ProjectX Identity

List agent identities

Each with whose authority it borrows, its blast radius and its budget.

Register an agent identity acting under delegation

An agent is never its own principal: `acts_for` is whose authority it borrows, and every decision about the agent is a decision about that person too.

Body

CreateAgentRequest

Fetch one agent identity

Replace an agent’s rate and spend ceilings

Body

AgentBudget

Return a stopped agent to service

Stop an agent immediately

The kill switch. The response carries the propagation time, so an operator can see when the last service actually stopped honouring the agent’s tokens.

Body

StopAgentRequest

Introspect an API grant for a scope

The scope must be within the grant and the grant not revoked. A revoked or missing grant allows nothing — the point of introspection over a self-contained token.

Body

IntrospectGrantRequest

Revoke an API access grant

List this tenant’s published SSO applications

Publish an SSO application from a template

From a catalog template — a specific SaaS, or generic-saml/generic-oidc — over SAML or OIDC, with optional per-app SCIM outbound.

Body

PublishApplicationRequest

Grant an application consented API access

A consented set of scopes with a rate limit. The consent is recorded (who, when) and the grant is revocable — introspection reads both.

Body

GrantApiAccessRequest

Set an application’s group- and rule-based assignment

Who gets the app: a set of groups and an optional attribute rule. Access follows the org chart rather than a hand-maintained list.

Body

SetAssignmentRequest

Find assigned licences unused past a threshold

Given the assigned principals, returns those whose last use is older than the threshold — or who never used it. Turns a seat count into a reclaim list.

Body

UnusedLicencesRequest

Record that a principal used an application

Feeds unused-licence detection — a seat assigned and never touched is the clearest waste.

Body

RecordAppUsageRequest

Decide how much proof a sign-in needs, given its risk

Critical risk is denied; high needs a phishing-resistant factor or steps up; medium needs a second factor or steps up; low allows. A sign-in already meeting the bar is not made to jump again.

Body

AdaptiveDecideRequest

Check whether two sign-ins imply impossible travel

Distance over time gives an implied speed; a speed no traveller reaches is flagged. The same account in two places at once is two people.

Body

ImpossibleTravelRequest

Continuously evaluate whether a session’s access still holds

Given the epoch the session was last evaluated at and the fresh PDP verdict when re-evaluation is due, returns continue or revoke — a session that no longer passes dies mid-request.

Body

ContinuousAccessRequest

List this tenant’s legacy auth endpoints

Enable and configure a legacy auth protocol

LDAP bind, RADIUS, Kerberos, smart card (PIV/CAC) or hardware OTP — off by default, opened only where the estate needs it.

Body

LegacyEndpointRequest

Authenticate a legacy identifier to a principal

Refuses an attempt against a disabled protocol and an identifier that maps to nobody. Returns the resolved principal.

Body

LegacyAuthenticateRequest

Map a legacy identifier to a principal

Bridges an old identifier — a bind DN, cert subject or token serial — to a platform principal, so a legacy protocol never authenticates a stranger.

Body

LegacyMappingRequest

Read the tenant’s access-policy epoch

The version live sessions are measured against for continuous access evaluation.

Bump the access-policy epoch on a policy change

Makes a policy change land mid-session: every live session evaluated against the old epoch is re-checked on its next request, and dies if it no longer passes.

Body

BumpEpochRequest

Query authentication attempts

Failures carry the username attempted rather than a resolved principal, because a sign-in attempt against an account that does not exist is exactly the event worth reading.

Score a sign-in for account-takeover risk

Bands the sign-in signals into low/medium/high so a response playbook reads the risk, not the arithmetic. Impossible travel weighs double.

Body

TakeoverAssessRequest

Decide allow / challenge / block for an attempt

The gateway calls this with what it has observed of the source. Credential stuffing is blocked; a source over its budget or already suspicious is challenged; the rest is allowed.

Body

BotEvaluateRequest

Set the bot-defence thresholds

How many attempts from one source before a challenge, and how many distinct accounts one source may fail against before it is blocked as credential stuffing.

Body

BotPolicyRequest

Grant consent for a purpose at a terms version

Consent is per purpose against a terms version — agreeing to v1 is not agreeing to v2. A new terms version resets it.

Body

GrantConsentRequest

Withdraw consent for a purpose

Withdrawal stamps the record withdrawn rather than deleting it — the audit needs both the grant and the withdrawal.

Body

WithdrawConsentRequest

List this tenant’s customer tenants

Create a customer tenant with its own branding

A customer’s own user base with its branding (logo, colours, domain, copy) and registration policy — the sign-up page a customer’s users see is the customer’s page, not ours wearing a hat.

Body

CreateCustomerTenantRequest

List this tenant’s data-subject requests, newest first

Raise a GDPR data-subject request

Export, rectify or erase — a tracked obligation with a deadline and a closed lifecycle, so a GDPR deadline is a state the system tracks rather than a promise in an inbox.

Body

RaiseDsrRequest

Close a data-subject request, fulfilled or rejected

A request is decided once; the outcome records where an export landed or why it was rejected.

Body

CloseDsrRequest

Set a principal’s roles in a customer org

B2B multi-org: one identity across many organisations, a different set of roles in each. Roles set here never leak into another org.

Body

SetOrgMembershipRequest

Apply preference changes for a principal

The customer’s switchboard. Changes merge over existing preferences — editing one leaves the others alone.

Body

SetPreferencesRequest

Set the self-registration policy

The fields collected at sign-up versus later. A short front door, the rest asked for when it is worth asking — progressive profiling.

Body

RegistrationPolicyRequest

Link a social provider identity to a principal

Links a Google/Apple/Microsoft/Facebook/GitHub subject to a principal. Refuses a subject already tied to another user — an external subject that maps to two people is an account-takeover seam.

Body

LinkSocialIdentityRequest

Issue a verification challenge

A challenge to an email, phone or document with a code and a deadline. It cannot be reused once verified — a spent verification is not a standing pass.

Body

IssueVerificationRequest

Verify a challenge with a presented code

Accepts the right code before the deadline and refuses a wrong code, an expired challenge, or a second attempt on a spent one.

Body

VerifyChallengeRequest

List API keys in the tenant

Mint an API key, returning the secret exactly once

Body

ApiKeyRequest

Revoke an API key

Replace an API key, leaving the old one valid for a grace window

The grace window is what lets a deploy pick up the new key without an outage in between.

Body

RotateApiKeyRequest

List your own API keys

Prefixes and expiries, never secrets. A secret is returned once, at issue.

List one customer’s users, as metadata

Platform tenant only. Name, email, state, source and sign-in times — never attributes or credentials.

One customer user, with the kinds of factor they have enrolled

Factor kinds and when each was added, so support can see why a sign-in fails. Never the factor itself.

Reactivate a suspended customer user

Body

CustomerUserActionRequest

Make a customer user register a new passkey at their next sign-in

The recovery path for somebody who has lost their key: nothing is removed, and the next sign-in asks for a new one.

Body

CustomerUserActionRequest

Revoke every session a customer user holds

Body

CustomerUserActionRequest

Suspend a customer’s user, revoking their sessions and credentials

Body

CustomerUserActionRequest

List the delegation grants this tenant has opened

Grant an MSP delegated administration of this tenant

Names the MSP tenant, the exact MSP principals, the action prefixes they may use, and why. Pausing the grant closes every access window it opened.

Body

DelegationGrantRequest

Pause or resume a delegation grant

Pausing closes every access window the grant opened.

Body

DelegationUpdateRequest

Open a time-boxed delegated access window into a client tenant

Every check runs on every open: the grant names your tenant and you, it is enabled and unexpired, and your account in the MSP tenant is active. The window lasts at most eight hours and never outlives the grant.

The delegated access windows open in this tenant right now

No unmanaged cross-client access is a list the client can read, not a promise.

End one delegated access window now

The client tenants the calling MSP principal may act for

Read from the MSP tenant’s own mirror records; a grant the client paused or let expire does not appear.

Read the managed-device access policy

Set the managed-device access policy

One rule per resource sensitivity, stating whether a device must be managed and compliant. This is what turns a personal laptop away from the crown jewels while letting a managed, healthy device through.

Body

DeviceAccessPolicyRequest

List this tenant’s MDM/EDR integrations

Register an MDM or EDR integration

A connection to the system of record for device management (Intune, Jamf, Kandji, Workspace ONE) or endpoint protection (CrowdStrike, SentinelOne, Defender). A synced posture is attributed to the integration it came from.

Body

RegisterIntegrationRequest

List this tenant’s enrolled devices

Enrol a device to a principal

Ties a device to its owner and records whether it is corporate-managed or personal. The device proves its identity with a client certificate, not a self-asserted name.

Body

EnrolDeviceRequest

Decide whether a device may reach a resource of a sensitivity

Folds device trust into an ABAC decision: returns allowed plus, when refused, the reasons — the same reasons the user needs to know what to fix. With no policy set, access is allowed; device trust is opt-in per tenant.

Body

EvaluateDeviceAccessRequest

Report a device’s posture signals

The MDM/EDR reporter posts the current signals — encryption, patch level, EDR, screen lock, jailbreak. Compliance is computed from these on demand, so a device that drifts out is treated as such at the next check.

Body

ReportPostureRequest

List this tenant’s network zones

Create or replace a network zone

A named set of CIDR ranges and how far they are trusted. A request’s source address resolves to a zone, which becomes an attribute ABAC reads — turning "only from a trusted network" into a rule rather than a firewall no one can see into.

Body

NetworkZoneRequest

List this tenant’s published apps

Publish an internal app through the ZTNA proxy

Makes an internal app reachable without a VPN, on conditions: a resource sensitivity the device policy reads and, optionally, a minimum network-zone trust. Every request is evaluated on its own — there is no inside.

Body

PublishAppRequest

Decide whether a device on a network may reach a published app

The proxy calls this per request: it resolves the source address to a network zone and combines device trust with zone trust, with no implicit inside. Returns allowed plus the reasons when refused — whether to fix the device or get on a better network.

Body

ReachAppRequest

Read the attributes this directory accepts

What a bulk import may set, what policy may test, and what a user may edit about themselves — all three are read from here rather than agreed by convention.

Declare or replace one directory attribute

The two fields that matter most are `self_service_editable` and `policy_visible`: an attribute a user may edit and the decision point may read is a privilege escalation waiting to be found.

Body

AttributeDefinition

The workload CA root certificate

What a workload needs to verify the certificate of another workload. Public by nature — a root certificate is meant to be distributed — but read through the directory permission so the request is audited like any other.

Read session and sign-in policy for the tenant

Set session and sign-in policy for the tenant

`allow_weak_second_factors` is the one field here that lowers a security floor, and it is annotated on the audit event for exactly that reason.

Body

RealmConfig

Create a new company’s sign-in realm and first administrator

Self-service sign-up (A5): creates the realm named after the tenant, a public PKCE client per customer console stamping a fixed `tenant` claim, and the first user with no password. Keycloak emails them a link, valid for three days, to verify the address and set a password and authenticator or register a passkey. Idempotent. Platform tenant only.

Body

ProvisionCompanyRequest

List your own enrolled second factors

Start enrolling a second factor on your own account

Body

EnrolFactorRequest

Remove a second factor from your own account

Send a number-matching push challenge to your phone

Returns the number the login screen displays. The phone receives the challenge id and three options — never the answer — and answers by signing the number the user tapped.

Body

BeginPushChallengeRequest

Read a push challenge’s status

Answer a push challenge with the tapped number and the device signature

Body

AnswerPushChallengeRequest

List your own enrolled push devices

Enrol a phone for push MFA with number matching

Body

EnrolPushDeviceRequest

Remove one of your push devices

List the LDAP and Active Directory directories this tenant reads people from

The bind credential is never returned.

Disconnect a directory

The people imported from it are removed from the realm with it: their accounts were the directory’s, and it is no longer there to vouch for them.

Connect or replace an LDAP or Active Directory directory

Read-only federation: people sign in with their directory password, checked by binding to the directory, and nothing is written back. The bind is tried before anything is saved; a directory that refuses it answers 422. Leave `bind_credential` out on a replace to keep the stored one.

Body

LdapDirectoryConfig

Pull people from a directory now

`mode: full` pulls everyone; `changed` (the default) only who changed since the last sync. The scheduled sync runs the `changed` kind every `sync_interval_seconds`.

Body

LdapSyncRequest

List this tenant’s HR connections

Connect an HR system (Workday, SuccessFactors, BambooHR, Personio, HiBob, ADP)

The credential stays behind a reference resolved by the deployment; this record holds where to call and how often, never the secret.

Body

CreateHrConnectionRequest

Pause, resume or re-cadence an HR connection

Body

UpdateHrConnectionRequest

Run a sync from this HR connection now

A delta run reads what changed since the watermark; a full run reads everything and reconciles, flagging principals this source manages whom the feed no longer mentions. A dry run reports what would change and touches nothing. Failures are recorded per record rather than aborting the run, and the run is kept as a reconciliation report.

Reconciliation reports for HR sync runs, newest first

Each report carries the steps, the per-record failures, the conflicts where an HR value overrode a locally managed principal, and the attributes the tenant schema declined.

List configured upstream identity providers

Aliases, protocols and mappings. Client secrets are never returned.

Remove an upstream identity provider

Deletes the realm’s federation to this provider. A user who signed in through it keeps their local principal; what goes is the ability to broker a new login.

Register or replace an upstream identity provider

`client_secret` is written through to the realm and never read back, so the audit event records the alias and the protocol and nothing else.

Body

IdentityProviderConfig

Service-provider metadata for one upstream SAML provider

What the customer’s identity provider imports to trust this tenant: the entity id and the ACS URL its assertions are posted to. Answers `application/xml`. Not found for a provider that is not SAML.

This realm’s SAML identity-provider metadata

The metadata a SAML application imports to sign people in through this tenant: the sign-in endpoint and the certificate assertions are signed with. Answers `application/xml`, not JSON, because the application expects the SAML metadata schema.

List groups, static and dynamic

Create a static or dynamic group

Supplying a `rule` makes the group dynamic — membership is evaluated from attributes rather than assigned — and omitting one makes it static.

Body

CreateGroupRequest

Remove a principal from a group

Add a principal to a group

An `expires_at` is what makes this a time-boxed elevation rather than a permanent grant.

Body

GroupMembershipRequest

List this tenant’s access requests, newest first

Request access to an entitlement, with a justification

The justification is the request’s reason for existing, not a note on it — an approver answers with it and an auditor reads it first, so a request without one is refused. The workflow says who approves and how: steps in order, together, or only when a condition holds, escalating when nobody acts in time.

Body

AccessRequestBody

Approve or reject an access request as one of its approvers

Any approver may reject the whole request; it is approved only when every applicable step is. On approval the time-bound grant is minted in the same step, so an approved request without the access it approved cannot happen.

Body

DecideAccessRequestBody

List this tenant’s birthright rules

Define a birthright rule: what a role or attribute grants on joining

The floor access a role implies — a new nurse opens the ward system on day one without a ticket. Anything beyond the birthright goes through a request.

Body

CreateBirthrightRuleRequest

List this tenant’s access review campaigns

Open an access review campaign, scoped to a manager, owner or role

The scope decides who reviews — a review nobody is accountable for is a review nobody does. Every item starts undecided, and an item still undecided when the campaign closes is revoked, not kept.

Body

CreateCampaignRequest

Export the certification evidence for a campaign

What an auditor is handed: every item, its reviewer, the decision and when. A review whose result cannot be exported is, to an auditor, a review that did not happen.

Close a campaign, revoking every item nobody reviewed

The fail-safe direction: an item nobody looked at loses its access, because access that persists because nobody reviewed it is the exact failure a review exists to catch. The grants are revoked in the same step the campaign closes.

Record a keep-or-revoke decision on one item of a campaign

Body

ReviewItemRequest

List the cross-pillar entitlement catalog with its pillar coverage

Returns the catalog and which pillars it actually covers, so a governance view shows the gap — a catalog that stops at three pillars is a leaver sweep that misses two — rather than discovering it during an incident.

Add one grantable thing to the cross-pillar entitlement catalog

One list of every grantable thing across identity, data, video, cloud, agents and ops. A review, a segregation-of-duties rule and a leaver sweep are only as complete as this single catalog, which is why it is one list and not five.

Body

CreateEntitlementRequest

List this tenant’s time-bound access grants

Renew a time-bound grant, extending it a fresh window

A renewal extends a live grant from now, not from its old expiry, so it grants a fresh window rather than back-dating a lapsed one. A revoked or permanent grant cannot be renewed and the call is refused rather than silently doing nothing.

Body

RenewGrantBody

Least-privilege analytics: who holds unused access and how much

An entitlement granted and never exercised is standing risk with no upside. Ranks principals by the fraction of their access that goes unused since the given instant, so a right-sizing conversation starts with who is furthest from least privilege.

Grant a joiner their role’s birthright on join

A new hire gets the floor access their role implies without a ticket. Anything beyond it goes through a request.

Body

LifecycleFactsRequest

Revoke every governance grant a leaver holds, across all pillars, in one run

The headline: one sweep spans identity, data, video, cloud, agents and ops, because the grants all name entitlements in the one cross-pillar catalog. The plan’s pillars_reached is the proof of breadth. The wider reach — sessions, credentials, downstream SaaS — is the platform offboarding sweep.

Body

LeaverRequest

Recompute a mover’s birthright and apply the difference

A move is a replacement, not an accumulation: the new position’s access is granted and the old position’s birthright is revoked, so a long-tenured employee does not end up with the run of the building.

Body

LifecycleFactsRequest

Grants and credentials whose owner is gone or deprovisioned

Access with nobody accountable for it — the residue of an incomplete leaver sweep. Reported, never deleted: an orphaned account might still be load-bearing, and destroying it is a human’s call.

Suggest roles from the entitlement sets many principals already share

When many people hold the same set of entitlements, that set is a role whether or not anyone named it. A suggestion an administrator confirms, never a role the miner creates on its own.

List this tenant’s role catalog

Define a role: a named bundle of permissions with an owner

The owner is required, not decorative — a role nobody owns is a role nobody reviews, and "who signs off that this bundle is still right" is the first question a review campaign asks.

Body

CreateRoleRequest

Grant a time-bounded exception to an SoD rule for one principal

Allowed only with an expiry — a permanent exception is the rule quietly repealed, and the exception that outlives its reason is the one an auditor finds years later.

Body

SodExceptionRequest

List this tenant’s segregation-of-duties rules

Define a segregation-of-duties rule: two entitlements one person must not hold

The two sides are entitlement URNs from the one catalog, so a rule can pair things across pillars — the cross-pillar conflict a per-pillar model cannot even express.

Body

CreateSodRuleRequest

Every principal holding both sides of an SoD rule, across live grants

Excepted violations are reported and flagged, not hidden — a suppressed violation is one nobody re-reviews when its exception lapses.

List a principal’s detections, newest first

Raise an identity threat detection

A known thing from the detection library — impossible travel, privilege escalation, mass entitlement change — against a principal. Severity defaults to the kind’s base but a detector may raise it.

Body

RaiseDetectionRequest

Create or replace a response playbook

Maps a risk band to the response it warrants — force re-auth, step up, notify, open a case, suspend, disable. Kept as data so it is edited, reviewed and tested.

Body

SavePlaybookRequest

Resolve the actions a playbook orders for a principal’s risk

Scores the principal, bands the risk, and reads the playbook’s rule for that band — the responder runs the result.

Body

RespondRequest

Read a principal’s live risk score and band

The decaying sum of the principal’s recent detections as of now — a spree today lights it up, the same spree last month has faded.

Correlate a principal’s identity risk with video and cloud events

Joins the principal’s identity risk to the video and cloud event refs the caller has gathered — one story across three pillars instead of three consoles.

Body

CorrelateRiskRequest

List this tenant’s SOC sinks

Configure a SOC sink

A SIEM stream, webhook or ticketing target detections are emitted to. The transport is the platform’s; this is the identity-side config.

Body

SaveSocSinkRequest

Consume a single-read credential handoff

Body

CredentialHandoffRead

List Lifecycle provider metadata

Register Lifecycle provider metadata

Body

LifecycleConnectionRequest

Read Lifecycle provider health and simulator status

List Lifecycle requests and execution state

Create a governed Lifecycle request

Body

LifecycleRequestCreate

Read a Lifecycle request and its history

Compensate completed steps of a failed Lifecycle request

Create a single-read first-day credential handoff

Body

CredentialHandoffCreate

Approve or reject a Lifecycle request

Body

LifecycleDecisionRequest

Execute or retry an approved Lifecycle request

List lifecycle cohorts and their state

Open one governed lifecycle action over a directory-selected cohort

The member list is frozen at creation and capped; every member runs through the same named approvals and per-step execution records as a single request.

Body

LifecycleCohortRequest

Apply one approval decision to every member of a cohort

Body

LifecycleCohortDecisionRequest

Execute every approved member of a cohort

A member that fails fails its own request with its own compensation path; the cohort reports partial rather than pretending unanimity.

Licence holdings, cost and reclaim candidates per SKU

Holdings are computed from Lifecycle’s own execution history; reclaim candidates are named with their reason — suspended, deprovisioned, or idle for ninety days.

List the licence rate card

Add or replace a licence rate card entry

Licence insight costs come from the tenant’s own rate card — a number we invented would be a number nobody can check.

Body

LicenceRateRequest

List Lifecycle role profiles

Create a Lifecycle role profile

Body

LifecycleRoleProfileRequest

List OAuth clients in the tenant

Registration records only — a client’s secret is never returned.

Register an OAuth client

A confidential client’s secret appears in this response and nowhere else — not in the audit context, not in a log line. Redirect URIs must be https, or http to a loopback address for a native app; a public client uses PKCE and may not hold client_credentials.

Body

CreateOAuthClientRequest

Read one OAuth client’s registration

Revoke an OAuth client

The record stays — the audit trail for what the client could ask for survives it — but the Keycloak client is deleted, so the flows stop working.

Body

RevokeOAuthClientRequest

Rotate an OAuth client’s secret

Returns the new secret once. The previous one stops working immediately. A public client has no secret to rotate.

List this tenant’s break-glass accounts and their seal state

Open a sealed break-glass account, requiring two approvers

No one person can open it alone — the account one person can open in an emergency is the account they open when it suits them. Every open raises an alert and is recorded for review.

Body

OpenBreakGlassRequest

List this tenant’s command filters

Create or replace a command filter

An ordered list of rules the broker consults before forwarding a command. Order is meaning: the first matching rule decides, so a narrow alert exception sits before the broad block it excepts.

Body

SaveCommandFilterRequest

Evaluate a command against a filter before it runs

Returns the decision — allow, alert or block — and the rule that decided. A block means the command is refused at the broker and never reaches the target.

Body

EvaluateCommandRequest

List this tenant’s JIT elevations, newest first

Request just-in-time elevation to a role for a window

Privilege with a stopwatch: approved once, it expires on its own, so it cannot outlive the work — there is no "forgot to hand it back".

Body

RequestElevationRequest

Approve a JIT elevation, starting its window

The clock starts at approval, not at the request, so the window is the time the operator actually has the access.

List this tenant’s brokered sessions, newest first

Open a brokered session to a host, cluster or database

The broker mints a short-lived credential the target trusts — an SSH certificate, an RDP ticket, a per-session kubeconfig, an ephemeral database role — that expires on its own. Nothing standing is left on the target, and a database session is credential-less: the injected role is the access, no password is handed back.

Body

OpenSessionRequest

Close a brokered session, killing its credential now

The ephemeral credential is dead from the close rather than at its natural expiry — the operator handed the session back, so the access ends with the hand-back.

Append a captured event to a session recording

The capture agent posts keystrokes, resolved commands and video frame markers as the session runs. Each carries an offset from the session open, so a later search is a seek into the video, not just a log line.

Body

RecordEventRequest

Play back or search a session recording

Returns the ordered event stream for playback. Pass ?q= to search: the response then carries only the matching events and their offsets, the moments a reviewer should watch.

Mint a dynamic secret leased for a short window

No stored shared secret: a fresh credential leased for a window and dead after. The credential that leaks is dead in minutes and belonged to nobody else.

Body

MintDynamicSecretRequest

List vault secrets as metadata, never their values

Names, systems, versions and checkout state — who holds the root password right now, and why. The value is never in the list.

Store a privileged secret in the vault

The vault holds another system’s privileged secret. Only metadata is stored here; the value goes to the encrypted store and is never returned by a listing — getting it is a recorded checkout.

Body

StoreSecretRequest

Check a secret back in, rotating it

Check-in rotates the secret, so the copy the borrower walked away with is dead the moment they hand the checkout back.

Check a secret out to yourself, with a reason

A recorded event with a holder and a reason, because "who has the root password right now, and why" is the question the vault exists to answer.

Body

CheckoutSecretRequest

List groups by SCIM

Fetch one group by SCIM

Patch a group’s membership by SCIM provisioning

Body

ScimPatchOp

List users by SCIM

RFC 7644 paging, which counts from one rather than zero. Errors on every SCIM route answer in SCIM’s error format rather than RFC 7807, because a provisioning agent treats anything else as a transport failure and retries for ever.

Create a user by SCIM provisioning

Idempotent on `externalId`, so a provider replaying a create gets the existing user and a 200 rather than a duplicate.

Body

ScimUser

Deprovision a user by SCIM

Most providers send a patch setting `active` to false instead; this is the harder form and is honoured as a deprovision rather than a delete, because the audit chain outlives the account.

Fetch one user by SCIM

The id is a percent-encoded URN. One belonging to another tenant gets a 404 rather than a 403, because confirming that it exists is itself a disclosure.

Patch a user by SCIM provisioning

`active: false` arriving as a replace operation is how most identity providers say a person has left, which makes this the most consequential body in the identity plane.

Body

ScimPatchOp

Replace a user by SCIM provisioning

Body

ScimUser

List the downstream systems this tenant pushes users to

Names only, never credentials. An offboarding sweep reads this to know which systems it must ask to deactivate the leaver, so that a target nobody told it about is a gap in the configuration rather than a gap in the sweep.

Push this tenant’s users to a downstream SCIM target

A dry run reports what would change and touches nothing. Failures are listed per user rather than aborting the run, because one rejected account should not leave the other four hundred unsynchronised.

Create a service account with a client secret

The secret appears in this response and nowhere else — not in the audit context, not in a log line.

Body

CreateServiceAccountRequest

Rotate a service account’s client secret

Returns the new secret once. The previous one stops working immediately.

List your own sessions

Device, address and assurance level for each, which is what lets a person recognise the one they do not recognise.

Revoke one session

Revoke every session a user holds

The response carries the propagation time, because “signed out everywhere” that takes four minutes to reach the last service is not what an incident responder needs.

Body

SignOutRequest

Read one customer’s allow-listed product operations summary

Platform tenant only. Counts, states, usage and provider health; no customer content or verification payloads.

Export the directory as CSV

Round-trippable through the import: the columns this writes are the columns that endpoint reads, so an administrator can export, edit in a spreadsheet, and apply.

Apply a user import

Planned first and refused as a whole if any row is invalid, so the operator fixes a spreadsheet rather than reconciling a partial run.

Validate a user import without writing anything

Returns a row-by-row verdict over the whole file. The two-step exists because a partially applied import of four thousand users is worse than a refused one: the operator has no way to tell what landed.

Change attributes on your own profile

Only attributes the tenant’s schema marks self-service editable are accepted, and the rest are refused rather than ignored: a user who thinks they changed their clearance and did not is worse off than one who was told no.

Body

SelfProfilePatch

List users

Create a user in the tenant directory

Body

CreateUserRequest

Fetch one user

`me` in place of the id resolves to the caller, and then goes through exactly the same decision as any other principal — so “can a user read their own profile” is a policy question with an auditable answer rather than a special case.

Change a user’s profile fields

An absent field is left alone, which is not the same as one set to null: a patch that omits a field must not be indistinguishable from one that clears it.

Body

UpdateUserRequest

Effective group membership for one user

Includes memberships inherited from parent groups and memberships a dynamic rule produces, because those are the ones an access review would otherwise miss.

Move a user between pending, active, suspended and deprovisioned

Suspending and deprovisioning revoke sessions and credentials as part of the same transition, and the response says how many of each — a state change that left a live session behind would be a suspension in name only.

Body

LifecycleRequest

Require the user to enrol a passkey at next sign-in

List Verify applicant metadata

Create a Verify applicant metadata record

Body

VerifyApplicantRequest

List Verify attempts and review state

Start a Verify attempt

Body

VerifyAttemptRequest

Read a Verify attempt timeline

Run one Verify provider check

Body

VerifyCheckRequest

Close an unbillable Verify attempt

Body

VerifyCloseRequest

Complete and meter a processed Verify attempt

Record purpose-specific Verify consent

Body

VerifyConsentRequest

Delete expired evidence and return deletion evidence

Register synthetic evidence in the regional boundary

Body

VerifyPayloadRequest

Record a reasoned Verify review decision

Body

VerifyReviewRequest

Read explainable Verify risk reasons

List Verify flow versions

Publish a versioned Verify flow

Body

VerifyFlowRequest

List monitoring alerts, newest first

Resolve an alert with words

A resolution without reasons is not one.

Body

MonitoringAlertResolveRequest

Evaluate one subscription now; a non-passing answer opens an alert

Body

MonitoringEvaluateRequest

Read monitoring provider health and simulator status

List monitoring subscriptions

Open a standing fraud/AML watch over an applicant

Ongoing duty, not a one-time check: the subscription re-screens on its cadence and every non-passing evaluation opens an alert.

Body

MonitoringSubscriptionRequest

Pause or resume a monitoring subscription

Body

MonitoringUpdateRequest

Read Verify provider health and simulator status

List reporting profiles

Declare or replace the reporting profile for a jurisdiction

Jurisdiction is declared, not inferred: the profile names the regulator, currency and Travel Rule threshold.

Body

ReportingProfileRequest

Read Travel Rule provider health and simulator status

List regulated reports and their filing state

Compile a regulated report from the period’s records

Reports are compiled from transfer and alert records, never inferred from KYC outcomes.

Body

RegulatedReportRequest

File a draft report; filing names its filer and happens once

List reusable identities and their state

Issue a reusable identity from a completed, approved attempt

One identity per source attempt; expiry is the applicant retention horizon capped at one year.

Body

ReusableIdentityIssueRequest

Revoke a reusable identity; attempts already satisfied stand

List Travel Rule transfers and their state

Record a transfer and send Travel Rule data when the threshold is met

Below the threshold the exemption itself is on the record; at or above it, originator, beneficiary and counterparty are required.

Body

TravelRuleTransferRequest

Record the counterparty’s acknowledgement of a sent transfer

Sign a workload certificate request

Returns a short-lived SPIFFE certificate. The private key never leaves the workload, which is the whole point of taking a CSR rather than generating a keypair here.

Body

WorkloadCertificateRequest

Read the assistive policy

Set the assistive cage: allowed actions, device cap, kill switch

Switching it off kills every proposed and approved run with it.

Body

AssistivePolicyRequest

List assistive runs, their simulations and their outcomes

Propose an assistive run; every step is simulated first

Body

AssistiveRunRequest

Approve or reject a proposed run; the approver is never the proposer

Body

AssistiveDecisionRequest

Execute the approved plan; the kill switch is re-checked first

List Workplace policy baselines

Publish a Workplace policy baseline

Body

WorkplaceBaselineRequest

List Workplace deployment results

List the Workplace managed fleet

Register or update a stable managed device

Body

WorkplaceDeviceRequest

Assign a device to a ring and baseline

Body

WorkplaceAssignRequest

Execute an idempotent Workplace deployment

Body

WorkplaceDeploymentRequest

Compare observed device settings with its baseline

Rotate the device’s local admin password; the record keeps the digest only

Body

LapsRotateRequest

Deploy a published package to a device

Roll a device back to the package’s named rollback target

Answer a device’s baseline drift with a baseline deployment

A device in step with its baseline has nothing to remediate — a 409, not a no-op.

Synchronize inventory through the MDM port

List Workplace elevation requests and expiry

Request time-boxed endpoint elevation

Body

WorkplaceElevationRequest

Approve or reject endpoint elevation

Body

WorkplaceElevationDecisionRequest

Revoke active endpoint elevation

Reveal the current local admin password once, for a named purpose

The reveal is written onto the record; afterwards the secret is gone from the boundary and the next reader rotates first.

Body

LapsRevealRequest

List LAPS credentials whose rotation cadence has elapsed

Configure the ITSM bridge migration waves publish cases to

Body

ItsmConnectionRequest

List migration waves and per-device outcomes

Create a migration wave over a frozen, inventory-checked device list

Body

MigrationWaveRequest

Ticket reconciliation: the wave’s ITSM case, or why there is none

Reclaim every device the wave enrolled, recorded the same way

Run a wave: per-device enrolment, partial over pretend, ITSM case attached

List application packages and their state

Publish a reviewed application package

A package is a source reference plus a SHA-256 digest; it publishes once per name and version and names its rollback target.

Body

AppPackageRequest

Retire a package; a retired package cannot be deployed

Read Workplace MDM health and simulator status

List Workplace rollout rings

Create an ordered Workplace rollout ring

Body

WorkplaceRingRequest