Identity Cloud REST API index

Get an authorization code
/access/getAuthorizationCode

Returns an authorization code you can exchange for an access token and a refresh token. Note that this operation can't be used to obtain Hosted Login access and refresh tokens.

Get an access token
/access/getAccessToken

Retrieves an Identity Cloud access token. Note that this access token can’t be used to obtain Hosted Login access tokens.

Exchange an authorization code
/oauth/token

Returns an Identity Cloud access token for an authenticated user. You need to exchange either an authorization code or a refresh token in order to get an access token. An authorization code is generated when a user is authenticated by using the JavaScript SDK or the Authentication API.

Note that the authorization code and refresh tokens used with this operation can’t be exchanged for a Hosted Login access token.

See also:
• Exchange an authorization code

Complete social registration
/oauth/register_native

Completes social registration. With social registration, a user creates an Identity Cloud account by using credentials and profile information derived from a social login identity provider such as Facebook or Twitter.

See JavaScript SDK registration overview for a comparison of social logins and registrations and traditional logins and registrations.

See also:
• Complete social login and registration

Complete traditional registration
/oauth/register_native_traditional

Completes a traditional registration. After registration completes, a user can authenticate on your website by using an email address and password.

See JavaScript SDK registration overview for a comparison of social logins and registrations and traditional logins and registrations.

See also:
• Complete traditional login and registration

Complete social login
/oauth/auth_native

Completes social login, a login carried out by first authenticating with a social login identity provider (IdP) and then using the IdP's credentials to log in to Identity Cloud.

See JavaScript SDK registration overview for a comparison of social logins and registrations and traditional logins and registrations.

See also:
• Complete social login and registration

Complete traditional login
/oauth/auth_native_traditional

Completes a traditional login, a process involving an email address and password.

See JavaScript SDK registration overview for a comparison of social logins and registrations and traditional logins and registrations.

See also:
• Complete traditional login and registration

Update a user profile
/oauth/update_profile_native

Updates a user profile based on input from a user. To make this call, you must have a valid Registration access token for the user profile to be updated.

See also:
• Update a user profile

Get a verification code
/access/getVerificationCode

Returns a verification code for setting an attribute to the current date and time. This is useful for such tasks as recording the date and time when an email address is verified.

Set a timestamp
/access/use_verification_code

Uses a one-time verification code to set a field value to the current date and time. For example, setting the emailVerified attribute to a timestamp indicates that the associated email address has been verified.

Send a password reset link
/oauth/forgot_password_native

Sends an email that includes a link for resetting a password. Clicking the link (which includes a one-time pass code) takes the user to a screen where they can reset their password.

See also:
• Reset a password

Verify an email address
/oauth/verifyemail native

Sends an email that includes a one-use verification link a user can click to complete the email verification process. The destination URL for this link is configured in the verify_email_url setting of the API client used to make the API call.

Link a social identity to a user account
/oauth/link_account_native

Links a new social identity provider (IdP) to an existing user account. After a provider is linked, you can use that IdP to log on to your Identity Cloud account. Note that social logins can be used in addition to or instead of traditional Identity Cloud logins. In a traditional login, the user logs in by supplying an email address and password.

See also:
• Link or unlink accounts

Unlink a social identity from a user account
/oauth/unlink_account_native

Unlinks a social provider from a user account. Once unlinked, the social provider can't be used to sign into that user account. To make this call, you must have a valid Registration access token for the user record being updated.

See also:
• Link or unlink accounts

Get all API clients
/config/{app_id}/clients

Returns information about the API clients associated with an application. API clients are primarily used to control access to the Identity Cloud APIs and to help define the user login and registration experience.

Get an API client
/config/{app_id}/clients/{client_id}

Returns information about a specific API client.

Modify an API client
/config/{app_id}/clients/{client_id}

Modifies permissions and settings for an API client.

Reset an API client secret
/config/{app_id}/clients/{client_id}/secret

Resets the client secret for an API client. For example, you might reset the secret if you believe that secret has been exposed to unauthorized users or if someone who had access to the secret has left your organization.

It's recommended that you contact your Akamai representative before resetting the client secret for an owner client.

Create an API client
/config/{app_id}/clients

Creates an API client.

Delete an API client
/config/{app_id}/clients/{client_id}

Deletes an existing API client. You can't delete an API client assigned the owner feature.

Get all application and client settings
/config/{app_id}/settings

Returns settings and values for the specified API client. This operation returns both the application settings and the settings applied specifically to the API client. Your operation must have owner permissions in order to return the global settings.

Get all the standard application settings
/config/{app_id}/settings/options

Returns information about Identity Cloud's predefined application and client settings. Custom settings that you’ve added yourself aren’t returned by this operation.

Modify application settings
/config/{app_id}/settings

Modifies the global settings for an application.

Get API client settings
/config/{app_id}/clients/{client_id}/settings

Returns the settings associated with a specific API client. In the API response, client settings, global settings, and custom settings are returned as separate JSON objects.

Modify API client settings
/config/{app_id}/clients/{client_id}/settings

Modifies the client settings associated with a specific API client.

Get all entity types
/config/{app_id}/entityTypes

Returns information about the entity types associated with an application. Entity types are databases that store user profile information.

Get an entity type
/config/{app_id}/entityTypes/{entity_type}

Returns information about the specified entity type.

Get the attributes in an entity type
/config/{app_id}/entityTypes/{entity_type}/attributes

Returns detailed information about each attribute in an entity type, including the attribute name and datatype. Attributes (roughly equivalent to database fields) represent individual bits of user information such as a user’s first name or a user’s email address.

Get an entity type attribute
/config/{app_id}/entityTypes/{entity_type}/attributes/{attribute_name}

Returns detailed information about the specified attribute, including the attribute name and data type.

Get all flows
/config/{app_id}/flows

Returns the flows associated with an application. Flows are JSON files that, among other things, help determine the look and feel of the user experience.

Get a flow
/config/{app_id}/flows/{flow}

Returns information about the specified flow.

Get all the versions of a flow
/config/{app_id}/flows/{flow}/versions

Returns a list of available versions for a flow. Each time you make and save a change to a flow (for example, adding a new field or deleting an existing translation) a new flow version is created.

Get a specific flow version
/config/{app_id}/flows/{flow}/versions/{version}

Returns the specified version of a flow.

Modify a flow
/config/{app_id}/flows/{flow}

Updates or replaces the userData object or the entity type schemas object assigned to the flow. The userData object lists the schema attributes to be stored in the janrainCaptureProfileData object in local storage following a successful authentication. The schemas object contains the name of your user profile databases.

Copy a flow
/config/{app_id}/flows/{flow}/copy

Creates a new flow by copying an existing flow. This operation can't be used to overwrite an existing flow, it can only be used to create a brand-new flow.

Promote a flow
/config/{app_id}/flows/{flow}/promote

Promotes a flow to another application. Promoting a flow simply means copying that flow from one application (such as your development environment) to another application (such as your production environment).

Restore a flow
/config/{app_id}/flows/{flow}/versions/{version}

Restores a flow to a previous version of that flow. When you restore a flow, the selected version becomes the current (HEAD) version of the flow.

Get all the fields in a flow
/config/{app_id}/flows/{flow}/fields

Returns a list of fields defined in the flow. Fields provide a link between onscreen form elements and their underlying user profile attributes. For example, onscreen a user might enter their first name in a field labeled First Name. In turn, the value entered in that field will be written to the givenName attribute in the user’s user profile.

Get a field
/config/{app_id}/flows/{flow}/fields/{field}

Returns information about a field.

Modify a field
/config/{app_id}/flows/{flow}/fields/{field}

Updates a field.

Create a field
/config/{app_id}/flows/{flow}/fields

Creates a new field and adds that field to a flow.

See also:
• Create a field and add it to a Hosted Login form
• Manage custom fields
• Field reference

Remove a field
/config/{app_id}/flows/{flow}/fields/{field}

Removes a field from the flow. This operation also removes the field from any forms that reference the field.

Get all the forms in a flow
/config/{app_id}/flows/{flow}/forms

Returns a list of forms in the flow. Forms serve as a container for fields. For example, the traditionalRegistrationForm form contains fields for all the information (name, email address, password, phone number, etc.) you want to collect from a user when creating their user account.

Get a form
/config/{app_id}/flows/{flow}/forms/{form}

Returns detailed information about the specified form.

Modify a form
/config/{app_id}/flows/{flow}/forms/{form}

Updates or replaces the list of fields and features in the form. Any fields added to the form must already exist in the flow.

See also:
• Add a field to a Hosted Login form

Create a form
/config/{app_id}/flows/{flow}/forms

Creates a form.

Delete a form
/config/{app_id}/flows/{flow}/forms/{form}

Deletes the specified form, but without deleting the fields associated with the form.

Get all the email templates in a flow
/config/{app_id}/flows/{flow}/locales/{locale}/mailTemplates

Returns a list of all the transaction email templates in the specified locale. Transactional emails are emails automatically sent by Identity Cloud in response to specific user activities. For example, after a user creates an account an email is sent asking the user to verify their email address.

Get an email template
/config/{app_id}/flows/{flow}/locales/{locale}/mailTemplates/{template}

Returns information about the specified email template.

Modify an email template
/config/{app_id}/flows/{flow}/locales/{locale}/mailTemplates/{template}

Modifies an email template. Note that, while you can modify your email templates, you can’t delete those templates nor can you create new templates.

See also:
• Modify transactional emails

Get the body of an email template
/config/{app_id}/flows/{flow}/locales/{locale}/mailTemplates/{template}/body

Returns the body for an email template.

Modify the body of an email template
/config/{app_id}/flows/{flow}/locales/{locale}/mailTemplates/{template}/body

Returns the body for an email template.

Get the subject of an email template
/config/{app_id}/flows/{flow}/locales/{locale}/mailTemplates/{template}/subject

Returns the subject line for an email template.

Modify the subject of an email template
/config/{app_id}/flows/{flow}/locales/{locale}/mailTemplates/{template}/subject

Updates the subject line for an email template.

Get all available Hosted Login upgrades
/config/{app_id}/flows/{flow}/upgrades

Returns the version numbers of Hosted Login you can upgrade to.

Get Hosted Login upgrade requirements
/config/{app_id}/flows/{flow}/upgrades/{upgradeId}

Returns information about the fields, translations, and screens that need to be added to or removed from a flow to make that flow compatible with the specified version of Hosted Login.

Upgrade Hosted Login
/config/{app_id}/flows/{flow}/upgrades/{upgradeId}

Adds the fields, translations, and screens required to help ensure that a flow is compatible with the specified version of Hosted Login.

Get all the Hosted Login links in a flow
/config/{app_id}/flows/{flow}/links

Returns a collection of all the Hosted Login links defined within the specified flow. These links appear on Hosted Login screens and direct your users to locations such as your help center or privacy policy.

Get a Hosted Login link
/config/{app_id}/flows/{flow}/links/{linkId}

Returns detailed information about a Hosted Login link.

Modify a Hosted Login link
/config/{app_id}/flows/{flow}/links/{linkId}

Updates a Hosted Login link.

See also:
• Change the target of a Hosted Login link

Create a Hosted Login link
/config/{app_id}/flows/{flow}/links

Creates a new Hosted Login link .

See also:
• Create a Hosted Login link

Delete a Hosted Login link
/config/{app_id}/flows/{flow}/links/{linkId}

Deletes the specified Hosted Login link.

Get all the 2FA messages in a flow
/config/{app_id}/flows/{flow}/locales/{locale}/2faMessages

Returns information about the two-factor authentication (2FA) messages included in a flow.

See also:
• View 2FA messages

Get a 2FA message
/config/{app_id}/flows/{flow}/locales/{locale}/2faMessages/{messageId}

Returns the specified two-factor authentication (2FA) message. Note that each 2FA message actually consists of: 1) an SMS message; 2) a plain-text email message; and 3) an HTML-formatted email message.

See also:
• View 2FA messages

Add the default 2FA messages to a flow
/config/{app_id}/flows/{flow}/locales/{locale}/2faMessages

Adds the default collection of two-factor authentication (2FA) messages to the specified flow.

See also:
• Add 2FA messages to a flow

Modify a 2FA message
/config/{app_id}/flows/{flow}/locales/{locale}/2faMessages/{messageId}

Modifies the specified two-factor authentication (2FA) message.

See also:
• Modify a 2FA message

Get all the locales in a flow
/config/{app_id}/flows/{flow}/locales/{locale}

Returns a list of all the locales associated with a flow. Each locale represents a specific language, region, and collection of locale variant preferences. Having different locales enable you to better personalize the user login and registration experience.

Get all the localized fields in a flow

/config/{app_id}/flows/{flow}/locales/{locale}/fields

Returns a list of fields defined for the specified locale.

Create a localized field
/config/{app_id}/flows/{flow}/locales/{locale}/fields

Adds a field to the specified locale.

Get a localized field
/config/{app_id}/flows/{flow}/locales/{locale}/fields/{field}

Returns information about a localized field.

Modify a localized field
/config/{app_id}/flows/{flow}/locales/{locale}/fields/{field}

Updates a localized field.

Get all the strings in a flow
/config/{app_id}/flows/{flow}/strings

Returns the strings defined in the flow. Strings are text elements that aren’t tied to a specific form.

Get a string
/config/{app_id}/flows/{flow}/strings/{string}

Returns information about the specified string.

Create a string
/config/{app_id}/flows/{flow}/strings

Adds a string to the flow.

Modify a string
/config/{app_id}/flows/{flow}/strings/{string}

Updates or replaces a string.

Delete a string
/config/{app_id}/flows/{flow}/strings/{string}

Removes a string from a flow.

Get all the localized strings in a flow
/config/{app_id}/flows/{flow}/locales/{locale}/strings

Returns a list of all the localized strings defined in a flow.

Get a localized string
/config/{app_id}/flows/{flow}/locales/{locale}/strings/{string}

Returns information about the localized string.

Create a localized string
/config/{app_id}/flows/{flow}/locales/{locale}/strings

Adds a localized string to a flow.

Modify a localized string
/config/{app_id}/flows/{flow}/locales/{locale}/strings/{string}

Updates or replaces a localized string in the flow.

Delete a localized string
/config/{app_id}/flows/{flow}/locales/{locale}/strings/{string}

Removes a localized string from a flow.

Get all the screens in a flow
/config/{app_id}/flows/{flow}/screens

Returns the screens associated with a flow.

Get a screen
/config/{app_id}/flows/{flow}/screens/{screen}

Returns information about a specific screen.

Modify a screen
/config/{app_id}/flows/{flow}/screens/{screen}

Updates property values for the specified screen.

Create a screen
/config/{app_id}/flows/{flow}/screens

Creates a new screen. New screens are primarily designed for use with the JavaScript SDK.

Delete a screen
/config/{app_id}/flows/{flow}/screens/{screen}

Deletes the specified screen. Be forewarned that it’s possible (although not recommended) to delete the default screens that ship with Hosted Login and the JavaScript SDK.

Get all the translations in a flow
/config/{app_id}/flows/{flow}/translations

Returns all the translations in a flow.

Get a translation
/config/{app_id}/flows/{flow}/translations/{key}

Returns all the translations for the specified translation key (i.e., all the translated values of a word or phrase).

Create a translation
/config/{app_id}/flows/{flow}/translations

Creates a translation for the specified locale. You’re on your own to provide the correctly translated value.

Delete a translation
/config/{app_id}/flows/{flow}/translations/{key}

Deletes a translation.

Modify a translation

/config/{app_id}/flows/{flow}/translations

Updates an existing translation.

See also:
• Modify screen text
• Localize screen text

Get all social login applications
/{customerId}/v2/config/low/services/engage-v2/apps

Returns information about your social login applications. You need a social login application to configure social login for Hosted Login and to create custom providers.

Get a social login application

/{customerId}/v2/config/low/services/engage-v2/apps/{appId}

Returns detailed information about a specific social login application.

Get all the custom providers in an application

/{customerId}/v2/config/low/services/engage-v2/apps/{appId}/custom-providers

Returns information about your custom providers. Custom providers are social login identity providers (IdPs) that weren't predefined by Akamai. Most IdPs that support OAuth 2.0, OpenID Connect, or SAML2 can be configured as custom providers.

Get a custom provider

/{customerId}/v2/config/low/services/engage-v2/apps/{appId}/custom-providers/{providerId}

Returns detailed information about the specified custom provider.

Modify a custom provider

/{customerId}/v2/config/low/services/engage-v2/apps/{appId}/custom-providers/{providerId}

Modifies a custom provider.

Create a custom provider

/{customerId}/v2/config/low/services/engage-v2/apps/{appId}/custom-providers

Creates a custom provider. The social login identity provider being used as a custom provider needs to support OAuth 2.0, OpenID Connect, or SAML2.

See also:
• Create a custom provider

Get a user profile
/entity

Returns the specified user profile. By default, this endpoint returns all the attributes associated with the user profile. However, it’s also possible to return a specified subset of attributes.

Search for user profiles
/entity.find

Searches an entity type for users meeting the specified criteria. For example, you might search for all the users who have not logged on since a specified date, or for all the users whose accounts were created after that date.

Count user profiles
/entity.count

Returns the number of user profiles in an entity type that meet the specified criteria. For example, you might return the number of users who live in France or the number of users who work for Akamai.

Modify a user profile
/entity.update

Updates a user profile. Note that this operation only modifies attributes specified in the request. Any attributes not included in the request are left exactly as-is.

Replace a user profile
/entity.replace

Replaces all the attribute values in a user profile with a new set of attribute values. By default, any attributes not included in your operation are replaced with null values.

Create a user profile
/entity.create

Creates a user profile. Note that, because of database replication requirements, it might take a few minutes for the new user profile to be available to other operations.

Create multiple user profiles
/entity.bulkCreate

Creates multiple user profiles with a single operation. Note that your request body can't be larger than 5 MB. If you encounter a client intended to send too large body error you must reduce the size of the request body. For example, you might divide the list of accounts to be created in half, then use two API calls instead of one.

See also:
• Query or import large data sets

Delete a user profile
/entity.delete

Deletes the specified user profile. Alternatively, you can use this endpoint to delete a child attribute of a plural attribute. In that case, only the child attribute is deleted and the rest of the user profile remains as-is.

Invalidate user access tokens
/entity.deleteAccess

Removes all existing access grants issued to the user, including all the access tokens, refresh tokens, and refresh secrets.

Get all entity types
/entityType.list

Returns information about your entity types. An entity type is a user profile data store.

Get an entity type
/entityType

Returns detailed information about the specified entity type.

Create an entity type
/entityType.create

Creates an entity type.

See also:
• Schema data types

Create an attribute
/entityType.addAttribute

Adds an attribute to an entity type. This operation also adds the new attribute to all existing user profiles.

Delete an attribute
}/entityType.removeAttribute

Removes an attribute from an entity type. Note that all the data associated with this attribute is deleted as well. That means that the attribute and its value are removed from each user profile in the entity type.

Get all validation rules
/entityType.rules

Returns all the data validation rules configured for the specified entity type. Identity Cloud uses these rules to validate attribute data with each user profile update.

Create a validation rule
/entityType.addRule

Creates a data validation rule for specified attributes in your schema.

Delete a validation rule
/entityType.removeRule

Removes the specified validation rule.

Assign constraints to an attribute
/entityType.setAttributeConstraints

Configures the list of constraints for an attribute. Constraints place restrictions on the type of data that can be stored in an attribute.

Modify password history settings
/entityType.setPasswordSettings

Manages the password history settings for an entity type. Password history tracks the last 1-10 passwords employed by a user, and prevents the user from setting their password to any of those prior values.

See also:
• Configure unique password enforcement

Get an access schema
/entityType.getAccessSchema

Retrieves the access schema for the specified API client. An access schema defines the subset of attributes to which a client has read or write access.

Note that access schemas only apply to API-based implementations of the Identity Cloud. If you're using a JavaScript SDK-based implementation of Identity Cloud then access to forms and fields is managed by the flow rather than by an access schema.

Create an access schema
/entityType.setAccessSchema

Creates an access schema for the specified API client. Each client can have one read access schema and one write access schema.

Note that access schemas only apply to API-based implementations of the Identity Cloud. If you're using a JavaScript SDK-based implementation of Identity Cloud then access to forms and fields is managed by the flow rather than by an access schema.

Delete an access schema
/entityType.deleteAccessSchema

Deletes the specified access schema for a client. Deleting an access schema gives a client read or write access to all attributes.

Note that access schemas only apply to API-based implementations of the Identity Cloud. If you're using a JavaScript SDK-based implementation of Identity Cloud then access to forms and fields is managed by the flow rather than by an access schema.

List all API clients
/clients/list

Returns a list of API clients, optionally filtered by client feature. API clients manage access to Identity Cloud APIs. Note that only the owner client can run this operation.

Modify API client features
/clients/set_features

Modifies the client features for an API client. Features define the permissions assigned to an API client.

See also:
• API clients and permissions

Reset an API client secret
/clients/reset_secret

Resets the client secret for the specified API client.

Rename an API client
/clients/set_description

Assigns a new name to an API client. Note that, for API clients, the client name and the client description refer to the same value.

Create an API client
/clients/add

Creates an API client.

Delete an API client
/clients/delete

Deletes an API client.

Modify an API client allowlist
/clients/set_whitelist

Modifies the IP allowlist for the specified API client. When used, the allowlist specifies the range of IP addresses that can use the client when calling Identity Cloud APIs. By default, IP allowlists are set to ["0.0.0.0"], allowing access to the client from any IP address.

Clear an API client allowlist
/clients/clear_whitelist

Clears the IP allowlist for the specified API client.

Get published application settings
/settings/widget/get

Returns a list of published settings files for the application. Published client settings do such things as support a configurable minimum age requirement for registration or track user acceptance of different terms of service and privacy policies.

With this operation at least three files are returned, including a JSON file for each settings version and both a JSON file and a JavaScript file pointing to the location where the most recent file versions are hosted. If no members are included, all the published settings files assigned to the application are be returned.

Get published client settings
/settings/widget/list

Returns the published settings for the specified API client and version. If the version member isn't included, the most recent version of the published settings is returned.

Publish application and API client settings
/settings/widget/publish

Publishes settings to a JSON file available for client-side use with the Registration user interface. This allows the settings to be loaded prior to any server-side operations.

Delete published settings
_/settings/widget/delete

Deletes the published settings for the specified API client and version. If the version member isn't included, all versions of the settings published for the API client are deleted.

Get an API client settings value
/settings/get_default

Returns the value associated with a settings key. If the key has no value at the client scope then the application scope value is returned instead. A null value is returned if the key has no application value either.

Get an application setting value
/settings/get

Returns the value of an application settings key.

Get multiple API client setting values
/settings/get_multi

Returns values for multiple keys. By design, values are returned for keys configured at the client scope. If a key doesn't exist at the client scope the value of the key as configured at the application scope is returned instead.

Delete an application settings key
/settings/delete_default

Deletes an application settings key.

Get all API client setting values
/settings/items

Returns all the settings for the specified API client, including all settings configured at the application scope. If a key is defined in both the client and application settings only the client-specific value is returned.

Get all API client setting keys
/settings/keys

Returns all the setting keys for a client, including those from the application-wide default settings.

Delete an API client setting
/settings/delete

Deletes a settings key from an API client.

Modify an API client setting
/settings/set

Assigns a setting and setting value to an API client. If the specified setting doesn't exist, it's created. If the setting does exists, then the current value of that setting is overwritten.

Modify an application setting
/settings/set_default

Creates or updates a setting in the application-wide default settings. If the setting doesn't exist, a new setting is created. If the setting does exist, the current value of that setting is overwritten.

Modify multiple application settings
/settings/set_default_multi

Creates or updates a setting in the application-wide default settings. If the setting doesn't exist, a new setting is created. If the setting does exist, the current value of that setting is overwritten.

Modify multiple API client settings
/settings/set_multi

Assigns multiple settings for the specified API client. If a setting doesn't, a new setting is created. If the setting does exist, the current value of that setting is overwritten.

Get an administrative access token
/{customerId}/login/token

Requests an administrative access token. An administrative access token is needed to call the other Hosted Login configuration endpoints.

Introspect an access or refresh token
/{customerId}/login/token/introspect

Returns the current state of a Hosted Login access or refresh token. If the token is active then additional claims associated with the token are also returned.

Revoke an access or refresh token
/{customerId}/login/token/revoke

Revokes a previously-issued access token or refresh token. After an access token has been revoked that token can't be used to access a protected resource. After a refresh token has been revoked that token can’t be used to request a new access token and the existing access token is also revoked.

Get your discovery document
/{customerId}/login/.well-known/openid-configuration

Returns the discovery document, a set of OpenID Connect values that can be retrieved by a client. These values enable OIDC clients to configure themselves.

See also:
• Discovery document

Get your JSON web keys
/{customerId}/login/jwk

Returns information about the JSON web keys (JWK) assigned to a customer. JSON web keys are public cryptographic keys used to verify the signatures on Hosted Login identity tokens.

See also:
• JSON web keys

Get userinfo Information
/{cusomerId}/profiles/oidc/userinfo

Returns user profile information from the userinfo endpoint.

Get all OpenID Connect clients
/{customerId}/config/clients

Returns information about all the OpenID Connect clients assigned to a customer.

Get an OpenID Connect client
/{customerId}/config/clients/{oidcClientId}

Returns information about an OpenID Connect client.

Modify an OpenID Connect client
/{customerId}/config/clients/{oidcClientId}

Modifies the specified OpenID Connect client.

Get an OpenID Connect client secret

/{customerId}/config/clients/{oidcClientId}/secret

Returns the client secret for the specified OIDC client. Note that this is the only way to return the secret for a confidential or configuration client.

Reset an OpenID Connect client secret
/config/clients/{oidcClientId}/secret

Resets the client secret for an OpenID Connect confidential client or configuration client. Resetting the secret enables you to rotate client secrets or to change a client secret you believe might have been compromised.

Create an OpenID Connect client
/{customerId}/config/clients

Creates an OpenID Connect client.

See also:
• Create an OIDC login client
• Create a Hosted Login configuration client

Delete an OpenID Conect client
/{customerId}/config/clients/{oidcClientId}

Deletes the specified OpenID Connect.

Get all login policies
/{customerId}/config/loginPolicies

Returns information about the login policies associated with the specified customer. Login policies help manage the user login experience by doing such things as specifying the exact path to the Capture domain and the user profile entity type, and defining the login URL for the directory.

See also:
• List login policies

Get a login policy
/{customerId}/config/loginPolicies/{loginPolicyId}

Returns information about the specified login policy. All OpenID Connect clients used for logins and registrations need to be assigned a login policy.

Modify a login policy
/{customerId}/config/loginPolicies/{loginPolicyId}

Returns information about the specified login policy. All OpenID Connect clients used for logins and registrations need to be assigned a login policy.

See also:
• Modify a login policy

Create a login policy
/{customerId}/config/loginPolicies

Creates a login policy. Login policies help manage the user login experience by doing such things as specifying the exact path to the Capture domain and the user profile entity type, and defining the login URL.

See also:
• Create a login policy

Delete a login policy
/{customerId}/config/loginPolicies

Deletes the specified login policy. Login policies help manage the user login experience by doing such things as: specifying the exact path to the Capture domain and the user profile entity type, and defining the login URL.

See also:
• Delete a login policy

Get a login policy's push claim status
/{customerId}/config/loginPolicies/{loginPolicyId}/pushClaims

Returns information about a login policy’s push claims status. Push claims centralize and standardize the user profile information added to an identity token or made available from the userinfo endpoint following a successful authentication.

See also:
• Push claims

Modify a login policy's push claim status
/{customerId}/config/loginPolicies/{loginPolicyId}/pushClaims

Enables or disables push claims for the specified login policy. Push claims centralize and standardize the user profile information added to an identity token or made available from the userinfo endpoint following a successful authentication.

See also: :
• Push claims

Get a login policy's allowed response types
/{customerId}/config/loginPolicies/{loginPolicyId}/allowedResponseTypes

Returns information about the response types assigned to the specified login policy. In an authorization request, the response_type parameter specifies the items clients expect to get back from the authorization server following a successful authentication.

See also:
• Supported response types

Modify a login policy's allowed response types

/{customerId}/config/loginPolicies/{loginPolicyId}/allowedResponseTypes

Modifies the response types assigned to the specified login policy. In an authorization request, the response_type parameter specifies the items clients expect to get back from the authorization server following a successful authentication.

See also:
• Supported response types

Get all token policies
/{customerId}/config/tokenPolicies

Returns information about your token policies. Token policies specify token lifetimes and define the allowed scopes for OpenID Connect clients.

See also:
• List token policies

Get a token policy
/{customerId}/config/tokenPolicies/{tokenPolicyId}

Returns information about the specified token policy. Token policies specify token lifetimes and define the allowed scopes for OpenID Connect clients.

Modify a token policy
/{customerId}/config/tokenPolicies/{tokenPolicyId}

Modifies a token policy. Token policies specify token lifetimes and define the allowed scopes for OpenID Connect clients.

See also:
• Modify a token policy

Create a token policy
/{customerId}/config/tokenPolicies

Creates a token policy. Token policies specify token lifetimes and define the allowed scopes for OpenID Connect clients associated.

See also:
• Create a token policy

Delete a token policy
/{customerId}/config/tokenPolicies/{tokenPolicyId}

Deletes a token policy. Token policies specify token lifetimes and define the allowed scopes for OpenID Connect clients.

See also:
• Delete a token policy

Get a token policy's allowed grant types
/{customerId}/config/tokenPolicies/{tokenPolicyId}/allowedGrantTypes

Returns information about the grant types defined in the specified token policy. A grant is a standard methodology for obtaining tokens and, as a result, obtaining access to resources.

See also:
• Supported authorization grant types

Modify a token policy's allowed grant types
/{customerId}/config/tokenPolicies/{tokenPolicyId}/allowedGrantTypes

Modifies the grant types supported by the specified token policy. A grant is a standard methodology for obtaining tokens and, as a result, obtaining access to resources.

See also:
• Supported authorization grant types

Get a token policy's allowed resource indicators
/{customerId}/config/tokenPolicies/{tokenPolicyId}/allowedResourceIndicators

Returns information about the resource indicators supported by the specified token policy. Resource indicators are identifiers representing items that can be referenced when using the resource parameter.

See also:
• Secure audience injection and the resource parameter

Modify a token policy's allowed resource indicators
/{customerId}/config/tokenPolicies/{tokenPolicyId}/allowedResourceIndicators

Modifies the resource indicators supported by the specified token policy. Resource indicators are identifiers representing items that can be referenced when using the resource parameter.

See also:
• Secure audience injection and the resource parameter

Submit an authorization request
/{customerId}/{hostedLoginDomain}/login/token

Requests Hosted Login authorization for an end user.

See also:
• Authorization code + PKCE grant type

Logout from Hosted Login
/{customerId}/{hostedLoginDomain}/auth-ui/logout?{clientId}&{redirectUri}

Logs a user out of a Hosted Login session.

Get the SIEM event service status
/config/applications/{appId}/eventdelivery/readStatus

Returns the SIEM event delivery service activation or deactivation status for the specified application.

See also:
• Activate or deactivate SIEM event feeds

Activate the SIEM event service
/config/applications/{appId}/eventdelivery/activate

Activates the SIEM event delivery service. You can't collect SIEM events unless the service is activated.

See also:
• Activate or deactivate SIEM event feeds

Deactivate the SIEM event service
/config/applications/{appId}/eventdelivery/deactivate

Deactivates the SIEM event delivery service for the specified application. After you call this operation, SIEM event messages for the application are no longer delivered.

See also:
• Activate or deactivate SIEM event feeds

Get the SIEM event blocklist
/config/applications/{appId}/eventdelivery/readBlocklist

Returns a list of the SIEM event delivery service event types blocked for the specified application. If an event type is blocked, event messages for that event aren't delivered. For example, if you block the new_email_verification event you won’t receive a notification when a user verifies an email address.

See also:
• Block SIEM events

Add an event to the SIEM event blocklist
/config/applications/{appId}/eventdelivery/addBlocklist

Adds an event to the SIEM event delivery service event types blocked for the specified application. If an event type is blocked, event messages for that event aren't delivered.

Remove an event from the SIEM event blocklist
/config/applications/{appId}/eventdelivery/deleteBlocklist

Removes one or more events from an application’s SIEM event delivery service blocklist. After an event is removed from the blocklist you'll receive a notification each time that event occurs.

See also:
• Block SIEM events

Get the SIEM event service public keys
/config/applications/{appId}/eventdelivery/readKeys

Returns information about the public keys assigned to the specified application. Use public keys to connect to the Amazon S3 bucket and download the event messages delivered by the SIEM event delivery service.

See also:
• Manage SIEM event public keys (legacy customers only)

Assign a public key to the SIEM event service
/config/applications/{appId}/eventdelivery/addKeys

Assigns public keys to the specified application. Use public keys to connect to the Amazon S3 bucket and download event messages delivered by the SIEM event delivery service. Organizations can assign a maximum of 10 public keys to their S3 bucket. However, you can delete one or more of your older keys and replace them with new keys.

See also:
• Manage SIEM event public keys (legacy customers only)

Delete a SIEM event service public key
/config/applications/{appId}/eventdelivery/deleteKeys

Removes SIEM event delivery service public keys.

See also:
• Manage SIEM event public keys (legacy customers only)

Authenticate a social login
/api/v2/auth_info

Authenticates a social login user.

Exchange a social login token for an access token
/api/v2/signin/oauth_token

Exchanges a social login identity provider token for an Identity Cloud social login token.

Get all social login providers
/api/v2/get_available_providers

Returns a list of configured providers for an application.

Get all configured social login providers
/api/v2/providers

Returns a list of configured social login identity providers for an application.

Configure social login authentication providers
/api/v2/set_auth_providers

Defines the list of social login identity providers that appear on the sign-in and registration pages. This is the same list of providers maintained by the Social Login dashboard.

Get a domain allowlist
/api/v2/get_domain_patterns

Returns all the domains on the social login allowlist. If the allowlist is configured, then only the domains included on that list can communicate with your social login application.

Add a domain to a domain allowlist
/api/v2/set_domain_patterns

Replaces the social login allowlist for an application. If the allowlist is configured, then only the domains included on that list can communicate with your social login application.

Modify a domain allowlist
/api/v2/add_domain_patterns

Modifies the domains on the social login allowlist. If the allowlist is configured, only the domains included on that list can communicate with your social login application.

Get all social login application settings
/api/v2/get_application_settings

View social login application settings.

Modify social login application settings
/api/v2/set_app_settings

Configures social login application settings.

Associate an identity provider with a primary key
/api/v2/map

Associates a primary key with a user’s social identity.

Remove an identity provider from a primary key
/api/v2/unmap

Removes a social login identity provider from a primary key.

Get all Webhooks v3 subscriptions
/{customerId}/webhooks/subscriptions

Returns information about the webhook subscriptions assigned to customer.

Get a Webhooks v3 subscription
/{customerId}/webhooks/subscriptions/{subscriptionId}

Returns information about the specified webhooks subscription.

Modify a Webhooks v3 subscription
/{customerId}/webhooks/subscriptions/{subscriptionId}

Modifies a webhooks subscription.

See also:
• Configure webhook subscriptions

Create a Webhooks v3 subscription
/{customerId}/webhooks/subscriptions

Creates a webhooks subscription.

See also:
• Configure webhook subscriptions

Delete a Webhooks v3 subscription
/{customerId}/webhooks/subscriptions/{subscriptionId}

Deletes the specified webhook subscription.

View a summary of Webhooks v3 events
/{customerId}/webhooks/subscriptions/{subscriptionId}/summary

Returns a high-level status summary of all events that have been generated for a given webhooks subscription in the last 7 days.

List Webhooks v3 events
/{customerId}/webhooks/subscriptions/{subscriptionId}/events

Returns event notifications for the specified webhooks subscription.

See also:
• View webhooks data in the events store

Get a Webhooks v3 event
/{customerId}/webhooks/subscriptions/{subscriptionId}/events/{eventId}

Returns information about the specified webhooks event.

See also:
• View webhooks data in the events store

Get a Webhooks v3 event's event history
/{customerId}/webhooks/subscriptions/{subscriptionId}/events/{eventId}/history

Returns the event history for the specified webhooks event.

This endpoint will be deprecated. Please use the /summary endpoint to understand the status of your webhooks subscription events from the last 7 days.

Redeliver a Webhooks v3 event
/{customerId}/webhooks/subscriptions/{subscriptionId}/events/{eventId}/redelivery

Schedules the specified event for redelivery to your listener endpoint.

See also:
• Schedule redelivery for a failed webhook event

Send a Webhooks v3 test notification
/{customerId}/webhooks/subscriptions/{subscriptionId}/test

Sends a test notification to your listener endpoint.

Get a Webhooks v3 administrative access token
/{customerId}/login/token

Requests an administrative access token for calling the other Webhooks v3 API endpoints.