| Bitbucket | account email |\n| GitHub | user:email |\n| GitLab | email profile openid |\n| Google | email profile openid |\n| Microsoft | email profile openid |\n| Microsoft Entra ID | email profile openid |\n| Okta | email groups profile openid |", "type": "array", "maxItems": 15, "uniqueItems": true, "items": { "description": "A scope that should be granted to the access token", "type": "string", "pattern": "^[x21x23-x5Bx5D-x7E]+$", "minLength": 1, "maxLength": 100, "example": "profile" } }, "teamId": { "type": "string", "example": "ABCEF2J3P4", "minLength": 1, "maxLength": 100, "description": "The apple team ID, required if the protocol type is SIWA" }, "serviceId": { "type": "string", "example": "com.example.client", "minLength": 1, "maxLength": 200, "description": "The apple service ID, required if the protocol type is SIWA" }, "keyId": { "type": "string", "example": "12345MY8LY", "minLength": 1, "maxLength": 100, "description": "The apple key ID, required if the protocol type is SIWA" }, "privateKey": { "type": "string", "example": "-----BEGIN PRIVATE KEY-----\nALABerBxYuNxJD57u9i0WdYmCyd5XKnWzwibDG7TZawhvZIWhrIu2IopHg0W\nOXlxQocYalChQbGgDk2pvHmi0oyKYAsNlMj4uYTdYpCxoEgII7FlOBd6UiBR\nipALcha2vD9eysOP6O0nDHRFoqDtYUIjGA0vV00HRx4mNN50HISs0GGySn8s\n-----END PRIVATE KEY-----", "minLength": 1, "maxLength": 1000, "description": "The apple private key in PEM format, required if the protocol type is SIWA" }, "redirectUrl": { "type": "string", "format": "uri", "example": "https://app.com/redirect", "readOnly": true, "description": "The URL that the identity provider will redirect to after authenticating the user, this value will only be present for protocol types: OAUTH2 and SIWA" }, "redirectDomainName": { "type": "string", "format": "hostname", "example": "app.com", "description": "The domain name that should be used in the redirect URL. This value must either be set to the owner's default vanity domain or a verified custom domain; for tenant owned IDPs the custom domain must be prepended with the tenant's domain name. This value can only be used with OAUTH2 and SIWA protocol types. If undefined, this value defaults to the owner's active vanity domain." }, "idpMetadataUrl": { "type": "string", "format": "uri", "minLength": 1, "maxLength": 2000, "example": "https://idp.com/metadata.xml", "description": "Optional URL that points to the IdP's SAML metadata endpoint, this value is only supported if the protocol type is SAML2" }, "idpEntityId": { "type": "string", "example": "http://idp.com/123", "minLength": 1, "maxLength": 200, "description": "The IdP entity ID, required if the protocol type is SAML2 unless the IdP has a status of `DISABLED`." }, "idpSsoUrl": { "type": "string", "format": "uri", "minLength": 1, "maxLength": 2000, "example": "https://idp.com/sso", "description": "The IdP SSO URL, required if the protocol type is SAML2 unless the IdP has a status of `DISABLED`" }, "idpSigningCerts": { "type": "array", "minItems": 1, "maxItems": 2, "uniqueItems": true, "description": "Array of PEM encoded IdP signing certificates, required if the protocol type is SAML2 unless the IdP has a status of `DISABLED`", "items": { "type": "string", "minLength": 1, "example": "-----BEGIN CERTIFICATE-----\nALABerBxYuNxJD57u9i0WdYmCyd5XKnWzwibDG7TZawhvZIWhrIu2IopHg0W\nOXlxQocYalChQbGgDk2pvHmi0oyKYAsNlMj4uYTdYpCxoEgII7FlOBd6UiBR\nipALcha2vD9eysOP6O0nDHRFoqDtYUIjGA0vV00HRx4mNN50HISs0GGySn8s\n-----END CERTIFICATE-----" } }, "allowIdpInitiatedSso": { "type": "boolean", "default": false, "example": true, "description": "Boolean indicating if IdP initiated SSO requests are allowed. If they are not allowed then users will be redirected to the application's login URL if an IdP initiated SSO request is detected." }, "spDomainName": { "type": "string", "format": "hostname", "example": "sp.com", "description": "The domain name that should be used in the service provider values. This value must either be set to the owner's default vanity domain or a verified custom domain; for tenant owned IDPs the custom domain must be prepended with the tenant's domain name. This value can only be used with the SAML2 protocol type. If undefined, this value defaults to the owner's active vanity domain." }, "spEntityId": { "type": "string", "example": "http://sp.com/id", "readOnly": true, "description": "The Service Provider entity ID. This value will only be present for the SAML2 protocol type." }, "acsUrl": { "type": "string", "format": "uri", "example": "http://sp.com/acs", "readOnly": true, "description": "The Service Provider ACS URL. This value will only be present for the SAML2 protocol type." } }, "example": { "type": "OAUTH2", "clientId": "1234567890-abc123def456.apps.googleusercontent.com", "clientSecret": "6ae50f72-e7e1-4a9f-a4f4-289ee3ba9bdd", "scopes": [ "some:scope" ], "redirectUrl": "https://app.com/redirect", "redirectDomainName": "app.com" } }, "Resource_Management_APIs_ExternalIdentityProvider": { "title": "ExternalIdentityProvider", "description": "External Identity Provider", "x-tags": [ "Models" ], "required": [ "protocol" ], "allOf": [ { "$ref": "#/components/schemas/Resource_Management_APIs_IdentityProvider" }, { "type": "object", "description": "External Identity Provider", "properties": { "protocol": { "$ref": "#/components/schemas/Resource_Management_APIs_IdentityProviderProtocol" } } } ], "example": { "id": "u9k33onh6nbsjggayhubbef5te", "ownerType": "APPLICATION", "ownerId": "1sor7zaca5bzrmic3w7h2okogw", "type": "GOOGLE", "name": "google", "displayName": "Google", "isExternal": true, "status": "ENABLED", "protocol": { "type": "OAUTH2", "clientId": "1234567890-abc123def456.apps.googleusercontent.com", "clientSecret": "6ae50f72-e7e1-4a9f-a4f4-289ee3ba9bdd", "redirectUrl": "https://app.com/redirect", "redirectDomainName": "app.com" }, "metadata": { "version": "1.0", "lastModifiedTime": "2021-06-13T19:49:31.686Z", "creationTime": "2021-06-13T19:49:31.686Z" } } }, "Resource_Management_APIs_EnterpriseIdentityProvider": { "title": "EnterpriseIdentityProvider", "description": "Enterprise Identity Provider", "x-tags": [ "Models" ], "required": [ "protocol" ], "allOf": [ { "$ref": "#/components/schemas/Resource_Management_APIs_ExternalIdentityProvider" }, { "type": "object", "description": "Enterprises Identity Provider", "properties": { "jitProvisioningEnabled": { "type": "boolean", "example": false, "description": "Boolean indicating if JIT provisioning is enabled for the IdP." }, "standardUserAttributesToSync": { "type": "array", "uniqueItems": true, "description": "List of standard user attributes that will be synced from the the external IdP.", "items": { "type": "string", "example": "email", "enum": [ "email", "fullName", "givenName", "familyName", "birthdate", "phoneNumber" ] } }, "roleMappingEnabled": { "type": "boolean", "example": false, "description": "Boolean indicating if role mapping is enabled for the IdP." } } } ], "example": { "id": "u9k33onh6nbsjggayhubbef5te", "ownerType": "APPLICATION", "ownerId": "1sor7zaca5bzrmic3w7h2okogw", "type": "GOOGLE_WORKSPACE", "name": "ent:google-workspace:org1", "displayName": "Org 1", "isExternal": true, "jitProvisioningEnabled": true, "standardUserAttributesToSync": [ "email", "fullName" ], "roleMappingEnabled": true, "status": "ENABLED", "protocol": { "type": "OAUTH2", "clientId": "1234567890-abc123def456.apps.googleusercontent.com", "clientSecret": "6ae50f72-e7e1-4a9f-a4f4-289ee3ba9bdd", "redirectUrl": "https://app.com/redirect", "redirectDomainName": "app.com" }, "metadata": { "version": "1.0", "lastModifiedTime": "2021-06-13T19:49:31.686Z", "creationTime": "2021-06-13T19:49:31.686Z" } } }, "Resource_Management_APIs_WristbandIdentityProvider": { "title": "WristbandIdentityProvider", "description": "Wristband Identity Provider", "x-tags": [ "Models" ], "allOf": [ { "$ref": "#/components/schemas/Resource_Management_APIs_IdentityProvider" }, { "type": "object", "description": "Wristband Identity Provider", "properties": { "loginIdentifiers": { "type": "array", "minItems": 1, "uniqueItems": true, "description": "Array of primary identifiers that can be used to uniquely identify a user in this Wristband IdP", "items": { "type": "string", "minLength": 1, "maxLength": 30, "enum": [ "EMAIL", "USERNAME" ], "example": "EMAIL" } }, "loginFactors": { "type": "array", "uniqueItems": true, "minItems": 1, "description": "Array of primary factors that can be used to log a user in for this Wristband IdP", "items": { "type": "string", "enum": [ "PASSWORD", "MAGIC_LINK" ], "example": "PASSWORD", "minLength": 1, "maxLength": 30 } }, "primaryLoginFactor": { "type": "string", "enum": [ "PASSWORD", "MAGIC_LINK" ], "example": "PASSWORD", "minLength": 1, "maxLength": 30, "description": "The first login factor that will be shown on the login page or other authentication flows. This value must be one of the login factors included in the `loginFactors` field." }, "resolvedPrimaryLoginFactor": { "type": "string", "readOnly": true, "enum": [ "PASSWORD", "MAGIC_LINK" ], "example": "PASSWORD", "minLength": 1, "maxLength": 30, "description": "If the `primaryLoginFactor` is set to a non-null value, this value will always be equal to the `primaryLoginFactor` value. Otherwise, this value will be resolved using the following logic:\n- If only one login factor is enabled, this value will be equal to the enabled login factor.\n- If both `PASSWORD` and `MAGIC_LINK` login factors are enabled, this value will be equal to `MAGIC_LINK`." } } } ], "example": { "id": "u9k33onh6nbsjggayhubbef5te", "ownerType": "APPLICATION", "ownerId": "1sor7zaca5bzrmic3w7h2okogw", "type": "WRISTBAND", "name": "wristband", "displayName": "Wristband", "isExternal": false, "status": "ENABLED", "loginIdentifiers": [ "EMAIL" ], "loginFactors": [ "PASSWORD", "MAGIC_LINK" ], "primaryLoginFactor": "PASSWORD", "resolvedPrimaryLoginFactor": "PASSWORD", "metadata": { "version": "1.0", "lastModifiedTime": "2021-06-13T19:49:31.686Z", "creationTime": "2021-06-13T19:49:31.686Z" } } }, "Resource_Management_APIs_AppleIdentityProvider": { "title": "AppleIdentityProvider", "description": "Apple Identity Provider. \n\nSupported protocols are: [SIWA]", "x-tags": [ "Models" ], "allOf": [ { "$ref": "#/components/schemas/Resource_Management_APIs_ExternalIdentityProvider" } ], "example": { "id": "u9k33onh6nbsjggayhubbef5te", "ownerType": "APPLICATION", "ownerId": "1sor7zaca5bzrmic3w7h2okogw", "type": "APPLE", "name": "apple", "displayName": "Apple", "isExternal": true, "status": "ENABLED", "protocol": { "type": "SIWA", "teamId": "ABCEF2J3P4", "serviceId": "com.example.client", "keyId": "12345MY8LY", "privateKey": "-----BEGIN PRIVATE KEY-----\nALABerBxYuNxJD57u9i0WdYmCyd5XKnWzwibDG7TZawhvZIWhrIu2IopHg0W\nOXlxQocYalChQbGgDk2pvHmi0oyKYAsNlMj4uYTdYpCxoEgII7FlOBd6UiBR\nipALcha2vD9eysOP6O0nDHRFoqDtYUIjGA0vV00HRx4mNN50HISs0GGySn8s\n-----END PRIVATE KEY-----", "redirectUrl": "https://app.com/redirect", "redirectDomainName": "app.com" }, "metadata": { "version": "1.0", "lastModifiedTime": "2021-06-13T19:49:31.686Z", "creationTime": "2021-06-13T19:49:31.686Z" } } }, "Resource_Management_APIs_BitbucketIdentityProvider": { "title": "BitbucketIdentityProvider", "description": "Bitbucket Identity Provider\n\nSupported protocols are: [OAUTH2]", "x-tags": [ "Models" ], "allOf": [ { "$ref": "#/components/schemas/Resource_Management_APIs_ExternalIdentityProvider" } ], "example": { "id": "u9k33onh6nbsjggayhubbef5te", "ownerType": "APPLICATION", "ownerId": "1sor7zaca5bzrmic3w7h2okogw", "type": "BITBUCKET", "name": "bitbucket", "displayName": "Bitbucket", "isExternal": true, "status": "ENABLED", "protocol": { "type": "OAUTH2", "clientId": "289ee3ba9bdd", "clientSecret": "6ae50f72-e7e1-4a9f-a4f4-289ee3ba9bdd", "scopes": [ "some:scope" ], "redirectUrl": "https://app.com/redirect", "redirectDomainName": "app.com" }, "metadata": { "version": "1.0", "lastModifiedTime": "2021-06-13T19:49:31.686Z", "creationTime": "2021-06-13T19:49:31.686Z" } } }, "Resource_Management_APIs_CustomIdentityProvider": { "title": "CustomIdentityProvider", "description": "Custom Identity Provider\n\nSupported protocols are: [SAML2]", "x-tags": [ "Models" ], "allOf": [ { "$ref": "#/components/schemas/Resource_Management_APIs_EnterpriseIdentityProvider" }, { "type": "object", "description": "Custom Identity Provider", "properties": { "logoUrl": { "description": "URL pointing to an image of the IdP's logo. The logo will be displayed on the IdP's login button. If no value is provided then a default logo will be used.", "type": "string", "format": "uri", "minLength": 1, "maxLength": 2000, "example": "https://idp.com/logo.png" }, "verifiedEmailDomains": { "type": "array", "uniqueItems": true, "maxItems": 10, "description": "List of email domains that indicate which emails should be marked as verified when a user is provisioned through this identity provider.", "items": { "type": "string", "format": "host", "example": "companya.com" } } } } ], "example": { "id": "u9k33onh6nbsjggayhubbef5te", "ownerType": "APPLICATION", "ownerId": "1sor7zaca5bzrmic3w7h2okogw", "type": "CUSTOM", "name": "ent:custom:org1", "displayName": "Custom IdP", "logoUrl": "https://idp.com/logo.png", "verifiedEmailDomains": [ "companya.com", "companyb.com" ], "isExternal": true, "jitProvisioningEnabled": true, "roleMappingEnabled": true, "status": "ENABLED", "protocol": { "type": "SAML2", "idpMetadataUrl": "https://idp.com/metadata.xml", "idpEntityId": "https://idp.com/123", "idpSsoUrl": "https://idp.com/sso", "allowIdpInitiatedSso": true, "idpSigningCerts": "-----BEGIN CERTIFICATE-----\nALABerBxYuNxJD57u9i0WdYmCyd5XKnWzwibDG7TZawhvZIWhrIu2IopHg0W\nOXlxQocYalChQbGgDk2pvHmi0oyKYAsNlMj4uYTdYpCxoEgII7FlOBd6UiBR\nipALcha2vD9eysOP6O0nDHRFoqDtYUIjGA0vV00HRx4mNN50HISs0GGySn8s\n-----END CERTIFICATE-----", "spDomainName": "sp.com", "spEntityId": "http://sp.com/id", "acsUrl": "http://sp.com/acs" }, "metadata": { "version": "1.0", "lastModifiedTime": "2021-06-13T19:49:31.686Z", "creationTime": "2021-06-13T19:49:31.686Z" } } }, "Resource_Management_APIs_GitHubIdentityProvider": { "title": "GitHubIdentityProvider", "description": "GitHub Identity Provider\n\nSupported protocols are: [OAUTH2]", "x-tags": [ "Models" ], "allOf": [ { "$ref": "#/components/schemas/Resource_Management_APIs_ExternalIdentityProvider" } ], "example": { "id": "u9k33onh6nbsjggayhubbef5te", "ownerType": "APPLICATION", "ownerId": "1sor7zaca5bzrmic3w7h2okogw", "type": "GITHUB", "name": "github", "displayName": "GitHub", "isExternal": true, "status": "ENABLED", "protocol": { "type": "OAUTH2", "clientId": "6ae50f72", "clientSecret": "6ae50f72-e7e1-4a9f-a4f4-289ee3ba9bdd", "scopes": [ "some:scope" ], "redirectUrl": "https://app.com/redirect", "redirectDomainName": "app.com" }, "metadata": { "version": "1.0", "lastModifiedTime": "2021-06-13T19:49:31.686Z", "creationTime": "2021-06-13T19:49:31.686Z" } } }, "Resource_Management_APIs_GitLabIdentityProvider": { "title": "GitLabIdentityProvider", "description": "GitLab Identity Provider\n\nSupported protocols are: [OAUTH2]", "x-tags": [ "Models" ], "allOf": [ { "$ref": "#/components/schemas/Resource_Management_APIs_ExternalIdentityProvider" } ], "example": { "id": "u9k33onh6nbsjggayhubbef5te", "ownerType": "APPLICATION", "ownerId": "1sor7zaca5bzrmic3w7h2okogw", "type": "GITLAB", "name": "gitlab", "displayName": "GitLab", "isExternal": true, "status": "ENABLED", "protocol": { "type": "OAUTH2", "clientId": "6ae50f72", "clientSecret": "6ae50f72-e7e1-4a9f-a4f4-289ee3ba9bdd", "scopes": [ "some:scope" ], "redirectUrl": "https://app.com/redirect", "redirectDomainName": "app.com" }, "metadata": { "version": "1.0", "lastModifiedTime": "2021-06-13T19:49:31.686Z", "creationTime": "2021-06-13T19:49:31.686Z" } } }, "Resource_Management_APIs_GoogleIdentityProvider": { "title": "GoogleIdentityProvider", "description": "Google Identity Provider\n\nSupported protocols are: [OAUTH2]", "x-tags": [ "Models" ], "allOf": [ { "$ref": "#/components/schemas/Resource_Management_APIs_ExternalIdentityProvider" } ], "example": { "id": "u9k33onh6nbsjggayhubbef5te", "ownerType": "APPLICATION", "ownerId": "1sor7zaca5bzrmic3w7h2okogw", "type": "GOOGLE", "name": "google", "displayName": "Google", "isExternal": true, "status": "ENABLED", "protocol": { "type": "OAUTH2", "clientId": "1234567890-abc123def456.apps.googleusercontent.com", "clientSecret": "6ae50f72-e7e1-4a9f-a4f4-289ee3ba9bdd", "scopes": [ "some:scope" ], "redirectUrl": "https://app.com/redirect", "redirectDomainName": "app.com" }, "metadata": { "version": "1.0", "lastModifiedTime": "2021-06-13T19:49:31.686Z", "creationTime": "2021-06-13T19:49:31.686Z" } } }, "Resource_Management_APIs_GoogleWorkspaceIdentityProvider": { "title": "GoogleWorkspaceIdentityProvider", "description": "Google Workspace Identity Provider\n\nSupported protocols are: [SAML2]", "x-tags": [ "Models" ], "allOf": [ { "$ref": "#/components/schemas/Resource_Management_APIs_EnterpriseIdentityProvider" } ], "example": { "id": "u9k33onh6nbsjggayhubbef5te", "ownerType": "APPLICATION", "ownerId": "1sor7zaca5bzrmic3w7h2okogw", "type": "GOOGLE_WORKSPACE", "name": "ent:google-workspace:org1", "displayName": "Google Workspace", "isExternal": true, "jitProvisioningEnabled": true, "roleMappingEnabled": true, "status": "ENABLED", "protocol": { "type": "SAML2", "idpEntityId": "https://idp.com/123", "idpSsoUrl": "https://idp.com/sso", "allowIdpInitiatedSso": true, "idpSigningCerts": "-----BEGIN CERTIFICATE-----\nALABerBxYuNxJD57u9i0WdYmCyd5XKnWzwibDG7TZawhvZIWhrIu2IopHg0W\nOXlxQocYalChQbGgDk2pvHmi0oyKYAsNlMj4uYTdYpCxoEgII7FlOBd6UiBR\nipALcha2vD9eysOP6O0nDHRFoqDtYUIjGA0vV00HRx4mNN50HISs0GGySn8s\n-----END CERTIFICATE-----", "spDomainName": "sp.com", "spEntityId": "http://sp.com/id", "acsUrl": "http://sp.com/acs" }, "metadata": { "version": "1.0", "lastModifiedTime": "2021-06-13T19:49:31.686Z", "creationTime": "2021-06-13T19:49:31.686Z" } } }, "Resource_Management_APIs_MicrosoftIdentityProvider": { "title": "MicrosoftIdentityProvider", "description": "Microsoft Identity Provider", "x-tags": [ "Models" ], "allOf": [ { "$ref": "#/components/schemas/Resource_Management_APIs_ExternalIdentityProvider" }, { "type": "object", "description": "Microsoft Identity Provider", "properties": { "supportedAccountTypes": { "type": "array", "uniqueItems": true, "minItems": 1, "maxItems": 2, "description": "[Required on Create] Array of supported Microsoft account types. The account types selected need to match the supported account types that \nwere chosen when configuring the Microsoft Entra ID application. The below table provides more details regarding \nwhich Microsoft account types are allowed to authenticate based on the values specified in the array.\n| Account Types | Description | \n| ---------------------------| ------------------------------------------------------------------------------- | \n| [ORGANIZATION] | Accounts in any Microsoft organization directory |\n| [PERSONAL] | Personal Microsoft accounts only |\n| [ORGANIZATION, PERSONAL] | Accounts in any Microsoft organization directory or personal Microsoft accounts | ", "items": { "type": "string", "enum": [ "ORGANIZATION", "PERSONAL" ], "example": "PERSONAL" } } } } ], "example": { "id": "u9k33onh6nbsjggayhubbef5te", "ownerType": "TENANT", "ownerId": "1sor7zaca5bzrmic3w7h2okogw", "type": "MICROSOFT", "name": "microsoft", "displayName": "Microsoft", "isExternal": true, "supportedAccountTypes": [ "ORGANIZATION", "PERSONAL" ], "status": "ENABLED", "protocol": { "type": "OAUTH2", "clientId": "1234567890-abc123def456.apps.googleusercontent.com", "clientSecret": "6ae50f72-e7e1-4a9f-a4f4-289ee3ba9bdd", "scopes": [ "some:scope" ], "redirectUrl": "https://tnt.app.com/redirect", "redirectDomainName": "tnt.app.com" }, "metadata": { "version": "1.0", "lastModifiedTime": "2021-06-13T19:49:31.686Z", "creationTime": "2021-06-13T19:49:31.686Z" } } }, "Resource_Management_APIs_MicrosoftEntraIdIdentityProvider": { "title": "MicrosoftEntraIdIdentityProvider", "description": "Microsoft Entra ID Identity Provider", "x-tags": [ "Models" ], "allOf": [ { "$ref": "#/components/schemas/Resource_Management_APIs_EnterpriseIdentityProvider" }, { "type": "object", "description": "Microsoft Identity Provider", "properties": { "microsoftTenantId": { "description": "[Required on Create] The ID of the Microsoft tenant whose users will be allowed to login through this IdP. Note, the value of `9188040d-6c67-4c5b-b112-36a304b66dad` is not allowed since this references the Microsoft consumer tenant.", "type": "string", "pattern": "^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}", "example": "818210de-ac4d-4d23-b9bb-8b5177a73050" }, "verifiedEmailDomains": { "type": "array", "uniqueItems": true, "maxItems": 10, "description": "List of email domains that indicate which emails should be marked as verified when a user is provisioned through this identity provider.", "items": { "type": "string", "format": "host", "example": "companya.com" } } } } ], "example": { "id": "u9k33onh6nbsjggayhubbef5te", "ownerType": "TENANT", "ownerId": "1sor7zaca5bzrmic3w7h2okogw", "type": "MICROSOFT_ENTRA_ID", "name": "ent:microsoft-entra-id:org-a", "displayName": "Org A", "microsoftTenantId": "818210de-ac4d-4d23-b9bb-8b5177a73050", "verifiedEmailDomains": [ "companya.com", "companyb.com" ], "isExternal": true, "jitProvisioningEnabled": true, "roleMappingEnabled": true, "status": "ENABLED", "protocol": { "type": "OAUTH2", "clientId": "1234567890-abc123def456.apps.googleusercontent.com", "clientSecret": "6ae50f72-e7e1-4a9f-a4f4-289ee3ba9bdd", "scopes": [ "some:scope" ], "redirectUrl": "https://tnt.app.com/redirect", "redirectDomainName": "tnt.app.com" }, "metadata": { "version": "1.0", "lastModifiedTime": "2021-06-13T19:49:31.686Z", "creationTime": "2021-06-13T19:49:31.686Z" } } }, "Resource_Management_APIs_OktaIdentityProvider": { "title": "OktaIdentityProvider", "description": "Okta Identity Provider", "x-tags": [ "Models" ], "allOf": [ { "$ref": "#/components/schemas/Resource_Management_APIs_EnterpriseIdentityProvider" }, { "type": "object", "description": "Okta Identity Provider", "properties": { "domainName": { "description": "[Required on Create] Domain name of the Okta organization authorization server.", "type": "string", "pattern": "hostname", "example": "org-a.okta.com" } } } ], "example": { "id": "u9k33onh6nbsjggayhubbef5te", "ownerType": "TENANT", "ownerId": "1sor7zaca5bzrmic3w7h2okogw", "type": "OKTA", "name": "ent:okta:org-a", "displayName": "Okta Org A", "domainName": "org-a.okta.com", "isExternal": true, "jitProvisioningEnabled": true, "roleMappingEnabled": true, "status": "ENABLED", "protocol": { "type": "OAUTH2", "clientId": "1234567890-abc123def456.apps.googleusercontent.com", "clientSecret": "6ae50f72-e7e1-4a9f-a4f4-289ee3ba9bdd", "scopes": [ "some:scope" ], "redirectUrl": "https://tnt.app.com/redirect", "redirectDomainName": "tnt.app.com" }, "metadata": { "version": "1.0", "lastModifiedTime": "2021-06-13T19:49:31.686Z", "creationTime": "2021-06-13T19:49:31.686Z" } } } }, "examples": { "Resource_Management_APIs_WristbandIdentityProvider": { "value": { "id": "u9k33onh6nbsjggayhubbef5te", "ownerType": "APPLICATION", "ownerId": "1sor7zaca5bzrmic3w7h2okogw", "type": "WRISTBAND", "name": "wristband", "displayName": "Wristband", "isExternal": false, "status": "ENABLED", "loginIdentifiers": [ "EMAIL" ], "loginFactors": [ "PASSWORD", "MAGIC_LINK" ], "primaryLoginFactor": "PASSWORD", "resolvedPrimaryLoginFactor": "PASSWORD", "metadata": { "version": "1.0", "lastModifiedTime": "2021-06-13T19:49:31.686Z", "creationTime": "2021-06-13T19:49:31.686Z" } } }, "Resource_Management_APIs_GoogleIdentityProvider": { "value": { "id": "u9k33onh6nbsjggayhubbef5te", "ownerType": "APPLICATION", "ownerId": "1sor7zaca5bzrmic3w7h2okogw", "type": "GOOGLE", "name": "google", "displayName": "Google", "isExternal": true, "status": "ENABLED", "protocol": { "type": "OAUTH2", "clientId": "2c075bd4-5ac9-4e85-a197-d5e3f53b5a77", "clientSecret": "secretValue", "scopes": [ "some:scope" ], "redirectUrl": "https://app.com/redirect", "redirectDomainName": "app.com" }, "metadata": { "version": "1.0", "lastModifiedTime": "2021-06-13T19:49:31.686Z", "creationTime": "2021-06-13T19:49:31.686Z" } } } }, "headers": { "Resource_Management_APIs_ETag": { "schema": { "type": "string", "example": "1.0", "minLength": 1 }, "description": "The version of the resource" }, "Resource_Management_APIs_Location": { "schema": { "type": "string" }, "description": "URL pointing to the location of the newly created resource" } }, "responses": { "Resource_Management_APIs_401": { "description": "Unauthorized", "headers": { "WWW-Authenticate": { "description": "Includes details on the failed authentication condition. This header is set in accordance with the [OAuth2 specification](https://datatracker.ietf.org/doc/html/rfc6750#section-3).", "schema": { "type": "string", "example": "Bearer error=\"invalid_token\", error_description=\"The provided access token was invalid\"" } } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Resource_Management_APIs_api-error" }, "examples": { "code - unauthenticated": { "value": { "type": "base_error", "code": "invalid_access_token", "message": "The provided access token was invalid", "ticket": "1u0d0edhwbjsd" } } } } } }, "Resource_Management_APIs_403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Resource_Management_APIs_api-error" }, "examples": { "code - unauthorized": { "value": { "type": "base_error", "code": "unauthorized", "message": "The request failed authorization", "ticket": "11t7n71hi5e6t" } } } } } }, "Resource_Management_APIs_405": { "description": "Method Not Allowed", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Resource_Management_APIs_api-error" }, "examples": { "code - method_not_supported": { "value": { "type": "base_error", "code": "method_not_supported", "message": "The specified HTTP method is not supported", "ticket": "11t7n71hi5e6t" } } } } } }, "Resource_Management_APIs_406": { "description": "Not Acceptable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Resource_Management_APIs_api-error" }, "examples": { "code - not_acceptable": { "value": { "type": "base_error", "code": "not_acceptable", "message": "The Accept header was invalid", "ticket": "11t7n71hi5e6t" } } } } } }, "Resource_Management_APIs_415": { "description": "Unsupported Media Type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Resource_Management_APIs_api-error" }, "examples": { "code - unsupported_media_type": { "value": { "type": "base_error", "code": "unsupported_media_type", "message": "The Content-Type header was invalid", "ticket": "11t7n71hi5e6t" } } } } } }, "Resource_Management_APIs_500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Resource_Management_APIs_api-error" }, "examples": { "code - internal_server_failure ": { "value": { "type": "base_error", "code": "internal_server_failure", "message": "An unexpected error occurred while processing the request", "ticket": "11t7n71hi5e6t" } } } } } }, "Resource_Management_APIs_503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Resource_Management_APIs_api-error" }, "examples": { "code - service_unavailable": { "value": { "type": "base_error", "code": "service_unavailable", "message": "The service is currently unavailable", "ticket": "11t7n71hi5e6t" } } } } } }, "Resource_Management_APIs_400-with-message-body": { "description": "Bad Request", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Resource_Management_APIs_api-error" }, { "$ref": "#/components/schemas/Resource_Management_APIs_constraint-violations-api-error" } ] }, "examples": { "code - invalid_request": { "value": { "type": "base_error", "code": "invalid_request", "message": "The request was invalid", "ticket": "11t7n71hi5e6t" } }, "code - request_constraint_violations": { "value": { "type": "constraint_violations_error", "code": "message_body_constraint_violations", "message": "The message body contained invalid fields", "ticket": "11t7n71hi5e6t", "violations": { "field1": { "code": "too_long", "constraintAttributes": { "maxLength": 10 } }, "field2": { "code": "not_null" } } } }, "code - message_body_constraint_violations": { "value": { "type": "constraint_violations_error", "code": "message_body_constraint_violations", "message": "The message body contained invalid fields", "ticket": "11t7n71hi5e6t", "violations": { "field1": { "code": "too_long", "constraintAttributes": { "maxLength": 10 } }, "field2": { "code": "not_null" } } } } } } } } } }, "x-tagGroups": [ { "name": "Resource Management APIs", "tags": [ "Applications", "Auth Factors", "Auth Sessions", "Auth Session Policies", "Bot Detection Policies", "Custom Claims", "Custom Domains", "Email Brandings", "Email Domains", "Email Policies", "External IdP Profiles", "External IdP Tokens", "Identity Providers", "IdP Attribute Mappings", "IdP Role Mappings", "MFA Policies", "OAuth2 Clients", "Page Brandings", "Password Policies", "Permissions", "Permission Boundaries", "Permission Groups", "Refresh Tokens", "Remembered Tenants", "Roles", "Role Assignment Policies", "Signing Keys", "Tenants", "Users", "User Schemas", "Vanity Domains", "Webhook Policies", "Workflow Policies" ] } ] } ```