Skip to main content
API docs by Redocly

API (1.0.0)

Download OpenAPI specification:Download

Scopes

Create a scope

Authorizations:
ApiKeyAuth
Request Body schema: application/json
required
id
required
string
name
required
string
type
required
string
Enum: "organization" "workspace" "application"
parentId
string
description
string
inheritParent
boolean
allowRoleInheritance
boolean
accessScopeId
string

Responses

Request samples

Content type
application/json
{
  • "id": "string",
  • "name": "string",
  • "type": "organization"
}

Response samples

Content type
application/json
{
  • "id": "string",
  • "name": "string",
  • "type": "organization"
}

List scopes

Authorizations:
ApiKeyAuth
query Parameters
limit
number

Maximum items per page

nextToken
string

Pagination cursor

type
string

Filter by scope type

Responses

Response samples

Content type
application/json
{
  • "id": "string",
  • "name": "string",
  • "type": "organization"
}

Get a scope by ID

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

Responses

Response samples

Content type
application/json
{
  • "id": "string",
  • "name": "string",
  • "type": "organization"
}

Update a scope

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

Request Body schema: application/json
required
id
required
string
name
string
description
string
type
string
Enum: "organization" "workspace" "application"
parentId
string
allowRoleInheritance
boolean

Responses

Request samples

Content type
application/json
{
  • "id": "string"
}

Response samples

Content type
application/json
{
  • "id": "string",
  • "name": "string",
  • "type": "organization"
}

Delete a scope

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}

Move a scope to a new parent

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

Request Body schema: application/json
required
newParentScopeId
required
string

Responses

Request samples

Content type
application/json
{
  • "newParentScopeId": "string"
}

Response samples

Content type
application/json
{
  • "id": "string",
  • "name": "string",
  • "type": "organization"
}

Apply an authorization manifest to a scope

Applies a declarative authorization manifest (permissions, roles, access policies) to a scope. Supports idempotent apply via idempotencyKey.

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

Request Body schema: application/json
required
required
object
serialization
string
Enum: "json" "yaml"

Responses

Request samples

Content type
application/json
{
  • "manifest": {
    }
}

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}

Export a scope as authorization manifest

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}

Permissions

Create a permission

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

Request Body schema: application/json
required
id
required
string
scopeId
required
string
resource
required
string
action
required
string
effect
required
string
Enum: "allow" "deny"
name
required
string
description
string
object or object or object or object

Responses

Request samples

Content type
application/json
{
  • "id": "string",
  • "scopeId": "string",
  • "resource": "string",
  • "action": "string",
  • "effect": "allow",
  • "name": "string"
}

Response samples

Content type
application/json
{
  • "id": "string",
  • "scopeId": "string",
  • "resource": "string",
  • "action": "string",
  • "effect": "allow",
  • "name": "string"
}

List permissions in a scope

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

query Parameters
limit
number

Maximum items per page

nextToken
string

Pagination cursor

Responses

Response samples

Content type
application/json
{
  • "id": "string",
  • "scopeId": "string",
  • "resource": "string",
  • "action": "string",
  • "effect": "allow",
  • "name": "string"
}

Bulk create permissions

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}

Bulk delete permissions

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}

Get a permission by ID

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

id
required
string

Permission ID

Responses

Response samples

Content type
application/json
{
  • "id": "string",
  • "scopeId": "string",
  • "resource": "string",
  • "action": "string",
  • "effect": "allow",
  • "name": "string"
}

Update a permission

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

id
required
string

Permission ID

Request Body schema: application/json
required
resource
string
action
string
effect
string
Enum: "allow" "deny"
name
string
description
string
object or object or object or object

Responses

Request samples

Content type
application/json
{ }

Response samples

Content type
application/json
{
  • "id": "string",
  • "scopeId": "string",
  • "resource": "string",
  • "action": "string",
  • "effect": "allow",
  • "name": "string"
}

Delete a permission

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

id
required
string

Permission ID

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}

Import permissions from CSV

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

Responses

Response samples

Content type
application/json
{
  • "created": 0,
  • "skipped": 0,
  • "errors": [
    ]
}

Roles

Create a role

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

Request Body schema: application/json
required
id
required
string
scopeId
required
string
name
required
string
description
string
permissionIds
required
Array of strings
parentRoleId
string

Responses

Request samples

Content type
application/json
{
  • "id": "string",
  • "scopeId": "string",
  • "name": "string",
  • "permissionIds": [
    ]
}

Response samples

Content type
application/json
{
  • "id": "string",
  • "name": "string",
  • "scope": {
    },
  • "permissions": [
    ]
}

List roles in a scope

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

query Parameters
limit
number

Maximum items per page

nextToken
string

Pagination cursor

Responses

Response samples

Content type
application/json
{
  • "id": "string",
  • "name": "string",
  • "scope": {
    },
  • "permissions": [
    ]
}

Bulk create roles

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}

Bulk delete roles

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}

Get a role by ID

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

id
required
string

Role ID

Responses

Response samples

Content type
application/json
{
  • "id": "string",
  • "name": "string",
  • "scope": {
    },
  • "permissions": [
    ]
}

Update a role

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

id
required
string

Role ID

Request Body schema: application/json
required
name
required
string
description
string
permissionIds
required
Array of strings
parentRoleId
string

Responses

Request samples

Content type
application/json
{
  • "name": "string",
  • "permissionIds": [
    ]
}

Response samples

Content type
application/json
{
  • "id": "string",
  • "name": "string",
  • "scope": {
    },
  • "permissions": [
    ]
}

Delete a role

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

id
required
string

Role ID

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}

Clone a role from another scope

Authorizations:
ApiKeyAuth
path Parameters
targetScopeId
required
string

Target scope ID

templateRoleId
required
string

Source role ID

Responses

Response samples

Content type
application/json
{
  • "id": "string",
  • "name": "string",
  • "scope": {
    },
  • "permissions": [
    ]
}

Access Policies

Create an access policy

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

Request Body schema: application/json
required
subjectId
required
string
scopeId
required
string
roleIds
Array of strings
permissionIds
Array of strings
subjectType
string
Enum: "user" "api-key"
expiresAt
string
validFrom
string

Responses

Request samples

Content type
application/json
{
  • "subjectId": "string",
  • "scopeId": "string"
}

Response samples

Content type
application/json
{
  • "id": "string",
  • "subjectId": "string",
  • "scope": {
    },
  • "roles": [
    ]
}

List access policies in a scope

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

query Parameters
limit
number

Maximum items per page

nextToken
string

Pagination cursor

Responses

Response samples

Content type
application/json
{
  • "id": "string",
  • "subjectId": "string",
  • "scope": {
    },
  • "roles": [
    ]
}

Get an access policy by ID

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

id
required
string

Policy ID (subjectId)

Responses

Response samples

Content type
application/json
{
  • "id": "string",
  • "subjectId": "string",
  • "scope": {
    },
  • "roles": [
    ]
}

Update an access policy

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

id
required
string

Policy ID (subjectId)

Request Body schema: application/json
required
roleIds
Array of strings
expiresAt
string
validFrom
string

Responses

Request samples

Content type
application/json
{ }

Response samples

Content type
application/json
{
  • "id": "string",
  • "subjectId": "string",
  • "scope": {
    },
  • "roles": [
    ]
}

Delete an access policy

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

id
required
string

Policy ID (subjectId)

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}

List access policies for a subject

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

subjectId
required
string

Subject ID

Responses

Response samples

Content type
application/json
{
  • "id": "string",
  • "subjectId": "string",
  • "scope": {
    },
  • "roles": [
    ]
}

Import access policies from CSV

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

Responses

Response samples

Content type
application/json
{
  • "created": 0,
  • "skipped": 0,
  • "errors": [
    ]
}

API Keys

Create an API key

Creates a new API key. The raw key is returned ONCE — store it securely.

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

Request Body schema: application/json
required
name
required
string
type
string
Enum: "management" "application"
expiresAt
string
object
permissions
Array of strings
roles
Array of strings
rateLimit
number
autoRotationEnabled
boolean
autoRotationIntervalDays
number
autoRotationOverlapDays
number

Responses

Request samples

Content type
application/json
{
  • "name": "string"
}

Response samples

Content type
application/json
{
  • "keyId": "string",
  • "type": "management",
  • "maskedKey": "string",
  • "createdAt": "string",
  • "subjectId": "string",
  • "name": "string",
  • "rawKey": "string"
}

List API keys in a scope

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

query Parameters
limit
number

Maximum items per page

nextToken
string

Pagination cursor

Responses

Response samples

Content type
application/json
{
  • "keyId": "string",
  • "type": "management",
  • "maskedKey": "string",
  • "createdAt": "string",
  • "subjectId": "string",
  • "name": "string"
}

Get an API key by ID

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

keyId
required
string

API key ID

Responses

Response samples

Content type
application/json
{
  • "keyId": "string",
  • "type": "management",
  • "maskedKey": "string",
  • "createdAt": "string",
  • "subjectId": "string",
  • "name": "string"
}

Delete an API key

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

keyId
required
string

API key ID

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}

Rotate an API key

Creates a new key and keeps the old key valid for a configurable overlap period.

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

keyId
required
string

API key ID

Request Body schema: application/json
required
overlapDays
number

Responses

Request samples

Content type
application/json
{ }

Response samples

Content type
application/json
{
  • "keyId": "string",
  • "maskedKey": "string",
  • "rawKey": "string",
  • "name": "string",
  • "oldKeyId": "string"
}

Reveal a rotated API key

Reveals the raw key from the most recent rotation within the overlap window.

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

keyId
required
string

API key ID

Responses

Response samples

Content type
application/json
{
  • "keyId": "string",
  • "apiKey": "string"
}

Configure auto-rotation for an API key

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

keyId
required
string

API key ID

Request Body schema: application/json
required
enabled
required
boolean
intervalDays
number
overlapDays
number

Responses

Request samples

Content type
application/json
{
  • "enabled": true
}

Response samples

Content type
application/json
{
  • "keyId": "string",
  • "type": "management",
  • "maskedKey": "string",
  • "createdAt": "string",
  • "subjectId": "string",
  • "name": "string"
}

Resource Types

Create a resource type

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

Request Body schema: application/json
required
id
required
string
name
required
string
description
string

Responses

Request samples

Content type
application/json
{
  • "id": "string",
  • "name": "string"
}

Response samples

Content type
application/json
{
  • "id": "string",
  • "scopeId": "string",
  • "name": "string",
  • "createdAt": "string"
}

List resource types in a scope

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

Responses

Response samples

Content type
application/json
{
  • "id": "string",
  • "scopeId": "string",
  • "name": "string",
  • "createdAt": "string"
}

Delete a resource type

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

resourceTypeId
required
string

Resource type ID

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}

Webhooks

Create a webhook endpoint

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

Request Body schema: application/json
required
id
string
url
required
string
events
required
Array of strings
active
boolean
name
string
description
string

Responses

Request samples

Content type
application/json
{
  • "url": "string",
  • "events": [
    ]
}

Response samples

Content type
application/json
{
  • "id": "string",
  • "scopeId": "string",
  • "url": "string",
  • "events": [
    ],
  • "active": true,
  • "createdAt": "string",
  • "secret": "string"
}

List webhook endpoints in a scope

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

Responses

Response samples

Content type
application/json
{
  • "id": "string",
  • "scopeId": "string",
  • "url": "string",
  • "events": [
    ],
  • "active": true,
  • "createdAt": "string"
}

Get a webhook endpoint by ID

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

endpointId
required
string

Endpoint ID

Responses

Response samples

Content type
application/json
{
  • "id": "string",
  • "scopeId": "string",
  • "url": "string",
  • "events": [
    ],
  • "active": true,
  • "createdAt": "string"
}

Update a webhook endpoint

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

endpointId
required
string

Endpoint ID

Request Body schema: application/json
required
url
string
events
Array of strings
active
boolean
name
string
description
string

Responses

Request samples

Content type
application/json
{ }

Response samples

Content type
application/json
{
  • "id": "string",
  • "scopeId": "string",
  • "url": "string",
  • "events": [
    ],
  • "active": true,
  • "createdAt": "string"
}

Delete a webhook endpoint

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

endpointId
required
string

Endpoint ID

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}

Rotate a webhook endpoint secret

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

endpointId
required
string

Endpoint ID

Responses

Response samples

Content type
application/json
{
  • "secret": "string"
}

Send a test delivery to a webhook endpoint

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

endpointId
required
string

Endpoint ID

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}

List deliveries for a webhook endpoint

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

endpointId
required
string

Endpoint ID

Responses

Response samples

Content type
application/json
{
  • "id": "string",
  • "endpointId": "string",
  • "scopeId": "string",
  • "url": "string",
  • "eventType": "string",
  • "success": true,
  • "httpStatus": "example",
  • "durationMs": 0,
  • "attempts": 0,
  • "deliveredAt": "string"
}

Retry a failed webhook delivery

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

endpointId
required
string

Endpoint ID

id
required
string

Delivery ID

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}

Access Evaluation

Evaluate access for a subject

Checks whether a subject has permission to perform an action on a resource.

Authorizations:
ApiKeyAuth
Request Body schema: application/json
required
subjectId
required
string
scopeId
required
string
resource
required
string
resourceId
string
action
required
string
object
includeReason
boolean

Responses

Request samples

Content type
application/json
{
  • "subjectId": "string",
  • "scopeId": "string",
  • "resource": "string",
  • "action": "string"
}

Response samples

Content type
application/json
{
  • "subjectId": "string",
  • "scopeId": "string",
  • "resource": "string",
  • "action": "string",
  • "allowed": true
}

Evaluate access for the authenticated API key

Checks whether the authenticated API key has permission to perform an action on a resource within the given scope. The subject is the key itself; scopeId is required and must be within the key hierarchy.

Authorizations:
ApiKeyAuth
Request Body schema: application/json
required
scopeId
required
string
resource
required
string
resourceId
string
action
required
string
object
includeReason
boolean

Responses

Request samples

Content type
application/json
{
  • "scopeId": "string",
  • "resource": "orders",
  • "action": "find-by-id"
}

Response samples

Content type
application/json
{
  • "subjectId": "string",
  • "scopeId": "string",
  • "resource": "string",
  • "action": "string",
  • "allowed": true
}

Evaluate multiple access checks

Authorizations:
ApiKeyAuth

Responses

Response samples

Content type
application/json
{
  • "subjectId": "string",
  • "scopeId": "string",
  • "resource": "string",
  • "action": "string",
  • "allowed": true
}

List permissions available to a subject

Authorizations:
ApiKeyAuth
Request Body schema: application/json
required
subjectId
required
string
scopeId
required
string

Responses

Request samples

Content type
application/json
{
  • "subjectId": "string",
  • "scopeId": "string"
}

Response samples

Content type
application/json
{
  • "permissions": [
    ]
}

List roles assigned to a subject

Authorizations:
ApiKeyAuth
Request Body schema: application/json
required
subjectId
required
string
scopeId
required
string

Responses

Request samples

Content type
application/json
{
  • "subjectId": "string",
  • "scopeId": "string"
}

Response samples

Content type
application/json
{
  • "roles": [
    ]
}

Simulate access with hypothetical permissions and roles

Authorizations:
ApiKeyAuth
Request Body schema: application/json
required
subjectId
required
string
scopeId
required
string
checks
required
Array of strings
permissions
required
Array of strings
roles
required
Array of strings
subjectRoleIds
required
Array of strings
includeReason
boolean

Responses

Request samples

Content type
application/json
{
  • "subjectId": "string",
  • "scopeId": "string",
  • "checks": [
    ],
  • "permissions": [
    ],
  • "roles": [
    ],
  • "subjectRoleIds": [
    ]
}

Response samples

Content type
application/json
{
  • "subjectId": "string",
  • "scopeId": "string",
  • "results": [
    ]
}

Audit

List audit events

Authorizations:
ApiKeyAuth
query Parameters
limit
number

Maximum items per page

nextToken
string

Pagination cursor

Responses

Response samples

Content type
application/json
{
  • "id": "string",
  • "eventType": "string",
  • "timestamp": "string",
  • "actor": "string",
  • "scopeId": "string",
  • "result": "string"
}

Export audit log

Authorizations:
ApiKeyAuth

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}

Verify audit log integrity

Authorizations:
ApiKeyAuth

Responses

Response samples

Content type
application/json
{
  • "total": 0,
  • "matched": 0,
  • "mismatchCount": 0,
  • "mismatches": [
    ]
}

Billing

Get current subscription

Authorizations:
ApiKeyAuth

Responses

Response samples

Content type
application/json
{
  • "tier": "free",
  • "tierName": "string",
  • "monthlyLimit": "example",
  • "currentMonthCount": 0,
  • "percentUsed": "example",
  • "notificationEmails": [
    ],
  • "alertThresholdPercent": 0,
  • "anomalyAlertsEnabled": true
}

Update subscription

Authorizations:
ApiKeyAuth
Request Body schema: application/json
required
notificationEmails
Array of strings
alertThresholdPercent
number
anomalyAlertsEnabled
boolean

Responses

Request samples

Content type
application/json
{ }

Response samples

Content type
application/json
{
  • "tier": "free",
  • "tierName": "string",
  • "monthlyLimit": "example",
  • "currentMonthCount": 0,
  • "percentUsed": "example",
  • "notificationEmails": [
    ],
  • "alertThresholdPercent": 0,
  • "anomalyAlertsEnabled": true
}

Create a Stripe checkout session

Authorizations:
ApiKeyAuth
Request Body schema: application/json
required
tier
required
string
Enum: "starter" "growth" "business" "scale"
interval
required
string
Enum: "monthly" "annual"
customerEmail
string
successUrl
required
string
cancelUrl
required
string

Responses

Request samples

Content type
application/json
{
  • "tier": "starter",
  • "interval": "monthly",
  • "successUrl": "string",
  • "cancelUrl": "string"
}

Response samples

Content type
application/json
{
  • "url": "string"
}

Create a Stripe customer portal session

Authorizations:
ApiKeyAuth

Responses

Response samples

Content type
application/json
{
  • "url": "string"
}

Get overage status

Authorizations:
ApiKeyAuth

Responses

Response samples

Content type
application/json
{
  • "tier": "free",
  • "tierName": "string",
  • "includedChecks": 0,
  • "currentMonthChecks": 0,
  • "overageChecks": 0,
  • "overageRatePerMillion": 0,
  • "estimatedOverageCharge": 0,
  • "isPaused": true,
  • "consentCount": 0,
  • "nextPauseAtPercent": 0,
  • "nextPauseAtChecks": 0,
  • "isHardPause": true
}

Grant consent for overage charges

Authorizations:
ApiKeyAuth
Request Body schema: application/json
required
ipAddress
string

Responses

Request samples

Content type
application/json
{ }

Response samples

Content type
application/json
{
  • "resumed": true,
  • "tier": "free",
  • "consentCount": 0,
  • "nextPauseAtPercent": 0,
  • "nextPauseAtChecks": 0
}

Dashboard

Get dashboard statistics for a scope

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

Responses

Response samples

Content type
application/json
{
  • "scopeName": "string",
  • "counts": {
    },
  • "usage": {
    },
  • "anomalies": [
    ],
  • "recentActivity": [
    ]
}

Get workspace usage statistics

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

Responses

Response samples

Content type
application/json
{
  • "items": [
    ],
  • "totalChecksToday": 0,
  • "totalGrantedToday": 0,
  • "totalDeniedToday": 0,
  • "totalChecksThisMonth": 0
}

Acknowledge an anomaly

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

anomalySk
required
string

Anomaly sort key

Responses

Response samples

Content type
application/json
{
  • "scopeId": "string",
  • "metric": "string",
  • "currentValue": 0,
  • "averageValue": 0,
  • "threshold": 0,
  • "flagged": true,
  • "period": "string"
}

SoD Constraints

Create a separation-of-duties constraint

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

Request Body schema: application/json
required
id
string
roleIdA
required
string
roleIdB
required
string
description
string

Responses

Request samples

Content type
application/json
{
  • "roleIdA": "string",
  • "roleIdB": "string"
}

Response samples

Content type
application/json
{
  • "id": "string",
  • "scopeId": "string",
  • "roleIdA": "string",
  • "roleIdB": "string"
}

List SoD constraints in a scope

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

Responses

Response samples

Content type
application/json
{
  • "id": "string",
  • "scopeId": "string",
  • "roleIdA": "string",
  • "roleIdB": "string"
}

Delete a SoD constraint

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

id
required
string

Constraint ID

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}

Session Tokens

Mint a session token for MCP use

Creates a short-lived JWT with embedded permission IDs for MCP agent authorization.

Authorizations:
ApiKeyAuth
Request Body schema: application/json
required
ttlSeconds
number
permissionIds
Array of strings
purpose
string

Responses

Request samples

Content type
application/json
{ }

Response samples

Content type
application/json
{
  • "token": "string",
  • "tokenType": "example",
  • "principalId": "string",
  • "scopeId": "string",
  • "jti": "string",
  • "issuedAt": 0,
  • "expiresAt": "string"
}

Revoke a session token

Authorizations:
ApiKeyAuth
path Parameters
jti
required
string

JWT ID (jti claim)

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}

Mint an intent-bound session token

Mints a short-lived intent-bound session token. The requested intent (integration + tools [+ instances]) must be fully within the issuer RBAC (fail-closed); the tamper-evident intentHash is bound into the signed token.

Authorizations:
ApiKeyAuth
Request Body schema: application/json
required
ttlSeconds
number
purpose
string
required
object

Responses

Request samples

Content type
application/json
{
  • "intent": {
    }
}

Response samples

Content type
application/json
{ }

Verify an intent-bound tool call

Per-call enforcement: verifies an agent session token against its bound intent and live RBAC for a specific tool [+ instance]. Returns an allow/deny decision.

Authorizations:
ApiKeyAuth
Request Body schema: application/json
required
token
required
string
tool
required
string
object

Responses

Request samples

Content type
application/json
{
  • "token": "string",
  • "tool": "string"
}

Response samples

Content type
application/json
{
  • "allowed": true,
  • "jti": "string",
  • "principalId": "string"
}

SSO

Create an SSO configuration

Authorizations:
ApiKeyAuth
path Parameters
orgId
required
string

Organization ID

Request Body schema: application/json
required
provider
required
string
Enum: "okta" "azure" "google"
protocol
required
string
Enum: "saml" "oidc"
metadataUrl
string
metadataXml
string
clientId
string
clientSecret
string
issuerUrl
string

Responses

Request samples

Content type
application/json
{
  • "provider": "okta",
  • "protocol": "saml"
}

Response samples

Content type
application/json
{
  • "orgId": "string",
  • "provider": "okta",
  • "protocol": "saml",
  • "cognitoIdpName": "string",
  • "status": "pending",
  • "ssoLoginUrl": "string"
}

List SSO configurations

Authorizations:
ApiKeyAuth
path Parameters
orgId
required
string

Organization ID

Responses

Response samples

Content type
application/json
{
  • "orgId": "string",
  • "provider": "okta",
  • "protocol": "saml",
  • "cognitoIdpName": "string",
  • "status": "pending",
  • "ssoLoginUrl": "string"
}

Get an SSO configuration

Authorizations:
ApiKeyAuth
path Parameters
orgId
required
string

Organization ID

idpId
required
string

Identity provider ID

Responses

Response samples

Content type
application/json
{
  • "orgId": "string",
  • "provider": "okta",
  • "protocol": "saml",
  • "cognitoIdpName": "string",
  • "status": "pending",
  • "ssoLoginUrl": "string"
}

Delete an SSO configuration

Authorizations:
ApiKeyAuth
path Parameters
orgId
required
string

Organization ID

idpId
required
string

Identity provider ID

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}

Update an SSO configuration

Authorizations:
ApiKeyAuth
path Parameters
orgId
required
string

Organization ID

idpId
required
string

Identity provider ID

Request Body schema: application/json
required
metadataUrl
string
metadataXml
string
clientId
string
clientSecret
string
issuerUrl
string

Responses

Request samples

Content type
application/json
{ }

Response samples

Content type
application/json
{
  • "orgId": "string",
  • "provider": "okta",
  • "protocol": "saml",
  • "cognitoIdpName": "string",
  • "status": "pending",
  • "ssoLoginUrl": "string"
}

Test an SSO connection

Authorizations:
ApiKeyAuth
path Parameters
orgId
required
string

Organization ID

idpId
required
string

Identity provider ID

Responses

Response samples

Content type
application/json
{
  • "success": true
}

Rotate SCIM bearer token

Generates a new SCIM v2 bearer token. The raw token is returned ONCE.

Authorizations:
ApiKeyAuth
path Parameters
orgId
required
string

Organization ID

Responses

Response samples

Content type
application/json
{
  • "token": "string",
  • "createdAt": "string"
}

Team Members

Add a team member to a scope

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

Request Body schema: application/json
required
subjectId
string
roleIds
required
Array of strings
email
string
name
string

Responses

Request samples

Content type
application/json
{
  • "roleIds": [
    ]
}

Response samples

Content type
application/json
{
  • "subjectId": "string",
  • "scopeId": "string",
  • "roleIds": [
    ],
  • "invitedBy": "string",
  • "createdAt": "string",
  • "status": "pending"
}

List team members in a scope

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

Responses

Response samples

Content type
application/json
{
  • "subjectId": "string",
  • "scopeId": "string",
  • "roleIds": [
    ],
  • "invitedBy": "string",
  • "createdAt": "string",
  • "status": "pending"
}

Remove a team member from a scope

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

subjectId
required
string

Subject ID

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}

Resend a pending invite email (at most 5 sends, 10 minutes apart)

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

subjectId
required
string

Subject ID

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}

Organization

Get organization details

Authorizations:
ApiKeyAuth

Responses

Response samples

Content type
application/json
{
  • "id": "string",
  • "name": "string",
  • "type": "organization"
}

Update organization details

Authorizations:
ApiKeyAuth
Request Body schema: application/json
required
name
string
description
string

Responses

Request samples

Content type
application/json
{ }

Response samples

Content type
application/json
{
  • "id": "string",
  • "name": "string",
  • "type": "organization"
}

Delete an organization

Authorizations:
ApiKeyAuth

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}

Get IP allowlist

Authorizations:
ApiKeyAuth
path Parameters
orgId
required
string

Organization ID

Responses

Response samples

Content type
application/json
{
  • "cidrs": [
    ]
}

Update IP allowlist

Authorizations:
ApiKeyAuth
path Parameters
orgId
required
string

Organization ID

Request Body schema: application/json
required
cidrs
required
Array of strings

Responses

Request samples

Content type
application/json
{
  • "cidrs": [
    ]
}

Response samples

Content type
application/json
{
  • "cidrs": [
    ]
}

Approval Requests

Create an approval request

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}

List approval requests in a scope

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}

Get an approval request

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

id
required
string

Approval request ID

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}

Approve an approval request

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

id
required
string

Approval request ID

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}

Deny an approval request

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

id
required
string

Approval request ID

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}

MCP Servers

Create an MCP server

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

Request Body schema: application/json
required
id
required
string
name
required
string
provider
required
string
status
string
Enum: "active" "disabled"
upstreamUrl
string
tools
Array of strings

Responses

Request samples

Content type
application/json
{
  • "id": "string",
  • "name": "string",
  • "provider": "string"
}

Response samples

Content type
application/json
{
  • "scopeId": "string",
  • "id": "string",
  • "name": "string",
  • "provider": "string",
  • "status": "active",
  • "createdAt": 0
}

List MCP servers in a scope

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

Responses

Response samples

Content type
application/json
{
  • "scopeId": "string",
  • "id": "string",
  • "name": "string",
  • "provider": "string",
  • "status": "active",
  • "createdAt": 0
}

Get an MCP server by ID

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

id
required
string

MCP server ID

Responses

Response samples

Content type
application/json
{
  • "scopeId": "string",
  • "id": "string",
  • "name": "string",
  • "provider": "string",
  • "status": "active",
  • "createdAt": 0
}

Delete an MCP server

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

id
required
string

MCP server ID

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}

Issue an MCP consent grant (bearer token)

Authorizations:
ApiKeyAuth
Request Body schema: application/json
required
servers
required
Array of strings
durationSeconds
number
authRequestId
string
scopeId
string

Responses

Request samples

Content type
application/json
{
  • "servers": [
    ]
}

Response samples

Content type
application/json
{
  • "status": "example",
  • "token": "string"
}

List MCP servers available for consent

Authorizations:
ApiKeyAuth

Responses

Response samples

Content type
application/json
[
  • "example"
]

Get consent context for a given request

Authorizations:
ApiKeyAuth
query Parameters
id
string

Auth request ID

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}

Deny an MCP consent request

Authorizations:
ApiKeyAuth

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}

Request MCP consent from a user

Authorizations:
ApiKeyAuth

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}

MCP Grants

List active MCP consent grants

Authorizations:
ApiKeyAuth

Responses

Response samples

Content type
application/json
[
  • "example"
]

Revoke an MCP consent grant

Authorizations:
ApiKeyAuth
path Parameters
grantId
required
string

Grant ID

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}

MCP Approvals

List pending HITL approvals

Authorizations:
ApiKeyAuth

Responses

Response samples

Content type
application/json
{
  • "approvals": [
    ]
}

List decided HITL approvals (history)

Authorizations:
ApiKeyAuth

Responses

Response samples

Content type
application/json
{
  • "approvals": [
    ]
}

Approve a pending HITL request

Authorizations:
ApiKeyAuth
path Parameters
id
required
string

Approval ID

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}

Deny a pending HITL request with optional reason

Authorizations:
ApiKeyAuth
path Parameters
id
required
string

Approval ID

Request Body schema: application/json
optional
reason
string

Responses

Request samples

Content type
application/json
{ }

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}

MCP Push

Get the VAPID public key for Web Push setup

Authorizations:
ApiKeyAuth

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}

Subscribe to Web Push notifications for HITL approvals

Authorizations:
ApiKeyAuth
Request Body schema: application/json
required
endpoint
required
string
required
object

Responses

Request samples

Content type
application/json
{
  • "endpoint": "string",
  • "keys": {
    }
}

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}

Unsubscribe from Web Push notifications

Authorizations:
ApiKeyAuth
Request Body schema: application/json
required
endpoint
required
string

Responses

Request samples

Content type
application/json
{
  • "endpoint": "string"
}

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}

MCP Assignments

List MCP server assignments for the caller

Authorizations:
ApiKeyAuth

Responses

Response samples

Content type
application/json
[
  • "example"
]

Set an MCP server assignment for a user

Authorizations:
ApiKeyAuth
Request Body schema: application/json
required
subjectId
required
string
serverKey
required
string
maxTier
required
string
Enum: "low" "medium" "high"
object

Responses

Request samples

Content type
application/json
{
  • "subjectId": "string",
  • "serverKey": "string",
  • "maxTier": "low"
}

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}

Delete an MCP server assignment

Authorizations:
ApiKeyAuth
path Parameters
scopeId
required
string

Scope ID

query Parameters
subjectId
string

Subject ID

serverKey
string

Server key

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}

MCP Velocity

Get MCP velocity policy configuration

Authorizations:
ApiKeyAuth

Responses

Response samples

Content type
application/json
{
  • "effective": {
    },
  • "overrides": "example"
}

Update MCP velocity policy configuration

Authorizations:
ApiKeyAuth
Request Body schema: application/json
required
enabled
required
boolean
perGrantPerMinute
required
number
perServerPerMinute
required
number
perToolPerMinute
required
number

Responses

Request samples

Content type
application/json
{
  • "enabled": true,
  • "perGrantPerMinute": 0,
  • "perServerPerMinute": 0,
  • "perToolPerMinute": 0
}

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}

MCP Tools

List available MCP tools for a server

Authorizations:
ApiKeyAuth
query Parameters
serverKey
string

Server key

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}

MCP OAuth

MCP OAuth callback endpoint

Authorizations:
ApiKeyAuth
query Parameters
code
required
string
state
required
string

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "message": "string",
  • "statusCode": 0,
  • "field": "string"
}