-
Notifications
You must be signed in to change notification settings - Fork 0
/
pingone-management.yml
21512 lines (21510 loc) · 735 KB
/
pingone-management.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
openapi: 3.0.0
info:
title: PingOne Platform API - SSO and Base
description: The PingOne Platform API covering the base and SSO services (otherwise known as the Management APIs)
version: '2023-06-29'
externalDocs:
url: https://apidocs.pingidentity.com/pingone/platform/v1/api/#management-apis
description: PingOne Platform API Reference - Management APIs
servers:
- url: '{protocol}://{baseDomain}.{suffix}/v1'
description: PingOne Platform API Endpoint
variables:
suffix:
enum:
- 'asia'
- 'ca'
- 'com'
- 'com.au'
- 'eu'
default: 'com'
baseDomain:
default: 'api.pingone'
protocol:
default: 'https'
- url: '{protocol}://{baseHostname}/v1'
description: PingOne Platform API Endpoint
variables:
baseHostname:
default: 'api.pingone.com'
protocol:
default: 'https'
components:
securitySchemes:
bearer:
type: http
scheme: bearer
bearerFormat: JWT
description: OAuth bearer token (see documentation)
schemas:
LinksHATEOAS:
type: object
readOnly: true
additionalProperties: true
properties:
self:
type: object
description: An object that describes the current resource.
properties:
href:
$ref: '#/components/schemas/LinksHATEOASHref'
next:
type: object
description: An object that describes the next page of results. This property is present only if there is a next page of results and the `limit` parameter is used.
properties:
href:
$ref: '#/components/schemas/LinksHATEOASHref'
LinksHATEOASHref:
type: string
format: uri
description: The URI of the resource.
EnumAgreementRevisionContentType:
type: string
description: An immutable string that specifies the content type of text. Options are text/html and text/plain, as defined by [rfc-6838](https://datatracker.ietf.org/doc/html/rfc6838#section-4.2.1) and [Media Types/text](https://www.iana.org/assignments/media-types/media-types.xhtml#text). This attribute is supported in POST requests only.
enum: [text/html,text/plain]
EnumAlertChannelAlertType:
type: string
enum: [CERTIFICATE_EXPIRED, CERTIFICATE_EXPIRING, KEY_PAIR_EXPIRED, GATEWAY_VERSION_DEPRECATED, KEY_PAIR_EXPIRING, GATEWAY_VERSION_DEPRECATING]
description: Alert channel alerting types. Possible values are `CERTIFICATE_EXPIRED`, `CERTIFICATE_EXPIRING`, `KEY_PAIR_EXPIRED`, `GATEWAY_VERSION_DEPRECATED`, `KEY_PAIR_EXPIRING`, `GATEWAY_VERSION_DEPRECATING`.
EnumAlertChannelSeverity:
type: string
enum: [INFO, WARNING, ERROR]
description: Alert channel severity. Possible values are `INFO`, `WARNING`, and `ERROR`.
EnumAlertChannelType:
type: string
enum: [EMAIL]
description: Alert channel type enumeration. Possible values are `EMAIL`.
EnumApplicationAccessControlType:
type: string
description: A string that specifies the user role required to access the application. Options are ADMIN_USERS_ONLY. A user is an admin user if the user has one or more of the following roles Organization Admin, Environment Admin, Identity Data Admin, or Client Application Developer.
enum: [ADMIN_USERS_ONLY]
EnumApplicationAccessControlGroupType:
type: string
enum: [ANY_GROUP, ALL_GROUPS]
description: A string that specifies the group type required to access the application. Options are `ANY_GROUP` (the actor must belong to at least one group listed in the `groups` property) and `ALL_GROUPS` (the actor must belong to all groups listed in the `groups` property).
EnumApplicationCorsSettingsBehavior:
type: string
enum: [ALLOW_NO_ORIGINS, ALLOW_SPECIFIC_ORIGINS]
description: The behavior of CORS for the application. `ALLOWS_NO_ORIGINS` rejects all CORS requests. `ALLOW_SPECIFIC_ORIGINS` rejects all CORS requests except those listed in `corsSettings.origins`.
EnumApplicationNativeGooglePlayVerificationType:
type: string
enum: [GOOGLE, INTERNAL]
description: The type of verification that should be used. The possible values are `GOOGLE` and `INTERNAL`. Using internal verification will not count against your Google API call quota. The value you select for `verificationType` determines what other parameters you must provide. When set to `GOOGLE`, you must provide `serviceAccountCredentials`. When set to `INTERNAL`, you must provide `decryptionKey` and `verificationKey`.
EnumApplicationOIDCGrantType:
type: string
enum: [AUTHORIZATION_CODE, IMPLICIT, REFRESH_TOKEN, CLIENT_CREDENTIALS, DEVICE_CODE]
EnumApplicationOIDCPARRequirement:
type: string
description: Whether pushed authorization requests (PAR) are required. Options are `REQUIRED` and `OPTIONAL`. The default value is `OPTIONAL`.
default: OPTIONAL
enum: [REQUIRED, OPTIONAL]
EnumApplicationOIDCPKCEOption:
type: string
enum: [OPTIONAL, REQUIRED, S256_REQUIRED]
description: A string that specifies how PKCE request parameters are handled on the authorize request. Options are OPTIONAL PKCE code_challenge is optional and any code challenge method is acceptable. REQUIRED PKCE code_challenge is required and any code challenge method is acceptable. S256_REQUIRED PKCE code_challege is required and the code_challenge_method must be S256.
EnumApplicationOIDCResponseType:
type: string
description: The code or token type returned by an authorization request. Options are `TOKEN`, `ID_TOKEN`, and `CODE`. For hybrid flows that specify `CODE` with `TOKEN` or `ID_TOKEN`, see [Hybrid grant type](https://apidocs.pingidentity.com/pingone/main/v1/api/#hybrid-grant-type).
enum: [TOKEN, ID_TOKEN, CODE]
EnumApplicationOIDCTokenAuthMethod:
type: string
enum: [NONE, CLIENT_SECRET_BASIC, CLIENT_SECRET_POST, PRIVATE_KEY_JWT, CLIENT_SECRET_JWT]
description: A string that specifies the client authentication methods supported by the token endpoint.
EnumApplicationProtocol:
type: string
enum: [OPENID_CONNECT, SAML, WS-FED, EXTERNAL_LINK]
description: A string that specifies the protocol for the Application.
EnumApplicationSAMLSloBinding:
type: string
enum: [HTTP_REDIRECT, HTTP_POST]
description: A string that specifies the binding protocol to be used for the logout response. Options are HTTP_REDIRECT or HTTP_POST. The default is HTTP_POST; existing configurations with no data default to HTTP_POST.
default: HTTP_POST
EnumApplicationTags:
type: string
enum: [PING_FED_CONNECTION_INTEGRATION]
EnumApplicationType:
type: string
enum: [WEB_APP, NATIVE_APP, SINGLE_PAGE_APP, WORKER, SERVICE, CUSTOM_APP, PING_ONE_SELF_SERVICE, PING_ONE_ADMIN_CONSOLE, PING_ONE_PORTAL, TEMPLATE_APP, PORTAL_LINK_APP]
description: A string that specifies the type associated with the application. This is a required property.
EnumApplicationWSFEDIDPSigningAlgorithm:
type: string
description: The signature algorithm to be used for signing. Algorithms supported `SHA256withRSA`, `SHA384withRSA`, `SHA512withRSA`, `SHA256withECDSA`, `SHA384withECDSA`, and `SHA512withECDSA`.
enum: [SHA256withRSA, SHA384withRSA, SHA512withRSA, SHA256withECDSA, SHA384withECDSA, SHA512withECDSA]
EnumApplicationWSFEDKerberosGatewayType:
type: string
enum: [LDAP]
description: The gateway type. This must be "LDAP".
EnumAttributeMappingType:
type: string
enum: [CORE, SCOPE, CUSTOM]
description: A string that specifies the mapping type of the attribute. Options are CORE, SCOPE, and CUSTOM. The CORE and SCOPE mapping types are for reserved attributes managed by the API and cannot be removed. Attribute values for these mapping types can be updated. The CUSTOM mapping type is for user-defined attributes. Attributes of this type can be updated and deleted.
EnumBillOfMaterialsProductTags:
type: string
enum: [DAVINCI_MINIMAL]
EnumBrandingLogoType:
type: string
enum: [IMAGE, NONE]
description: The type of format used for the image. Options are IMAGE and NONE.
EnumBrandingThemeBackgroundType:
type: string
enum: [NONE, COLOR, IMAGE, DEFAULT]
description: The background type for the theme. Options are `NONE`, `COLOR`, `IMAGE`, `DEFAULT`.
EnumBrandingThemeTemplate:
type: string
enum: [default, focus, mural, slate, split]
description: The template name of the branding theme associated with the environment. Options are default, focus, mural, slate, and split.
EnumCertificateKeyAlgorithm:
type: string
enum: [RSA, EC, UNKNOWN]
description: Specifies the key algorithm. Options are `RSA`, `EC`, and `UNKNOWN`.
EnumCertificateKeySignagureAlgorithm:
type: string
description: Specifies the signature algorithm of the key. For RSA keys, options are `SHA256withRSA`, `SHA384withRSA` and `SHA512withRSA`. For elliptical curve (EC) keys, options are `SHA256withECDSA`, `SHA384withECDSA`, and `SHA512withECDSA`
enum: [SHA256withRSA, SHA384withRSA, SHA512withRSA, SHA256withECDSA, SHA384withECDSA, SHA512withECDSA]
EnumCertificateKeyStatus:
type: string
description: Specifies the status of the key. Options are `VALID`, `EXPIRING`, `EXPIRED`, `NOT_YET_VALID`, and `REVOKED`.
enum: [VALID, EXPIRING, EXPIRED, NOT_YET_VALID, REVOKED]
readOnly: true
EnumCertificateKeyUsageType:
type: string
description: Specifies how the certificate is used. Options are `ENCRYPTION`, `SIGNING`, `SSL/TLS`, `ISSUANCE`, `OUTBOUND_MTLS`. `ISSUANCE` keys are used as part of another key's trust chain, and are used to sign other keys. Certificate Revocation Lists (CRL) are published against these keys. `SSL/TLS` keys are used to protect internet protocol domains (such as, a [Custom Domain](https://apidocs.pingidentity.com/pingone/platform/v1/api/#custom-domains) you've configured in PingOne). `OUTBOUND_MTLS` keys are used to enable mutual TLS (mTLS) authentication with a subscription service.
enum: [ENCRYPTION, SIGNING, SSL/TLS, ISSUANCE, OUTBOUND_MTLS]
EnumCreateCertificateAcceptHeader:
type: string
enum: [application/x-pkcs7-certificates]
EnumCSRExportHeader:
type: string
enum: [application/pkcs10, application/x-pem-file]
EnumCSRResponseImportHeader:
type: string
enum: [application/x-pem-file]
EnumCustomDomainPostHeader:
type: string
enum: [application/vnd.pingidentity.certificate.import+json, application/vnd.pingidentity.domainName.verify+json]
EnumCustomDomainStatus:
type: string
description: A string that specifies the status of the custom domain. Options are ACTIVE, VERIFICATION_REQUIRED, and SSL_CERTIFICATE_REQUIRED.
enum: [ACTIVE, VERIFICATION_REQUIRED, SSL_CERTIFICATE_REQUIRED]
EnumEmailDomainStatus:
type: string
enum: [ACTIVE, VERIFICATION_REQUIRED]
description: The status of the email domain ownership.
EnumEnvironmentType:
type: string
enum: [PRODUCTION, SANDBOX]
description: A string that specifies the type of environment to use.
EnumFormItemAlignment:
type: string
enum: [LEFT, CENTER, RIGHT]
description: A string that specifies the alignment of the item.
EnumFormCategory:
type: string
enum: [CUSTOM]
description: A string that specifies the type of form. The `CUSTOM` form type allows the form to be built with fields that do not map specifically to the PingOne directory attributes.
EnumFormElementLabelMode:
type: string
enum: [DEFAULT, FLOAT]
description: A string that specifies how the field is rendered.
EnumFormElementLayout:
type: string
enum: [HORIZONTAL, VERTICAL]
description: A string that specifies layout attributes for radio button and checkbox fields. This is a required property when the type is `RADIO` or `CHECKBOX`.
EnumFormElementValidationType:
type: string
enum: [NONE, CUSTOM]
description: A string that specifies the validation type. This is a required property when the field type is `TEXT`.
EnumFormFieldType:
type: string
enum: [TEXT, PASSWORD, PASSWORD_VERIFY, RADIO, CHECKBOX, DROPDOWN, COMBOBOX, DIVIDER, EMPTY_FIELD, TEXTBLOB, SLATE_TEXTBLOB, SUBMIT_BUTTON, ERROR_DISPLAY, FLOW_LINK, FLOW_BUTTON, RECAPTCHA_V2, QR_CODE, SOCIAL_LOGIN_BUTTON]
description: A string that specifies the type of the field.
EnumFormRecaptchaV2Size:
type: string
enum: [NORMAL, COMPACT]
description: A string that specifies the size of the reCAPTCHA widget.
EnumFormRecaptchaV2Theme:
type: string
enum: [LIGHT, DARK]
description: A string that specifies the theme of the reCAPTCHA widget.
EnumFormSocialLoginIdpType:
type: string
enum: [FACEBOOK, APPLE, GOOGLE, AMAZON, LINKEDIN, MICROSOFT, TWITTER, YAHOO, PAYPAL, GITHUB, OPENID_CONNECT, SAML, LDAP]
description: A string that specifies the external identity provider type.
EnumFormStylesWidthUnit:
type: string
enum: [PERCENT, PIXELS]
EnumFormTranslationMethod:
type: string
enum: [TRANSLATE, DEFAULT_VALUE, KEY]
description: A string that specifies how to translate the text strings in the form.
EnumFormQrCodeType:
type: string
enum: [MFA_AUTH]
description: A string that specifies the QR Code type.
EnumFlowPolicyTriggerType:
type: string
description: An enum string that specifies the trigger type associated with the flow policy trigger.
enum: [AUTHENTICATION]
EnumFormsIncludeParameter:
type: string
enum: [components]
EnumGatewayTypeLDAPSecurity:
type: string
enum: [None, TLS, StartTLS]
description: A string that specifies the connection security type. Options are None, TLS, and StartTLS. The default value is None.
default: None
EnumGatewayType:
type: string
enum: [LDAP, PING_FEDERATE, PING_INTELLIGENCE, API_GATEWAY_INTEGRATION, RADIUS]
description: A string that specifies the type of gateway resource. Options are LDAP, PING_FEDERATE, API_GATEWAY_INTEGRATION, RADIUS and PING_INTELLIGENCE. This is a required property.
EnumGatewayPasswordAuthority:
type: string
enum: [PING_ONE, LDAP]
description: This can be either `PING_ONE` or `LDAP`. If set to `PING_ONE`, PingOne authenticates with the external directory initially, then PingOne authenticates all subsequent sign-ons.
EnumGatewayVendor:
type: string
enum: [PingDirectory, Microsoft Active Directory, Oracle Directory Server Enterprise Edition, Oracle Unified Directory, CA Directory, OpenDJ Directory, IBM (Tivoli) Security Directory Server, LDAP v3 compliant Directory Server]
description: A string that specifies the LDAP vendor. Options are `PingDirectory`, `Microsoft Active Directory`, `Oracle Directory Server Enterprise Edition`, `Oracle Unified Directory`, `CA Directory`, `OpenDJ Directory`, `IBM (Tivoli) Security Directory Server`, and `LDAP v3 compliant Directory Server`.
EnumGetKeyAcceptHeader:
type: string
enum: [application/json, application/x-pkcs7-certificates, application/x-x509-ca-cert]
EnumGroupSourceType:
type: string
enum: [GATEWAY, IDP]
readOnly: true
description: External groups only. Set during user creation/update. Supported values are `GATEWAY`, `IDP`
EnumHealthStatus:
type: string
enum: [HEALTHY, DEGRADED, UNHEALTHY]
description: An enumeration that specifies whether or not the gateway is in a healthy state.
EnumIdentityPropagationPlanStatus:
type: string
enum: [INACTIVE]
description: Status of the propagation plan; defaults to `INACTIVE`
EnumIdentityProvider:
type: string
enum: [FACEBOOK, GOOGLE, LINKEDIN, APPLE, TWITTER, AMAZON, YAHOO, MICROSOFT, PAYPAL, GITHUB, OPENID_CONNECT, SAML, PING_ONE]
description: A string that identifies the type of identity provider used to authenticate the user. The default value of `PING_ONE` is set when a value for identityProvider.id is not provided. The `PING_ONE` value is the default for all pre-existing users. There is currently no search filter support for this attribute.
default: PING_ONE
EnumIdentityProviderAttributeMappingType:
type: string
description: The mapping type. Options are CORE (This attribute is required by the schema and cannot be removed. The name and update properties cannot be changed.) or CUSTOM (All user-created attributes are of this type.)
enum: [CORE, CUSTOM]
EnumIdentityProviderAttributeMappingUpdate:
type: string
description: Indicates whether to update the user attribute in the directory with the non-empty mapped value from the IdP. Options are EMPTY_ONLY (only update the user attribute if it has an empty value); ALWAYS (always update the user attribute value).
enum: [EMPTY_ONLY, ALWAYS]
EnumIdentityProviderExt:
type: string
enum: [FACEBOOK, GOOGLE, LINKEDIN, APPLE, TWITTER, AMAZON, YAHOO, MICROSOFT, PAYPAL, GITHUB, OPENID_CONNECT, SAML]
description: A string that identifies the type of identity provider used to authenticate the user.
EnumIdentityProviderOIDCTokenAuthMethod:
type: string
description: A string that specifies the OIDC identity provider's token endpoint authentication method. Options are CLIENT_SECRET_BASIC (default), CLIENT_SECRET_POST, and NONE. This is a required property.
default: CLIENT_SECRET_BASIC
enum: [CLIENT_SECRET_BASIC, CLIENT_SECRET_POST, NONE]
EnumIdentityProviderPKCEMethod:
type: string
description: The method for PKCE. Options are `NONE` or `S256`. The default is `NONE`. This value auto-populates from a discovery endpoint if the OpenID Provider includes `S256` in its `code_challenge_methods_supported` claim. The plain method is not currently supported.
default: NONE
enum: [S256, NONE]
EnumIdentityProviderSAMLSigningAlgorithm:
type: string
description: The signing key algorithm used by PingOne. Value will depend on which key algorithm and signature algorithm you chose when creating your signing key. Possible values are `SHA256withRSA`, `SHA384withRSA`, `SHA512withRSA`, `SHA256withECDSA`, `SHA384withECDSA`, `SHA512eithEDCSA`.
enum: [SHA256withRSA, SHA384withRSA, SHA512withRSA, SHA256withECDSA, SHA384withECDSA, SHA512eithEDCSA]
EnumIdentityProviderSAMLSSOBinding:
type: string
description: A string that specifies the binding for the authentication request. Options are HTTP_POST and HTTP_REDIRECT.
enum: [HTTP_POST, HTTP_REDIRECT]
EnumIdentityProviderSAMLSLOBinding:
type: string
description: The binding protocol to be used for the logout response. Options are `HTTP_REDIRECT` or `HTTP_POST`. The default is `HTTP_POST`; existing configurations with no data default to `HTTP_POST`. This is an optional property.
enum: [HTTP_POST, HTTP_REDIRECT]
default: HTTP_POST
EnumImageFormat:
type: string
enum: [png, jpg, gif]
description: A string that specifies the type of format used for the image. Options are jpg, png, and gif.
EnumKeyRotationPolicyAlgorithm:
type: string
enum: [RSA]
description: The algorithm this KRP applies to generated `KrpKeys`. `RSA` is currently the only supported value.
EnumKeyRotationPolicySigAlgorithm:
type: string
enum: [SHA256withRSA]
description: The signature algorithm this KRP will apply to generated `KrpKeys`. `SHA256withRSA` is currently the only supported value.
EnumKeyRotationPolicyUsageType:
type: string
enum: [SIGNING]
description: How the KRP will be used, pertaining to what operations the KRP supports. The only valid value for initial release is `SIGNING`.
EnumLicenseStatus:
type: string
enum: [ACTIVE, EXPIRED, FUTURE, TERMINATED]
description: A string that specifies the status of the license. Options are `ACTIVE`, `EXPIRED`, `FUTURE` and `TERMINATED`.
EnumMobileIntegrityDetectionPlatform:
type: string
enum: [IOS, GOOGLE]
EnumNotificationsPolicyCountryLimitDeliveryMethod:
type: string
enum: [SMS, Voice]
description: The delivery method that the defined limitation should be applied to. Options are `SMS`, `Voice`.
EnumNotificationsPolicyCountryLimitType:
type: string
enum: [NONE, ALLOWED, DENIED]
description: |
Determines the kind of limitation being defined. The possible values are:
`NONE`
`ALLOWED` - allows SMS/Voice notifications only for the countries specified with `countryLimit.countries`
`DENIED` - denies SMS/Voice notifications for the countries specified with `countryLimit.countries`
EnumNotificationsPolicyQuotaDeliveryMethods:
type: string
enum: [SMS, Voice, Email]
EnumNotificationsPolicyQuotaItemType:
type: string
enum: [USER, ENVIRONMENT]
description: Specifies whether the limit defined is per-user or per environment. Value must be either `USER` or `ENVIRONMENT`.
EnumNotificationsSettingsDeliveryMode:
type: string
enum: [ALL]
EnumNotificationsSettingsPhoneDeliverySettingsCustomDeliveryMethod:
type: string
enum: [SMS, VOICE]
description: |
The notification's delivery method. Possible values:
`SMS`
`VOICE`
EnumNotificationsSettingsPhoneDeliverySettingsCustomRequestMethod:
type: string
enum: [GET, POST]
description: The type of HTTP request method. Possible values are `GET` and `POST`.
EnumNotificationsSettingsPhoneDeliverySettingsCustomNumberFormat:
type: string
enum: [FULL, NUMBER_ONLY]
default: FULL
description: |
The phone number format. Possible values:
`FULL` (default)
The phone number format with a leading `+` sign, in the E.164 standard format.
For example: `+14155552671`
`NUMBER_ONLY`
The phone number format without a leading `+` sign, in the E.164 standard format.
For example: `14155552671`
EnumNotificationsSettingsPhoneDeliverySettingsCustomNumbersType:
type: string
enum: [SHORT_CODE, TOLL_FREE, PHONE_NUMBER]
description: The type of phone number.
EnumNotificationsSettingsPhoneDeliverySettingsCustomNumbersCapability:
type: string
enum: [SMS, VOICE]
description: The type of phone delivery service capability.
EnumNotificationsSettingsPhoneDeliverySettingsCustomAuthMethod:
type: string
enum: [BASIC, BEARER]
description: |
The custom provider account's authentication method. Possible values: `BASIC`, `BEARER`
EnumNotificationsSettingsPhoneDeliverySettingsTwilioSyniverseNumbersType:
type: string
enum: [SHORT_CODE, TOLL_FREE, PHONE_NUMBER]
description: |
The type of phone number. Possible values: `SHORT_CODE`, `TOLL_FREE`, `PHONE_NUMBER`
EnumNotificationsSettingsPhoneDeliverySettingsTwilioSyniverseNumbersCapability:
type: string
enum: [VOICE, SMS]
description: |
The type of phone delivery service capability. Possible values: `VOICE`, `SMS`
EnumNotificationsSettingsPhoneDeliverySettingsProvider:
type: string
enum: [CUSTOM_TWILIO, CUSTOM_SYNIVERSE, CUSTOM_PROVIDER]
description: |
The ID of the provider of phone delivery service. Possible values:
`PINGONE_TWILIO`: Specifies that Ping Identity's Twilio account is the SMS/voice provider.
`CUSTOM_TWILIO`: Specifies that your Twilio account is the SMS/voice provider.
`CUSTOM_SYNIVERSE`: Specifies that your Syniverse account is the SMS/voice provider.
`CUSTOM_PROVIDER`: Specifies a custom-defined SMS provider (excluding Twilio and Syniverse).
EnumOrganizationType:
type: string
enum: [PAID, TRIAL, INTERNAL]
description: A string that specifies the organization type. If the organization has any paid licenses, the type property value is set to `PAID`. Otherwise, the property value is set to `TRIAL`. Internal organizations have a value of `INTERNAL`.
EnumPasscodeRefreshTimeUnit:
type: string
description: The type of time unit for `mobile.passcodeRefreshDuration.duration`. Must be SECONDS.
default: SECONDS
enum: [SECONDS]
EnumProductType:
type: string
enum: [PING_ONE_MFA, PING_ONE_DAVINCI, PING_ONE_ORCHESTRATE, PING_ONE_RISK, PING_ONE_FRAUD, PING_ONE_PROVISIONING, PING_DATA_SYNC, PING_DATA_GOVERNANCE, PING_ONE_FOR_ENTERPRISE, PING_ID_SDK, PING_ONE_FOR_SAAS, PING_ONE_VERIFY, PING_ONE_CREDENTIALS, PING_ONE_AUTHORIZE, PING_ONE_BASE, PING_FEDERATE, PING_ACCESS, PING_DIRECTORY, PING_AUTHORIZE, PING_ID, PING_INTELLIGENCE, PING_CENTRAL]
description: A string that specifies the Ping Identity product type. Options for PingOne platform products are PING_ONE_DAVINCI, PING_ONE_MFA, PING_ONE_RISK, PING_ONE_VERIFY, PING_ONE_CREDENTIALS, PING_ONE_AUTHORIZE and PING_ONE_BASE. The PING_ONE_BASE product represents the default set of services that an environment can use on the PingOne platform. Options for other Ping Identity products are PING_FEDERATE, PING_ACCESS, PING_DIRECTORY, PING_AUTHORIZE, PING_ID, PING_INTELLIGENCE, and PING_CENTRAL
EnumPropagationStoreConnectionStatusContentType:
type: string
enum: [application/vnd.pingidentity.connection.check+json]
EnumPropagationStoreStatus:
type: string
enum: [INACTIVE]
description: The status of the identity store. The default value is INACTIVE.
EnumPropagationStoreSyncState:
type: string
readOnly: true
enum: [SYNCING, FAILED]
description: The current state of synchronization with a propagation store or stores. Options are either SYNCING or FAILED.
EnumPropagationStoreType:
type: string
enum: [Aquera, AzureActiveDirectorySAML2, directory, LdapGateway, PingOne, Salesforce, SalesforceContacts, scim, Slack, Workday, Zoom]
description: The type of the identity store and determines the required and acceptable configuration properties. It also determines the acceptable target attribute mappings. Options are Aquera, AzureActiveDirectorySAML2, directory, LdapGateway, PingOne, Salesforce, SalesforceContacts, scim, Slack, Workday, or Zoom.
EnumPropagationStoreTypeRemoveActionDisable:
type: string
enum: [Disable]
description: The action to take when deprovisioning (removing) a user. Must be set to Disable.
EnumPropagationStoreTypeRemoveActionDisableDelete:
type: string
enum: [Disable, Delete]
description: The action to take when deprovisioning (removing) a user. Options are either `Disable` or `Delete`.
EnumPropagationStoreTypeAqueraAuthenticationMethod:
type: string
enum: [OAuth Bearer Token, Basic Auth]
description: The account authentication method. For example, `OAuth Bearer Token` or `Basic Auth`.
EnumPropagationStoreTypeAqueraGroupSourceName:
type: string
enum: [Common Name, Distinguished Name]
description: The source to use for the group name. Options are either `Common Name` or `Distinguished Name`.
EnumPropagationStoreTypeLDAPGatewayLDAPType:
type: string
enum: [PingDirectory, Microsoft Active Directory]
description: Type of LDAP gateway; can be `PingDirectory` or `Microsoft Active Directory`.
EnumPropagationStoreTypePingOneDefaultAuthMethod:
type: string
enum: [Email 1, SMS 1, Voice 1]
description: The default authentication method. Options are `Email 1`, `SMS 1`, or `Voice 1`.
EnumPropagationStoreTypePingOneRegion:
type: string
enum: [NA, CA, EU, AP]
description: A supported region. Options are `NA`, `CA`, `EU`, or `AP`.
EnumPropagationStoreTypeSalesforceContactsRecordType:
type: string
enum: [Lead, Contact]
description: The type of Salesforce record. Options are either Lead or Contact.
EnumPropagationStoreTypeSCIMAuthenticationMethod:
type: string
enum: [OAuth 2 Client Credentials, OAuth 2 Bearer Token, Basic Authentication]
description: The account authentication method. Can be `OAuth 2 Client Credentials`, `OAuth 2 Bearer Token`, or `Basic Authentication`.
EnumPropagationStoreTypeSCIMGroupNameSource:
type: string
enum: [Common Name, Distinguished Name]
description: The source to use for the group name. Options are either `Common Name` or `Distinguished Name`.
EnumPropagationStoreTypeSCIMUniqueUserIdentifier:
type: string
enum: [userName, workEmail]
description: Specifies the unique user identifier to use. Options are either `userName` or `workEmail`.
EnumPropagationStoreTypeSlackUniqueUserIdentifier:
type: string
enum: [primaryEmail, userName]
description: The unique user identifier, must be either `primaryEmail` or `userName`.
EnumPropagationStoreTypeZoomAuthenticationMethod:
type: string
enum: [JWT Bearer Token, OAuth Bearer Token]
description: Account authentication method. Case sensitive. Can be JWT Bearer Token or OAuth Bearer Token. Defaults to JWT Bearer Token.
default: JWT Bearer Token
EnumRegionCode:
type: string
enum: [AP, CA, EU, NA]
description: A string that specifies the environment region code. The value is set when the environment is created and cannot be updated.
EnumRegionCodeLicense:
type: string
enum: [AP, CA, EU, NORTH_AMERICA]
EnumResourceAttributeType:
type: string
enum: [CORE, CUSTOM, PREDEFINED]
description: |
A string that specifies the type of resource attribute. Options are:
CORE: The claim is required and cannot not be removed.
CUSTOM: The claim is not a CORE attribute. All created attributes are of this type.
PREDEFINED: A designation for predefined OIDC resource attributes such as given_name. These attributes cannot be removed; however, they can be modified.
EnumResourceApplicationResourceType:
type: string
enum: [PING_ONE_RESOURCE]
description: The application resource's parent type. Options are `PING_ONE_RESOURCE`.
EnumResourceIntrospectEndpointAuthMethod:
type: string
enum: [NONE, CLIENT_SECRET_BASIC, CLIENT_SECRET_POST]
description: The client authentication methods supported by the token endpoint. Options are `NONE`, `CLIENT_SECRET_BASIC`, and `CLIENT_SECRET_POST`.
EnumResourceType:
type: string
enum: [OPENID_CONNECT, PINGONE_API, CUSTOM]
description: A string that specifies the type of resource. Options are `OPENID_CONNECT`, `PINGONE_API`, and `CUSTOM`. Only the `CUSTOM` resource type can be created. `OPENID_CONNECT` specifies the built-in platform resource for OpenID Connect. `PINGONE_API` specifies the built-in platform resource for PingOne.
EnumRoleName:
type: string
description: The name of the role
enum: [
"Client Application Developer",
"Configuration Read Only",
"DaVinci Admin Read Only",
"DaVinci Admin",
"Environment Admin",
"Identity Data Admin",
"Identity Data Read Only",
"Organization Admin",
"PingFederate Administrator",
"PingFederate Auditor",
"PingFederate Crypto Administrator",
"PingFederate Expression Administrator",
"PingFederate User Administrator"
]
EnumRoleAssignmentScopeType:
type: string
enum: [ORGANIZATION, ENVIRONMENT, POPULATION]
description: A string that specifies the type of resource defining the scope of the Role assignment.
EnumSchemaAttributeSchemaType:
type: string
enum: [ CORE, STANDARD, CUSTOM ]
description: A string that specifies the schema type of the attribute. It may be one of CORE, STANDARD or CUSTOM. Core and standard attributes are present out-of-the-box. Core attributes may not be updated or deleted. Standard attributes may not be deleted, but their mutable properties may be updated. Custom attributes may be deleted, and their mutable properties may be updated. New attributes are created with a schema type of CUSTOM.
EnumSchemaAttributeType:
type: string
enum: [ STRING, JSON, BOOLEAN, COMPLEX ]
description: A string that specifies the the type of the attribute. It may be one of STRING, JSON, BOOLEAN, or COMPLEX. If the type is not provided during creation, then it defaults to STRING. Complex and boolean attributes may not be created, but standard attributes of those types may be updated. JSON attributes are limited by size (total size must not exceed 16KB).
default: STRING
EnumSignOnPolicyExtraVerification:
type: string
enum: [disabled, permissive, restrictive]
default: disabled
description: |
Specifies the level of further verification when deviceAuthorization is enabled. The PingOne platform performs an extra verification check by sending a silent push notification to the customer native application, and receives a confirmation in return. `extraVerification` can be one of the following levels:
`disabled` (default): The PingOne platform does not perform the extra verification check.
`permissive`: The PingOne platform performs the extra verification check. Upon timeout or failure to get a response from the native app, the MFA step is treated as successfully completed.
`restrictive`: The PingOne platform performs the extra verification check.The PingOne platform performs the extra verification check. Upon timeout or failure to get a response from the native app, the MFA step is treated as failed.
EnumSignOnPolicyNoDeviceMode:
type: string
enum: [BYPASS, BLOCK]
description: A string that specifies the device mode for the MFA flow. Options are `BYPASS` to allow MFA without a specified device, or `BLOCK` to block the MFA flow if no device is specified. To use this configuration option, the authorize request must include a signed `login_hint_token` property. For more information, see Authorize (Browserless and MFA Only Flows)
EnumSignOnPolicyType:
type: string
description: A string that specifies the type of action. Options are `LOGIN`, `MULTI_FACTOR_AUTHENTICATION`, `IDENTIFIER_FIRST`, `IDENTITY_PROVIDER` `AGREEMENT` and `PROGRESSIVE_PROFILING`. Workforce environments also include `PINGID_WINLOGIN_PASSWORDLESS_AUTHENTICATION` and `PINGID_AUTHENTICATION`
enum: [LOGIN, MULTI_FACTOR_AUTHENTICATION, IDENTIFIER_FIRST, IDENTITY_PROVIDER, PROGRESSIVE_PROFILING, AGREEMENT, PINGID_WINLOGIN_PASSWORDLESS_AUTHENTICATION, PINGID_AUTHENTICATION]
EnumSignOnPolicyActionLoginNewUserProvisioningGatewayType:
type: string
enum: [LDAP]
description: A string identifying the type of gateway. Currently, only `LDAP` is supported.
EnumSolutionType:
type: string
enum: [WORKFORCE, CUSTOMER]
description: The solution set of the environment
EnumSubscriptionFilterIncludedTags:
type: string
enum: [adminIdentityEvent]
description: A tags that events must have to be monitored by a subscription. Currently, the available tags are `adminIdentityEvent`. Identifies the event as the action of an administrator on other administrators.
EnumSubscriptionFormat:
type: string
enum: [ACTIVITY, SPLUNK, NEWRELIC]
description: A string that specifies one of the supported subscription formats. Options are ACTIVITY, SPLUNK, and NEWRELIC. This is a required property.
EnumTemplateContentDeliveryMethod:
type: string
enum: [Email, SMS, Voice, Push]
description: The content's delivery method. Possible values are `Email`, `SMS`, `Voice` or `Push`. Cannot be changed after it is initially set in `POST /environments/{{envID}}/templates/{{templateName}}/contents`.
EnumTemplateContentPushCategory:
type: string
enum: [BANNER_BUTTONS, WITHOUT_BANNER_BUTTONS, APPROVE_AND_OPEN_APP]
description: |
For Push content, you can specify what type of banner should be displayed to the user. The available options are:
* `BANNER_BUTTONS` - the banner contains both Approve and Deny buttons
* `WITHOUT_BANNER_BUTTONS` - when the user clicks the banner, they are taken to an application that contains the necessary approval controls.
* `APPROVE_AND_OPEN_APP` - when the Approve button is clicked, authentication is completed and the user is taken to the relevant application.
If this parameter is not provided, the default is `BANNER_BUTTONS`. Note that to use the non-default push banners, you must implement them in your application code, using the PingOne SDK. For details, see the [README for iOS](https://github.com/pingidentity/pingone-mobile-sdk-ios/#171-push-notifications-categories) and the [README for Android](https://github.com/pingidentity/pingone-mobile-sdk-android).
default: BANNER_BUTTONS
EnumTemplateName:
type: string
enum: [credential_issued,credential_revoked,credential_updated,credential_verification, device_pairing,digital_wallet_pairing,email_verification_admin,email_verification_user,email_phone_verification,general,id_verification,new_device_paired,recovery_code_template, strong_authentication, transaction, verification_code_template]
description: The name of the template
EnumTrustedEmailStatus:
type: string
enum: [ACTIVE, VERIFICATION_REQUIRED]
description: A string that specifies the status of the trusted email address.
readOnly: true
EnumEnabledStatus:
type: string
enum: [ENABLED, DISABLED]
description: A string that specifies whether device integrity detection takes place on mobile devices, for the application's enrollment and authentication events ENABLED, DISABLED
EnumDurationUnitMinsHours:
type: string
enum: [MINUTES, HOURS]
EnumUpdateStatus:
type: string
description: >-
An enumeration that specifies one of the following values:
AT_LATEST: The gateway instance's version is at or after the supported version marked latest.
UPGRADE_AVAILABLE: The gateway instance's version is at the supported version that is marked recommended but there is a later supported version marked recommended.
UPGRADE_RECOMMENDED: The gateway instance's version is at a known version but the version is not marked as recommended or latest. The version has greater than 30 days support.
UPGRADE_REQUIRED: The gateway instance's version is at a known version but the version is not marked as recommended or latest. The version has support ending within the next month.
NOT_SUPPORTED: The gateway instance's version is not known or supported.
enum: [AT_LATEST, UPGRADE_AVAILABLE, UPGRADE_RECOMMENDED, UPGRADE_REQUIRED, NOT_SUPPORTED]
EnumUserLifecycleStatus:
type: string
enum: [ACCOUNT_OK, VERIFICATION_REQUIRED]
description: A string that specifies information about the account lifecycle. Options for status are `ACCOUNT_OK` and `VERIFICATION_REQUIRED`. This property value is only allowed to be set when importing a user to set the initial account status. If the initial status is set to `VERIFICATION_REQUIRED` and an email address is provided, a verification email is sent.
EnumUserAccountContentTypeHeader:
type: string
enum: [application/vnd.pingidentity.account.unlock+json, application/vnd.pingidentity.account.lock+json]
EnumGroupMembershipType:
type: string
enum: [DIRECT, INDIRECT]
description: A string that defines the relationship of group membership
EnumUserGroupAssignmentExpandParameter:
type: string
enum: [group]
description: When this parameter is appended to the request, the results are expanded to include additional information about each group.
EnumUserRequestInclude:
type: string
enum: [memberOfGroupIDs, memberOfGroupNames]
EnumUserStatus:
type: string
enum: [LOCKED, OK]
description: A string that specifies the account locked state.
EnumUserVerifyStatus:
type: string
enum: [NOT_INITIATED, ENABLED, DISABLED]
description: Indicates whether ID verification can be done for the user. This value can be NOT_INITIATED (the initial value), ENABLED, or DISABLED. If the user verification status is DISABLED, a new verification status cannot be created for that user until the status is changed to ENABLED.
Agreement:
type: object
properties:
'_links':
$ref: '#/components/schemas/LinksHATEOAS'
consentsAggregatedAt:
type: string
format: date-time
description: The time the consent count metric was last updated. This value is typically updated once every 24 hours.
readOnly: true
description:
type: string
description: A string that specifies the description of the agreement.
enabled:
type: boolean
description: A boolean that specifies the current enabled state of the agreement. This is a required property. The agreement must support the default language to be enabled. It cannot be disabled if it is referenced by a sign-on action. When an agreement is disabled, it is not used anywhere it is configured across PingOne.
environment:
$ref: '#/components/schemas/ObjectEnvironment'
totalExpiredConsents:
type: integer
description: An integer that identifies the number of users who have consented to the agreement, but their consent has expired. This value is last calculated at the consentCountsUpdatedAt time.
readOnly: true
id:
type: string
description: A string that specifies the agreement ID.
readOnly: true
name:
type: string
description: A string that specifies the name of the agreement resource. This is a required property.
reconsentPeriodDays:
type: number
format: float
description: A number that represents the number of days until a consent to this agreement expires.
totalConsents:
type: integer
description: An integer that identifies the total number of users who have consented to the agreement. This value is last calculated at the consentCountsUpdatedAt time.
readOnly: true
required:
- enabled
- name
AgreementLanguage:
type: object
properties:
'_links':
$ref: '#/components/schemas/LinksHATEOAS'
agreement:
type: object
properties:
id:
type: string
description: A read-only string of the ID for the agreement resource for this revision.
readOnly: true
currentRevision:
type: object
properties:
id:
type: string
description: A relationship that specifies the current revision associated with this language resource. The current revision is the one shown to users for new consents in the language.
readOnly: true
displayName:
type: string
description: A string that is used as the title of the agreement for the language presented to the user. This is a required property.
enabled:
type: boolean
description: A boolean that maps directly with a language being enabled or displayed for the environment within the platform. This is a required property.
id:
type: string
description: A string that specifies the language ID.
readOnly: true
locale:
type: string
description: A string that specifies the tag for identifying the language resource associated with this agreement consent (for example, en-US). This is a required property. For more information about language tags, see Tags for Identifying Languages.
userExperience:
type: object
properties:
acceptCheckboxText:
type: string
description: A string that specifies the text next to the "accept" checkbox in the end user interface. Accepted character are unicode letters, combining marks, numeric characters, whitespace, and punctuation characters (regex `^[\p{L}\p{M}\p{N}\p{Zs}\p{P}]+$`).
pattern: '^[\p{L}\p{M}\p{N}\p{Zs}\p{P}]+$'
continueButtonText:
type: string
description: A string that specifies the text of the "continue" button in the end user interface. Accepted character are unicode letters, combining marks, numeric characters, whitespace, and punctuation characters (regex `^[\p{L}\p{M}\p{N}\p{Zs}\p{P}]+$`).
pattern: '^[\p{L}\p{M}\p{N}\p{Zs}\p{P}]+$'
declineButtonText:
type: string
description: A string that specifies the text of the "decline" button in the end user interface. Accepted character are unicode letters, combining marks, numeric characters, whitespace, and punctuation characters (regex `^[\p{L}\p{M}\p{N}\p{Zs}\p{P}]+$`).
pattern: '^[\p{L}\p{M}\p{N}\p{Zs}\p{P}]+$'
required:
- displayName
- enabled
- locale
AgreementLanguageRevision:
type: object
properties:
'_links':
$ref: '#/components/schemas/LinksHATEOAS'
agreement:
type: object
properties:
id:
type: string
description: A read-only string of the ID for the agreement resource for this revision.
readOnly: true
contentType:
$ref: '#/components/schemas/EnumAgreementRevisionContentType'
effectiveAt:
type: string
format: date-time
description: A date that specifies the start date that the revision is presented to users. This property value can be modified only if the current value is a date that has not already passed. The effective date must be unique for each language agreement, and the property value can be the present date or a future date only.
id:
type: string
description: A read-only string that specifies the revision ID.
readOnly: true
language:
type: object
properties:
id:
type: string
description: A relationship that specifies the language resource associated with this revision.
readOnly: true
notValidAfter:
type: string
format: date-time
description: A date that specifies whether the revision is still valid in the context of all revisions for a language. This property is calculated dynamically at read time, taking into consideration the agreement language, the language enabled property, and the agreement enabled property. When a new revision is added, the notValidAfter property values for all other previous revisions might be impacted. For example, if a new revision becomes effective and it forces reconsent, then all older revisions are no longer valid.
readOnly: true
requireReconsent:
type: boolean
description: A boolean that specifies whether the user is required to provide consent to the language revision after it becomes effective.
text:
type: string
description: An immutable string that specifies text or HTML for the revision. This attribute is supported in POST requests only. For more information, see contentType.
required:
- contentType
- effectiveAt
- requireReconsent
- text
AlertChannel:
type: object
properties:
'_links':
$ref: '#/components/schemas/LinksHATEOAS'
id:
type: string
description: Unique ID of the alert channel.
readOnly: true
environment:
$ref: '#/components/schemas/ObjectEnvironment'
channelType:
$ref: '#/components/schemas/EnumAlertChannelType'
addresses:
type: array
description: The email addresses to send the alert to.
items:
type: string
format: email
includeSeverities:
type: array
description: Filters alerts by severity. If empty, all severities are included. Possible values are `INFO`, `WARNING`, and `ERROR``.
items:
$ref: '#/components/schemas/EnumAlertChannelSeverity'
includeAlertTypes:
type: array
description: Filters alerts by alert type. If empty, all alert types are included. Possible values are CERTIFICATE_EXPIRED, CERTIFICATE_EXPIRING, KEY_PAIR_EXPIRED, GATEWAY_VERSION_DEPRECATED, KEY_PAIR_EXPIRING, and GATEWAY_VERSION_DEPRECATING.
items:
$ref: '#/components/schemas/EnumAlertChannelAlertType'
excludeAlertTypes:
type: array
description: Administrators will not be emailed alerts of these types. If empty, no alert types are excluded. Possible values are CERTIFICATE_EXPIRED, CERTIFICATE_EXPIRING, KEY_PAIR_EXPIRED, GATEWAY_VERSION_DEPRECATED, KEY_PAIR_EXPIRING, and GATEWAY_VERSION_DEPRECATING.
items:
$ref: '#/components/schemas/EnumAlertChannelAlertType'
required:
- channelType
- addresses
Application:
type: object
properties:
'_links':
$ref: '#/components/schemas/LinksHATEOAS'
accessControl:
type: object
properties:
role:
type: object
properties:
type:
$ref: '#/components/schemas/EnumApplicationAccessControlType'
required:
- type
group:
type: object
properties:
type:
$ref: '#/components/schemas/EnumApplicationAccessControlGroupType'
groups:
type: array
description: A set that specifies the group IDs for the groups the actor must belong to for access to the application.
items:
type: object
properties:
id:
type: string
required:
- id
required:
- type
- groups
createdAt:
type: string
format: date-time
readOnly: true
description: The time the resource was created.
description:
type: string
description: A string that specifies the description of the application.
enabled:
type: boolean
description: A string that specifies the current enabled state of the application. Options are ENABLED or DISABLED.
environment:
$ref: '#/components/schemas/ObjectEnvironment'
hiddenFromAppPortal:
type: boolean
description: A boolean to specify whether the application is hidden in the application portal despite the configured group access policy.
icon:
type: object
description: The HREF and the ID for the application icon.
properties:
id:
type: string
href:
type: string
required:
- id
- href
id:
type: string
readOnly: true
description: A string that specifies the application ID.
loginPageUrl:
type: string
description: A string that specifies the custom login page URL for the application. If you set the loginPageUrl property for applications in an environment that sets a custom domain, the URL should include the top-level domain and at least one additional domain level. Warning To avoid issues with third-party cookies in some browsers, a custom domain must be used, giving your PingOne environment the same parent domain as your authentication application. For more information about custom domains, see Custom domains.
name:
type: string
description: A string that specifies the name of the application. This is a required property.
protocol:
$ref: '#/components/schemas/EnumApplicationProtocol'
type:
$ref: '#/components/schemas/EnumApplicationType'
updatedAt:
type: string
format: date-time
readOnly: true
description: The time the resource was last updated.
required:
- enabled
- name
- type
- protocol
ApplicationCorsSettings:
type: object
description: Allows customization of how the Authorization and Authentication APIs interact with CORS requests that reference the application. If omitted, the application allows CORS requests from any origin except for operations that expose sensitive information (e.g. `/as/authorize` and `/as/token`). This is legacy behavior, and it is recommended that applications migrate to include specific `corsSettings`.
properties:
behavior:
$ref: '#/components/schemas/EnumApplicationCorsSettingsBehavior'
origins:
type: array
description: Must be non-empty when `corsSettings.behavior` is `ALLOW_SPECIFIC_ORIGINS` and must be omitted or empty when `corsSettings.behavior` is `ALLOW_NO_ORIGINS`. Limited to 20 values. Values are the origins from which CORS requests to the Authorization and Authentication APIs are allowed. Each value is an `http` or `https` URL without a path. The host may be a domain name (including `localhost`), or an IPv4 address. Subdomains may use the wildcard (*) to match any string.
maxItems: 20
items:
type: string
required:
- behavior
ApplicationExternalLink:
allOf:
- $ref: '#/components/schemas/Application'
- type: object
properties:
homePageUrl:
type: string
description: A string that specifies the custom home page URL for the application.
required:
- homePageUrl
ApplicationSAML:
allOf:
- $ref: '#/components/schemas/Application'
- type: object
properties:
homePageUrl:
type: string
description: A string that specifies the custom home page URL for the application.
acsUrls:
type: array
description: A string that specifies the Assertion Consumer Service URLs. The first URL in the list is used as default (there must be at least one URL). This is a required property.
items:
type: string
assertionDuration:
type: integer
description: An integer that specifies the assertion validity duration in seconds. This is a required property.
assertionSigned:
type: boolean
description: A boolean that specifies whether the SAML assertion itself should be signed. The default value is `true`.
default: true
corsSettings:
$ref: '#/components/schemas/ApplicationCorsSettings'
defaultTargetUrl:
type: string
description: This is used as the RelayState parameter by the IdP to deep link into the application after authentication. This value can be overridden by the applicationUrl query parameter for GET Identity Provider Initiated SSO. Although both of these parameters are generally URLs, because they are used as deep links, this is not enforced. If neither defaultTargetUrl nor applicationUrl is specified during a SAML authentication flow, no RelayState value is supplied to the application. The defaultTargetUrl (or the applicationUrl) value is passed to the SAML application's ACS URL as a separate RelayState key value (not within the SAMLResponse key value).
enableRequestedAuthnContext:
type: boolean
description: Indicates whether `requestedAuthnContext` is taken into account in policy decision-making during authentication.
idpSigning:
type: object
properties:
key:
type: object
properties:
id:
type: string
description: A string that specifies the certificate to be used by the identity provider to sign assertions and responses. If this property is omitted, the default signing certificate for the environment is used.
required:
- id
algorithm:
$ref: '#/components/schemas/EnumCertificateKeySignagureAlgorithm'
required:
- key
nameIdFormat:
type: string
description: A string that specifies the format of the Subject NameID attibute in the SAML assertion
responseSigned:
type: boolean
description: A boolean that specifies whether the SAML assertion response itself should be signed. The default value is `false`.
default: false
sloBinding:
$ref: '#/components/schemas/EnumApplicationSAMLSloBinding'
sloEndpoint:
type: string
description: A string that specifies the logout endpoint URL. This is an optional property. However, if a sloEndpoint logout endpoint URL is not defined, logout actions result in an error.
sloResponseEndpoint: