components: schemas: ApplicationAvailableResponse: additionalProperties: false properties: displayName: examples: - Midaz type: string name: examples: - midaz type: string required: - name - displayName type: object ApplicationInput: additionalProperties: false properties: description: examples: - Identity Used By BR Sisbajud type: string name: examples: - midaz type: string nature: description: Optional. bancarizador, the only accepted value, puts the top-level claim nature=bancarizador, which the consignado gateway requires, on every token this credential issues; it cannot be combined with partnerId, an empty string is treated as absent, and any other value is refused with 400. examples: - "" type: string partnerId: examples: - 00000000-0000-0000-0000-000000000000 type: string source: description: "Refused in both modes: multi-tenant answers 400 IDE-1063, single-tenant answers 400 IDE-1064 (service credentials are issued through POST /v1/applications/service-credentials)." type: string target: examples: - plugin-identity type: string required: - description type: object ApplicationResponse: additionalProperties: false properties: clientId: type: string clientSecret: description: Returned only by the create call. Absent from every Identity API read. type: string createdAt: examples: - "2021-09-01T00:00:00Z" type: string description: examples: - Midaz Used By Application X type: string id: examples: - 00000000-0000-0000-0000-000000000000 type: string name: examples: - Midaz type: string partnerId: examples: - 00000000-0000-0000-0000-000000000000 type: string type: object AssignGroupsInput: additionalProperties: false properties: groups: description: Group identifiers. items: type: string minItems: 1 type: array required: - groups type: object AssignPermissionsInput: additionalProperties: false properties: permissions: description: Permission identifiers. items: type: string minItems: 1 type: array required: - permissions type: object AssignUsersInput: additionalProperties: false properties: users: description: User identifiers. items: type: string minItems: 1 type: array required: - users type: object DeclarationDimension: additionalProperties: false properties: collection: description: The resource this dimension's own siblings live in. A partner scoped on this dimension may not list or create in it. examples: - ledgers type: string covers: description: Further resources whose items each belong to ONE value of this dimension. A partner scoped on this dimension may not address them without naming its value — that would reach its siblings' items. Must not repeat an entry or name the dimension's own collection. examples: - - balances - operations items: type: string type: - array - "null" explicit: description: "A partner reaches this dimension's collection only through ids its scope names: a scoped partner that names none for it is refused on the collection, instead of reaching every item. For a collection the product looks up by the item's own id alone, so no ancestor dimension of the request confines it. Requires a collection and excludes required." examples: - true type: boolean from: description: "Where the product reads the value from on its own route: a path parameter, a query key, a header, or an application/x-www-form-urlencoded field." enum: - path - query - header - form examples: - path type: string label: description: Human name used in refusal messages. examples: - ledger type: string multi: description: A partner scope line for this dimension may carry more than one value. examples: - true type: boolean name: description: Attribute key the product sends on an authorize call and the value of field on a partner scope line. Compared by exact equality. examples: - ledgerId type: string param: description: "Name of what the value is read from: the path parameter (from path), the query key (from query), the header, compared case-insensitively (from header), or the form field (from form). Two dimensions may not read the same one." examples: - ledger_id type: string parent: description: Name of the dimension whose instances hold this one's (a ledgerId dimension's parent is organizationId), declaring the hierarchy the order of the list does not. Must name another declared dimension, and following parents from any dimension must end at a dimension without one. Absent for a top-level dimension. examples: - organizationId type: string required: description: Every partner granted this product must scope this dimension. examples: - false type: boolean type: object DeclarationGrant: additionalProperties: false properties: group: description: Existing group whose members receive the role. examples: - fees-admins type: string type: object DeclarationLevel: additionalProperties: false properties: action: description: Action of the permission. examples: - update type: string level: description: tenant, or the name of a dimension of this manifest's scope, spelled exactly. examples: - organizationId type: string resource: description: Resource the permission applies to, written bare. examples: - ledgers type: string type: object DeclarationM2M: additionalProperties: false properties: exposed: description: When true, this plugin is callable as an M2M target. examples: - true type: boolean needs: description: Manifest services of the products this plugin calls via M2M tokens (e.g. midaz). Entries must be non-empty, unique, different from service and contain no wildcard, compared trimmed and case-insensitively. examples: - - midaz items: type: string type: - array - "null" party_roles: description: Declared roles a party robot (a fund or an originator calling through the product) assumes; a product that declares none admits none. Requires exposed when non-empty. examples: - - operator items: type: string type: - array - "null" roles: description: "Declared roles an M2M caller of this service assumes. Requires exposed when non-empty. Absent: every declared role except m2m.service_roles is assumable. A group-less partner role never is. []: none." examples: - - editor items: type: string type: - array - "null" service_roles: description: Declared roles an internal service caller assumes; never assumable by a client M2M credential. A role named service-{caller} is held by that caller's service credential alone; the others by every caller that has no such role. Requires exposed when non-empty. Each must bind no group, must not be in m2m.roles or m2m.party_roles, and must not be editor or editor-role. examples: - - lender-m2m-role items: type: string type: - array - "null" type: object DeclarationManifest: additionalProperties: false properties: integrations: description: Lerian services this product calls while serving a request (e.g. midaz). A partner's request this product relays to one of them is also decided there by the partner's own rules for that service, so the Console offers to set those rules when the partner is granted this product. Forwarded with the scope catalog; alone it is a scope-only body. Entries must be non-empty, unique, different from service and contain no wildcard, compared trimmed and case-insensitively. examples: - - midaz items: type: string type: - array - "null" levels: description: "Scope-only form of the permissions' levels: one entry per permission that declares a level, sent when the permission section is not. Forwarded with the scope catalog. Not accepted next to permissions, which carry their level themselves; alone it is not a section, since it would replace the catalog's dimensions and opt-in with nothing." items: $ref: "#/components/schemas/DeclarationLevel" type: - array - "null" m2m: $ref: "#/components/schemas/DeclarationM2M" description: "Bilateral machine-to-machine contract: which targets this plugin calls and whether it is callable." partners: description: "Opts the product in to partner credentials: a partner can be granted this product only when it is true. Forwarded with the scope catalog; a body carrying only this member is a scope-only body. Replaces the opt-in whenever the catalog is replaced." examples: - true type: boolean permissions: description: Permissions declared by the plugin; one entry per (resource, action). items: $ref: "#/components/schemas/DeclarationPermission" type: - array - "null" roles: description: Roles declared by the plugin. Names may use '/' for hierarchy but must not repeat the service prefix (it is added automatically). items: $ref: "#/components/schemas/DeclarationRole" type: - array - "null" scope: $ref: "#/components/schemas/DeclarationScope" description: Dimensions the product's routes address instances by — the WHERE a partner's scope lines name. Replaces the product's catalog when present. Accepted in single- and multi-tenant deployments. service: description: Service that owns this declaration; matches the caller token (the plugin- prefix is kept). examples: - plugin-fees type: string version: description: Advisory manifest version. Must be a positive integer. Excluded from the canonical content hash. examples: - 3 format: int64 type: integer type: object DeclarationPermission: additionalProperties: false properties: action: description: Semantic action (create/read/update/delete or a domain verb). examples: - create type: string effect: description: "Permission effect. Must be allow." examples: - allow type: string level: description: "How wide one instance of the resource is: tenant, or the name of a dimension of this manifest's scope, spelled exactly. Partners are not granted a write on a resource wider than their scope." examples: - organizationId type: string resource: description: Resource the permission applies to, written bare (the service prefix is composed centrally). examples: - billing-packages type: string roles: description: Bare role names (each matching a declared role name) this permission grants to. examples: - - editor items: type: string type: - array - "null" type: object DeclarationResponseBody: additionalProperties: false properties: slug: description: Slug of the declaration that was upserted. examples: - plugin-fees type: string status: description: Outcome of the upsert operation. examples: - accepted type: string required: - slug - status type: object DeclarationRole: additionalProperties: false properties: granted_to: description: Existing groups whose members receive this role. Group names must not contain '/'. items: $ref: "#/components/schemas/DeclarationGrant" type: - array - "null" name: description: Bare role name; '/' denotes hierarchy. Must not repeat the service prefix (it is added automatically). examples: - editor type: string type: object DeclarationScope: additionalProperties: false properties: dimensions: description: "Dimensions in tree order: the first is the top of the funnel (e.g. the organization) and every later one narrows inside the previous (e.g. a ledger inside it). An empty list declares that the product addresses no instance." items: $ref: "#/components/schemas/DeclarationDimension" type: - array - "null" type: object DefaultTenantInput: additionalProperties: false properties: tenantId: examples: - acme-b type: string required: - tenantId type: object Detail: additionalProperties: true properties: code: description: "Stable, machine-readable domain error code scoped to the emitting service (format: -NNNN)." type: string detail: description: A human-readable explanation specific to this occurrence of the problem. examples: - Property foo is required but is missing. type: string errors: description: Optional list of individual error details items: $ref: "#/components/schemas/ErrorDetail" type: - array - "null" instance: description: A URI reference that identifies the specific occurrence of the problem. examples: - https://example.com/error-log/abc123 format: uri type: string status: description: HTTP status code examples: - 400 format: int64 type: integer title: description: A short, human-readable summary of the problem type. This value should not change between occurrences of the error. examples: - Bad Request type: string type: default: about:blank description: A URI reference to human-readable documentation for the error. examples: - https://example.com/errors/example format: uri type: string upstream: $ref: "#/components/schemas/Upstream" description: "RFC 9457 extension member: the error a proxied third-party provider reported. Absent unless the emitting service explicitly surfaced one." type: object EffectivePermissionResponse: additionalProperties: false properties: actions: items: type: string type: array effect: examples: - allow type: string id: examples: - midaz-editor-permission type: string isEnabled: examples: - true type: boolean name: examples: - Midaz Editor Permission type: string resources: items: type: string type: array sources: items: $ref: "#/components/schemas/PermissionSource" type: array type: object ErrorDetail: additionalProperties: false properties: location: description: Where the error occurred, e.g. 'body.items[3].tags' or 'path.thing-id' type: string message: description: Error message text type: string value: description: The value at the given location type: object ForgotPasswordResetInput: additionalProperties: false properties: code: examples: - "123456" type: string email: examples: - user@acme.com type: string newPassword: examples: - newPassw0rd! type: string required: - email - code - newPassword type: object ForgotPasswordSendCodeInput: additionalProperties: false properties: email: examples: - user@acme.com type: string required: - email type: object GroupFullResponse: additionalProperties: false properties: contactEmail: examples: - admin@example.com type: string createdAt: examples: - "2026-01-01T00:00:00Z" type: string id: examples: - my-group type: string isEnabled: examples: - true type: boolean isTopGroup: examples: - false type: boolean manager: examples: - admin type: string name: examples: - My Group type: string parentId: examples: - parent-group type: string type: examples: - custom type: string updatedAt: examples: - "2026-06-24T10:00:00Z" type: string users: examples: - - user1 - user2 items: type: string type: array type: object GroupInput: additionalProperties: false properties: contactEmail: examples: - team@example.com type: string displayName: examples: - Custom Group type: string name: examples: - custom-group type: string required: - name - displayName type: object GroupPagination: additionalProperties: false properties: items: description: The page of groups. items: $ref: "#/components/schemas/GroupFullResponse" type: array limit: description: The page size that was applied. examples: - 10 format: int64 type: integer page: description: The 1-based page this response corresponds to. examples: - 1 format: int64 type: integer total: description: Total number of groups, across all pages. examples: - 10 format: int64 type: integer type: object GroupUpdateInput: additionalProperties: false properties: contactEmail: examples: - updated@example.com type: string displayName: examples: - Updated Group type: string isEnabled: examples: - true type: boolean type: object HTTPError: additionalProperties: false properties: code: type: string entityType: type: string err: {} message: type: string title: type: string type: object IPAllowlistEntry: additionalProperties: false properties: cidr: description: Network in CIDR form, or a bare IPv4/IPv6 address which is widened to a host route (/32, /128) on persist. Malformed entries are refused with IDE-0036; the same cidr twice with IDE-1050. examples: - 203.0.113.0/24 type: string description: description: Free-text label for this entry, shown to operators. Never influences an access decision; bounded only by length. examples: - Loja do Zé — SP datacenter type: string required: - cidr type: object IPAllowlistInput: additionalProperties: false properties: entries: items: description: "One allowlist entry: a bare IP address or CIDR block (the original form), or a labeled {cidr, description} object. A bare string is stored with an empty description." oneOf: - description: An IP address or CIDR block. Bare addresses are widened to /32 or /128. examples: - 203.0.113.0/24 type: string - additionalProperties: false properties: cidr: description: Required. An IP address or CIDR block. Bare addresses are widened to /32 or /128. A missing, blank or malformed cidr is refused with IDE-0036. examples: - 203.0.113.0/24 type: string description: description: Free-text label shown to administrators, e.g. which office or datacenter the network belongs to. Never influences an access decision. examples: - São Paulo office type: string type: object type: array scopes: examples: - - console - api items: type: string type: - array - "null" required: - entries type: object IPAllowlistLabeledEntry: additionalProperties: false properties: cidr: description: Canonical CIDR block, exactly as listed in entries. examples: - 203.0.113.0/24 type: string description: description: Free-text label shown to administrators; empty when none was given. Never influences an access decision. examples: - São Paulo office type: string required: - cidr - description type: object IPAllowlistResponse: additionalProperties: false properties: entries: examples: - - 203.0.113.0/24 - 198.51.100.7 items: type: string type: array labeledEntries: description: The same allowlist as entries, in the same order and with the same CIDRs, each paired with the description an administrator gave it. The description is empty for an entry saved as a bare string or stored before descriptions existed. entries keeps its current shape and stays available; it will be retired later in favor of this member. The description is display text only and never influences an access decision. items: $ref: "#/components/schemas/IPAllowlistLabeledEntry" type: array scopes: examples: - - console - api items: type: string type: array required: - entries - scopes - labeledEntries type: object MFAAdminEnableInput: additionalProperties: false properties: mfaType: examples: - email type: string required: - mfaType type: object MFADisableInput: additionalProperties: false properties: code: examples: - "123456" type: string required: - code type: object MFAEnableInput: additionalProperties: false properties: mfaType: examples: - app type: string recoveryCode: type: string secret: examples: - JBSWY3DPEHPK3PXP type: string required: - recoveryCode - mfaType type: object MFAPreferredInput: additionalProperties: false properties: mfaType: examples: - app type: string secret: type: string required: - mfaType type: object MFARecoveryCodesResponse: additionalProperties: false properties: recoveryCodes: items: type: string type: array type: object MFASetupInput: additionalProperties: false properties: mfaType: examples: - app type: string required: - mfaType type: object MFASetupResponse: additionalProperties: false properties: enabled: type: boolean mfaType: examples: - app type: string recoveryCodes: items: type: string type: array secret: examples: - JBSWY3DPEHPK3PXP type: string url: examples: - otpauth://totp/... type: string type: object MFAStatusResponse: additionalProperties: false properties: emailEnabled: examples: - false type: boolean enabled: examples: - true type: boolean methods: examples: - - app - email items: type: string type: array preferredType: examples: - app type: string totpEnabled: examples: - true type: boolean type: object MFAVerifyInput: additionalProperties: false properties: mfaType: examples: - app type: string passcode: examples: - "123456" type: string secret: examples: - JBSWY3DPEHPK3PXP type: string required: - passcode - mfaType type: object OwnProfileResponse: additionalProperties: false properties: countryCode: examples: - BR type: string email: examples: - john@example.com type: string firstName: examples: - John type: string id: examples: - 123e4567-e89b-12d3-a456-426614174000 type: string lastName: examples: - Doe type: string phone: examples: - "+5511998888777" type: string username: examples: - johndoe type: string type: object PartnerCeiling: additionalProperties: false properties: grants: description: "A (resource, action) can be granted to a partner only when ONE entry holds both; head is granted together with get inside the entry that holds get. Empty when the role holds nothing in the product: no partner can then be granted anything in it." items: $ref: "#/components/schemas/PartnerCeilingGrant" type: - array - "null" product: description: Product slug the ceiling is for. examples: - tracer type: string required: - product - grants type: object PartnerCeilingGrant: additionalProperties: false properties: actions: description: Verbs this permission holds on every one of those collections. examples: - - get - post items: type: string type: - array - "null" resources: description: Collections this permission holds, as the product names them. examples: - - validations items: type: string type: - array - "null" required: - resources - actions type: object PartnerInput: additionalProperties: false properties: displayName: description: "Human-readable name for the partner, unique within the organization (a duplicate is refused with IDE-1040). This is NOT the id: the id is a server-generated UUID returned in the response." examples: - Loja do Zé minLength: 1 type: string ipAllowlist: description: The partner's own IP allowlist. Omit it or send null to inherit the organization's list — for a partner "no list" means INHERIT, never "allow everything". An empty array is refused (IDE-1048). items: $ref: "#/components/schemas/IPAllowlistEntry" type: - array - "null" permissions: description: What the partner may do, per product. A product with no entry here is unreachable by the partner, whatever its scope says. items: $ref: "#/components/schemas/PartnerPermission" type: - array - "null" scope: description: Where the partner may do it, per product and dimension. Optional as a whole; when a product's published scope catalog marks a dimension required, the entry for that dimension is mandatory. items: $ref: "#/components/schemas/PartnerScope" type: - array - "null" validFrom: description: RFC 3339 instant before which the partner's credentials are not honoured. Absent means "valid immediately". examples: - "2026-01-01T00:00:00Z" format: date-time type: string validUntil: description: RFC 3339 instant after which the partner's credentials stop being honoured (the authorize call answers authorized=false with reason "expired", which the calling product turns into 401). Absent means "no end date". Must be later than validFrom, else IDE-1045. examples: - "2027-01-01T00:00:00Z" format: date-time type: string required: - displayName - permissions type: object PartnerPagination: additionalProperties: false properties: items: description: The page of partners, newest first. items: $ref: "#/components/schemas/PartnerResponse" type: - array - "null" limit: description: The page size that was applied. examples: - 10 format: int64 type: integer page: description: The 1-based page this response corresponds to. examples: - 1 format: int64 type: integer total: description: Total number of partners in the organization, across all pages. examples: - 42 format: int64 type: integer required: - items - limit - total type: object PartnerPermission: additionalProperties: false properties: actions: description: Verbs the partner may use on those collections, lowercase ("get", "post", "patch", "delete"). "head" is granted together with "get". Each resource/action pair must be held by one permission of your organization's editor role in the product, else IDE-1043. "*" is refused (IDE-1047). examples: - - get - post items: type: string type: - array - "null" product: description: Product slug these permissions apply to, as returned by GET /v1/applications/available. Matched by exact equality. examples: - midaz type: string resources: description: Collections the partner may reach in this product, named exactly as the product declares them ("accounts", "transactions"). Each resource/action pair must be held by one permission of your organization's editor role in the product, else IDE-1043. "*" is refused (IDE-1047). examples: - - accounts - balances items: type: string type: - array - "null" required: - product - resources - actions type: object PartnerResponse: additionalProperties: false properties: applicationsCount: description: How many M2M applications are currently attached to this partner. A non-zero value is what makes DELETE answer 409 (IDE-1049). examples: - 2 format: int64 type: integer createdAt: description: When the partner was created (RFC 3339). examples: - "2026-01-15T09:30:00Z" type: string displayName: description: Human-readable name, unique within the organization. examples: - Loja do Zé type: string id: description: Server-generated identifier of the partner (UUID). This is the value to pass as partnerId when creating an application. examples: - 00000000-0000-0000-0000-000000000000 type: string ipAllowlist: description: "The partner's own IP allowlist, or null when it inherits the organization's list. Null and an empty list are NOT the same thing here: null is inheritance, and an empty own list cannot be stored." items: $ref: "#/components/schemas/IPAllowlistEntry" type: - array - "null" permissions: description: What the partner may do, per product. items: $ref: "#/components/schemas/PartnerPermission" type: - array - "null" scope: description: Where the partner may do it, per product and dimension. items: $ref: "#/components/schemas/PartnerScope" type: - array - "null" state: description: "Whether the partner's credentials are honoured. Note this never reads \"expired\": expiry is derived from validUntil at decision time, so a closed window shows here as \"active\" with a past validUntil." enum: - active - suspended examples: - active type: string updatedAt: description: When it was last modified (RFC 3339). examples: - "2026-01-15T09:30:00Z" type: string validFrom: description: Start of the validity window (RFC 3339), or null when it is open-ended. examples: - "2026-01-01T00:00:00Z" format: date-time type: - string - "null" validUntil: description: End of the validity window (RFC 3339), or null when it is open-ended. examples: - "2027-01-01T00:00:00Z" format: date-time type: - string - "null" required: - id - displayName - state - permissions - scope - ipAllowlist - validFrom - validUntil - applicationsCount - createdAt - updatedAt type: object PartnerScope: additionalProperties: false properties: field: description: Dimension being scoped, as the product's published scope catalog names it (GET /v1/scope-catalog/{product}). A field the catalog does not declare is refused with IDE-1042; a required dimension left out with IDE-0001; several values on a single-valued dimension with IDE-0002. examples: - ledgerId type: string product: description: Product slug this scope applies to. Must also appear in permissions, else IDE-1044. examples: - midaz type: string values: description: "Instance identifiers for this dimension, compared after trimming: a canonical UUID case-insensitively, any other value (such as an account alias) exactly. Neither format nor existence inside the product is checked, so supply values the product's own list API returned." examples: - - 00000000-0000-0000-0000-000000000000 items: type: string type: - array - "null" required: - product - field - values type: object PartnerUpdateInput: additionalProperties: false properties: displayName: description: New human-readable name. Still unique within the organization (IDE-1040). examples: - Loja do Zé Matriz minLength: 1 type: string ipAllowlist: description: Omit to leave the list untouched, send null to go back to inheriting the organization's list, send entries to replace it. An empty array is refused (IDE-1048). items: $ref: "#/components/schemas/IPAllowlistEntry" type: - array - "null" permissions: description: Replaces the whole permissions list when supplied. items: $ref: "#/components/schemas/PartnerPermission" type: array scope: description: Replaces the whole scope list when supplied. items: $ref: "#/components/schemas/PartnerScope" type: array state: description: Suspend or reactivate the partner. Takes effect on the next authorization decision, including for access tokens already issued, and on the next token issuance. enum: - active - suspended examples: - suspended type: string validFrom: description: "New window start (RFC 3339). Omit to keep the stored start; send null to remove it, so the partner's credentials are honoured from now on; an empty string is refused (422). The resulting window is checked against the stored validUntil when that is not sent: validUntil must stay later than validFrom, else 400 IDE-1045." examples: - "2026-01-01T00:00:00Z" format: date-time type: - string - "null" validUntil: description: New window end (RFC 3339). Omit to keep the stored end; send null to remove it, so the window has no end date and a partner already past its end date is honoured again (unless suspended); an empty string is refused (422). Must be later than validFrom — the one sent, or the stored one when validFrom is not sent — else 400 IDE-1045. examples: - "2027-01-01T00:00:00Z" format: date-time type: - string - "null" type: object PasskeyEnrollBeginResponse: additionalProperties: false properties: enrollmentToken: description: Names this enrollment. Send it back to POST /v1/users/{id}/passkeys/finish within 5 minutes; it works once. examples: - Zm9vYmFyLWVucm9sbG1lbnQtdG9rZW4tZXhhbXBsZQ type: string options: description: The WebAuthn creation options (publicKey) to pass to navigator.credentials.create, exactly as the identity provider wrote them. required: - enrollmentToken - options type: object PasskeyEnrollFinishInput: additionalProperties: false properties: credential: description: The PublicKeyCredential navigator.credentials.create returned, serialized as JSON (PublicKeyCredential.toJSON()). enrollmentToken: description: The enrollmentToken POST /v1/users/{id}/passkeys/begin answered. examples: - Zm9vYmFyLWVucm9sbG1lbnQtdG9rZW4tZXhhbXBsZQ type: string required: - enrollmentToken - credential type: object PasskeyEnrollFinishResponse: additionalProperties: false properties: registered: description: True when the passkey was added. examples: - true type: boolean required: - registered type: object PasskeyPolicyInput: additionalProperties: false properties: enabled: description: True offers passkey sign-in to the organization; false stops offering it. Existing passkeys stay stored either way. examples: - true type: boolean required: - enabled type: object PasskeyPolicyResponse: additionalProperties: false properties: enabled: description: True when the organization offers passkey sign-in. While it is true, a person who has a passkey cannot sign in with a password. examples: - true type: boolean ssoActive: description: True when the organization signs in through an SSO provider. Passkeys cannot be turned on while it is true. examples: - false type: boolean type: object PasskeyRemoveResponse: additionalProperties: false properties: removed: description: True when a passkey existed and was removed; false when there was none. examples: - true type: boolean required: - removed type: object PasskeyStatusResponse: additionalProperties: false properties: enabled: description: True when the organization offers passkey sign-in. While it is false a passkey cannot be added, but an existing one can be removed. examples: - true type: boolean registered: description: True when the account has a passkey. examples: - true type: boolean transports: description: How the browser reaches the passkey's authenticator (for example internal, hybrid, usb), as the authenticator reported it. Absent when there is no passkey or the authenticator reported none. examples: - - internal - hybrid items: type: string type: - array - "null" required: - registered - enabled type: object PermissionPagination: additionalProperties: false properties: items: description: The page of permissions. items: $ref: "#/components/schemas/PermissionResponse" type: array limit: description: The page size that was applied. examples: - 10 format: int64 type: integer page: description: The 1-based page this response corresponds to. examples: - 1 format: int64 type: integer total: description: Total number of permissions, across all pages. examples: - 10 format: int64 type: integer type: object PermissionResponse: additionalProperties: false properties: actions: items: type: string type: array effect: examples: - allow type: string groups: items: type: string type: array id: examples: - midaz-editor-permission type: string isEnabled: examples: - true type: boolean name: examples: - Midaz Editor Permission type: string resources: items: type: string type: array roles: items: type: string type: array users: items: type: string type: array type: object PermissionSource: additionalProperties: false properties: groupId: examples: - engineering type: string groupName: examples: - Engineering type: string roleId: examples: - midaz-editor type: string roleName: examples: - Midaz Editor type: string type: examples: - role type: string type: object ProviderInput: additionalProperties: false properties: appId: type: string category: enum: - Email - SMS - OAuth type: string clientId: examples: - noreply@example.com type: string clientId2: type: string clientSecret: type: string clientSecret2: type: string content: type: string customAuthUrl: type: string customTokenUrl: type: string customUserInfoUrl: type: string disableSsl: type: boolean domain: type: string endpoint: type: string host: type: string intranetEndpoint: type: string issuerUrl: type: string method: type: string name: type: string port: format: int64 type: integer receiver: type: string regionId: type: string scopes: type: string signName: type: string subType: type: string templateCode: type: string title: type: string type: enum: - SendGrid - Twilio SMS - Twilio - Google - Microsoft - Okta - Custom type: string required: - name - category - type type: object ProviderItemInput: additionalProperties: false properties: alertType: type: string canSignIn: type: boolean canSignUp: type: boolean canUnlink: type: boolean prompted: type: boolean providerId: type: string rule: type: string required: - providerId type: object ProviderItemResponse: additionalProperties: false properties: alertType: type: string canSignIn: type: boolean canSignUp: type: boolean canUnlink: type: boolean category: type: string prompted: type: boolean providerId: type: string rule: type: string type: type: string type: object ProviderItemUpdateInput: additionalProperties: false properties: alertType: type: string canSignIn: type: boolean canSignUp: type: boolean canUnlink: type: boolean prompted: type: boolean rule: type: string type: object ProviderPagination: additionalProperties: false properties: items: description: The page of providers. items: $ref: "#/components/schemas/ProviderResponse" type: array limit: description: The page size that was applied. examples: - 10 format: int64 type: integer page: description: The 1-based page this response corresponds to. examples: - 1 format: int64 type: integer total: description: Total number of providers, across all pages. examples: - 10 format: int64 type: integer type: object ProviderResponse: additionalProperties: false properties: appId: type: string category: enum: - Email - SMS - OAuth examples: - Email type: string clientId: type: string clientId2: type: string content: type: string createdAt: examples: - "2021-09-01T00:00:00Z" type: string customAuthUrl: type: string customTokenUrl: type: string customUserInfoUrl: type: string disableSsl: type: boolean domain: type: string endpoint: type: string host: type: string id: examples: - 00000000-0000-0000-0000-000000000000 type: string intranetEndpoint: type: string issuerUrl: type: string method: type: string name: examples: - SMTP Corp type: string port: format: int64 type: integer providerUrl: type: string receiver: type: string regionId: type: string scopes: type: string signName: type: string subType: type: string templateCode: type: string title: type: string type: enum: - SendGrid - Twilio SMS - Twilio - Google - Microsoft - Okta - Custom examples: - SendGrid type: string type: object ProviderTestSendInput: additionalProperties: false properties: email: type: string phone: type: string type: object ProviderTestSendResponse: additionalProperties: false properties: category: enum: - Email - SMS examples: - SMS type: string delivered: examples: - true type: boolean providerId: examples: - 00000000-0000-0000-0000-000000000000 type: string type: object ProviderUpdateInput: additionalProperties: false properties: appId: type: string clientId: type: string clientId2: type: string clientSecret: type: string clientSecret2: type: string content: type: string customAuthUrl: type: string customTokenUrl: type: string customUserInfoUrl: type: string disableSsl: type: boolean domain: type: string endpoint: type: string host: type: string intranetEndpoint: type: string issuerUrl: type: string method: type: string name: type: string port: format: int64 type: integer receiver: type: string regionId: type: string scopes: type: string signName: type: string subType: type: string templateCode: type: string title: type: string type: object RoleInput: additionalProperties: false properties: description: examples: - A custom editor role type: string displayName: examples: - Custom Editor type: string name: examples: - custom-editor type: string required: - name - displayName type: object RolePagination: additionalProperties: false properties: items: description: The page of roles. items: $ref: "#/components/schemas/RoleResponse" type: array limit: description: The page size that was applied. examples: - 10 format: int64 type: integer page: description: The 1-based page this response corresponds to. examples: - 1 format: int64 type: integer total: description: Total number of roles, across all pages. examples: - 10 format: int64 type: integer type: object RoleResponse: additionalProperties: false properties: createdAt: examples: - "2026-06-24T10:00:00Z" type: string description: examples: - A custom editor role type: string groups: items: type: string type: array id: examples: - custom-editor type: string isEnabled: examples: - true type: boolean isSystem: examples: - false type: boolean name: examples: - Custom Editor type: string roles: items: type: string type: array users: items: type: string type: array type: object RoleUpdateInput: additionalProperties: false properties: description: examples: - An updated description type: string displayName: examples: - Updated Editor type: string isEnabled: examples: - true type: boolean type: object SSOPolicyInput: additionalProperties: false properties: allowLocalPassword: examples: - true type: boolean type: object SSOPolicyResponse: additionalProperties: false properties: allowLocalPassword: examples: - true type: boolean type: object SSOProviderConfigInput: additionalProperties: false properties: clientId: type: string clientSecret: type: string customAuthUrl: type: string customTokenUrl: type: string customUserInfoUrl: type: string disablePasswordLogin: examples: - true type: boolean domain: examples: - https://your-org.okta.com type: string entraTenantId: examples: - 3f2a6b1c-8d4e-4f5a-9b6c-7d8e9f0a1b2c type: string issuerUrl: type: string name: type: string scopes: type: string type: examples: - Google type: string required: - type - clientId - clientSecret type: object SSOProviderConfigResponse: additionalProperties: false properties: configured: type: boolean passwordEnabled: type: boolean provider: $ref: "#/components/schemas/ProviderResponse" type: object SSOProviderPreflight: additionalProperties: false properties: authorizationEndpoint: examples: - https://accounts.google.com/o/oauth2/v2/auth type: string configValid: type: boolean credentialsValid: type: boolean discoveryOk: type: boolean redirectUriAcceptedByIdp: type: boolean tokenEndpoint: examples: - https://oauth2.googleapis.com/token type: string userinfoEndpoint: examples: - https://openidconnect.googleapis.com/v1/userinfo type: string type: object ScopeCatalog: additionalProperties: false properties: dimensions: description: "Dimensions in tree order: the first is the top of the funnel and every later one narrows inside the previous. A partner scope line's field must be one of these names." items: $ref: "#/components/schemas/ScopeDimension" type: - array - "null" integrations: description: Lerian services this product calls while serving a request (e.g. midaz). A partner granted this product reaches them through it, and each of them also applies the partner's own rules for that service when the partner has any. Absent when the product declares none. examples: - - midaz items: type: string type: - array - "null" levels: description: How wide one instance of each leveled resource is, per (resource, action). A partner is not granted a write on a resource wider than its scope. Absent when the product declares no level. items: $ref: "#/components/schemas/ScopeLevel" type: - array - "null" partners: description: Whether the product accepts partner credentials. A partner can be granted the product only when true. examples: - true type: boolean product: description: Product slug, as returned by GET /v1/applications/available. examples: - midaz type: string required: - product - dimensions - partners type: object ScopeCatalogList: additionalProperties: false properties: items: description: One entry per product that has published a scope catalog. A product absent from this list publishes none, and no partner can be scoped on it. items: $ref: "#/components/schemas/ScopeCatalog" type: - array - "null" required: - items type: object ScopeDimension: additionalProperties: false properties: collection: description: The product collection the values are ids of. A partner scoped on this dimension may not list or create in this collection — that is where its siblings live. examples: - organizations type: string covers: description: Further product collections whose items each belong to ONE value of this dimension. A partner scoped on this dimension may not address them without naming its value. Absent when the dimension covers nothing beyond its own collection. examples: - - balances - operations items: type: string type: - array - "null" explicit: description: A partner scoped on this product reaches the dimension's collection only through ids its scope names for it; one that names none is refused there. Absent when false. examples: - true type: boolean from: description: "Where the product reads the value from on its own routes: path, query, header or form." examples: - path type: string label: description: Display name for the dimension. examples: - Midaz organization type: string multi: description: A line for this dimension may carry more than one value; when false, more than one is refused with IDE-0002. examples: - false type: boolean name: description: The value to send as field on a partner scope line. examples: - organizationId type: string param: description: "What carries the value on the product's routes: the path parameter, the query key, the header name (compared case-insensitively) or the form field." examples: - organization_id type: string parent: description: "Name of the dimension of this catalog whose instances hold this one's: a ledger's parent is its organization. Absent for a top-level dimension." examples: - organizationId type: string required: description: A partner scoped on this product must carry a line for this dimension, else IDE-0001. examples: - true type: boolean required: - name - from - param - required - multi - collection type: object ScopeLevel: additionalProperties: false properties: action: description: Action of the permission. examples: - update type: string level: description: tenant, or a dimension name of the catalog. examples: - organizationId type: string resource: description: Resource the permission applies to. examples: - ledgers type: string required: - resource - action - level type: object ServiceCredentialInput: additionalProperties: false properties: source: description: The Lerian service that signs in with this credential; it becomes the sourceService claim. Must match GET /v1/applications/available. examples: - jd-courier type: string target: description: The service this credential calls. Must match GET /v1/applications/available. examples: - plugin-identity type: string required: - source - target type: object Upstream: additionalProperties: false properties: code: description: The upstream provider's own error code, verbatim. examples: - E4001 type: string message: description: The upstream provider's own error message, verbatim (bounded, never its raw response body). examples: - account not found at provider type: string type: object UserInput: additionalProperties: false properties: countryCode: examples: - BR type: string email: examples: - john@example.com type: string firstName: examples: - John type: string groups: examples: - - admin-group - midaz-viewer-group - midaz-contributor-group items: type: string type: array lastName: examples: - Doe type: string password: examples: - password type: string phone: examples: - "+5511998888777" type: string username: examples: - johndoe type: string required: - firstName - lastName - username - password - email type: object UserPagination: additionalProperties: false properties: items: description: The page of users. items: $ref: "#/components/schemas/UserResponse" type: array limit: description: The page size that was applied. examples: - 10 format: int64 type: integer page: description: The 1-based page this response corresponds to. examples: - 1 format: int64 type: integer total: description: Total number of users, across all pages. examples: - 10 format: int64 type: integer type: object UserPasswordInput: additionalProperties: false properties: newPassword: examples: - newpassword type: string oldPassword: examples: - oldpassword type: string required: - newPassword type: object UserPhoneInput: additionalProperties: false properties: countryCode: examples: - BR type: string phone: examples: - "+5511998888777" type: string required: - phone - countryCode type: object UserResetPasswordInput: additionalProperties: false properties: newPassword: examples: - newpassword type: string required: - newPassword type: object UserResponse: additionalProperties: false properties: countryCode: examples: - BR type: string email: examples: - john@example.com type: string firstName: examples: - John type: string groups: items: type: string type: array id: examples: - 123e4567-e89b-12d3-a456-426614174000 type: string lastName: examples: - Doe type: string mfa: $ref: "#/components/schemas/MFAStatusResponse" phone: examples: - "+5511998888777" type: string username: examples: - johndoe type: string type: object UserTenantResponse: additionalProperties: false properties: displayName: examples: - Acme A type: string isCurrent: examples: - true type: boolean isDefault: examples: - false type: boolean ssoEnabled: examples: - false type: boolean tenantId: examples: - acme-a type: string type: object UserTenantsResponse: additionalProperties: false properties: items: items: $ref: "#/components/schemas/UserTenantResponse" type: array type: object UserUpdateInput: additionalProperties: false properties: countryCode: examples: - BR type: string email: examples: - john@example.com type: string firstName: examples: - John type: string groups: examples: - - admin-group - midaz-viewer-group - midaz-contributor-group items: type: string type: array lastName: examples: - Doe type: string phone: examples: - "+5511998888777" type: string required: - firstName - lastName - email type: object securitySchemes: BearerAuth: bearerFormat: JWT description: JWT bearer token issued by the identity provider. scheme: bearer type: http info: contact: name: Lerian Studio url: https://lerian.studio description: OpenAPI 3.1 surface for the Access Manager identity component. license: name: Lerian Studio General License title: Access Manager Identity API version: v1 openapi: 3.1.0 paths: /v1/applications: get: description: |- Returns the applications registered in your organization. An application is a credential: it is what a program signs in as, in contrast to a user, who is a person. Each one holds a clientId and a clientSecret, and the Identity API returns the secret in full only when the application is created. The `clientSecret` is NOT returned here: every row carries its `clientId`, and no row carries a secret. A lost secret cannot be recovered through any Identity API read; delete the application and create another. Pass `partnerId` to narrow the list to the credentials issued to ONE of your customers. Omit it for all of them. This listing is NOT paginated: it returns a plain array, and there is no `page` or `limit`. Read-only: nothing changes. Failures: - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: listApplications parameters: - description: Narrow the list to the credentials of ONE partner. Omit it for all of them. explode: false in: query name: partnerId schema: description: Narrow the list to the credentials of ONE partner. Omit it for all of them. examples: - 00000000-0000-0000-0000-000000000000 type: string responses: "200": content: application/json: schema: items: $ref: "#/components/schemas/ApplicationResponse" type: array description: OK "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: List Applications tags: - Applications x-mint: href: /pt/reference/platform/access-manager/list-applications post: description: |- Registers an application and issues its credentials. ⚠️ The response carries the `clientSecret` IN FULL, and no other Identity API response returns it. Store it when you receive it; a later read of the same application does not show it again. Losing it means deleting the application and creating another. Send `partnerId` to bind the credential to one of your customers: the application is then confined to that partner's permissions and scope, and reaches only the intersection of the two. Failures: - `400` — a required member is missing or malformed. - `404 IDE-1046` — `partnerId` names a partner that does not exist in your organization. - `400 IDE-0007` — `nature` holds any value other than `bancarizador`, or is sent with `partnerId`; `fields.nature` names it. Nothing was created. - `400 IDE-1063` — multi-tenant only: the request sends `source`. Service credentials are issued by Lerian, never through this route; nothing was created. Remove `source` and retry. - `400 IDE-1064` — single-tenant only: the request sends `source`. Service credentials are issued through `POST /v1/applications/service-credentials`; nothing was created. Remove `source` and retry. - `503 IDE-0064` — another application for the same product is being created in your organization at the same moment. Creates for one product are applied one at a time, so this request waits up to about 10 seconds for its turn and answers this only if the other create is still running. Nothing about the request was wrong and nothing was created; retry it. - `503 IDE-0065` — the service that coordinates concurrent creates did not answer within that wait. Nothing was created; retry it. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: createApplication requestBody: content: application/json: schema: $ref: "#/components/schemas/ApplicationInput" description: The application to create. required: true responses: "201": content: application/json: schema: $ref: "#/components/schemas/ApplicationResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Create an Application tags: - Applications x-mint: href: /pt/reference/platform/access-manager/create-an-application /v1/applications/available: get: description: |- Returns the catalog of applications this deployment knows how to serve — the Lerian products it can issue credentials for, with the identifier to use when creating one. Called to populate the product picker on a create-application screen, so a caller does not have to guess an identifier. It is a STATIC catalog: it describes the deployment, not your organization, and it is identical for every caller. Read-only: nothing changes. Note that this path is matched before `GET /v1/applications/{id}`, so no application whose id is literally "available" can be read through that route. operationId: listAvailableApplications responses: "200": content: application/json: schema: items: $ref: "#/components/schemas/ApplicationAvailableResponse" type: array description: OK "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error security: - BearerAuth: [] summary: List Available Applications tags: - Applications x-mint: href: /pt/reference/platform/access-manager/list-available-applications /v1/applications/service-credentials: post: description: |- Single-tenant only. Issues the credential a Lerian service signs in with: `source` is the service the credential speaks for, recorded as its `sourceService` claim, and `target` the service it calls. Both must appear in `GET /v1/applications/available`. Only a person may call this. An application token is refused even when it may create applications. For target `plugin-identity` the application, displayed `{target}-service`, joins no permission: it only authenticates the service's own permission declaration. For any other target, when the target declares the role `service-{source}` in `m2m.service_roles`, it is displayed `{target}-service-{source}` and listed on that caller's own lane, `{target}-service-{source}-m2m-permission`, which holds that role alone. Otherwise it is displayed `{target}-service` and listed on the shared service lane, `{target}-service-m2m-permission`, which holds the target's other service roles; when the target later declares `service-{source}`, its next re-apply moves the credential to that caller's lane and display name; once it stops declaring it, back to the shared lane. It never joins the client lane `{target}-m2m-permission`. ⚠️ The response carries the `clientSecret` IN FULL, and no other Identity API response returns it. Revoke it with `DELETE /v1/applications/{id}`, which also removes it from its lane. Each issue is a new credential, so to rotate one: issue the new one, deploy it, then revoke the old one. Failures: - `400` — `source` or `target` is missing, or `IDE-0012` when either is not in the catalog. - `403` — the caller is an application, not a person (`401` where M2M inversion is off). - `409 IDE-1065` — the generated application name is taken. Nothing was created; retry it. - `422` — the target has no service lane yet: it declares no `m2m.service_roles`, or it has not published its declaration; or its lane gives that source no role. Nothing was created. - `501` — multi-tenant deployment: the tenant manager issues service credentials there. - `503 IDE-0064` / `IDE-0065` — another write to the same service lane held it past the wait, or the service that coordinates those writes did not answer. Nothing was created; retry it. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: issueServiceCredential requestBody: content: application/json: schema: $ref: "#/components/schemas/ServiceCredentialInput" description: The service credential to issue. required: true responses: "201": content: application/json: schema: $ref: "#/components/schemas/ApplicationResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Forbidden "409": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Conflict "422": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "501": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Implemented "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Issue a Service Credential tags: - Applications x-mint: href: /pt/reference/platform/access-manager/issue-a-service-credential /v1/applications/{id}: delete: description: |- Removes an application and revokes its credentials. Deleting every application attached to a partner is also the prerequisite for deleting the partner itself, which is refused while any credential still points at it. A service credential (single-tenant, displayed `{target}-service` or `{target}-service-{caller}`) is also removed from its service lane. On success the response has no body (204). Failures: - `404` — no such application in your organization. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: deleteApplication parameters: - description: Application ID. in: path name: id required: true schema: description: Application ID. examples: - plugin-identity type: string responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Delete an Application tags: - Applications x-mint: href: /pt/reference/platform/access-manager/delete-application get: description: |- Returns one application: its identity, the partner it is bound to if any, and its clientId. The `clientSecret` is NOT returned here. The Identity API returns it only in the create response. Read-only: nothing changes. Failures: - `404` — no such application in your organization. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: getApplication parameters: - description: Application ID. in: path name: id required: true schema: description: Application ID. examples: - plugin-identity type: string responses: "200": content: application/json: schema: $ref: "#/components/schemas/ApplicationResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Retrieve Application details tags: - Applications x-mint: href: /pt/reference/platform/access-manager/retrieve-application-details /v1/applications/{id}/providers: get: description: |- Returns the providers linked to one application, and which of them is the default for its category. This is the answer to "where does this application's mail actually go?" — a provider exists in the catalog, but it only carries anything for an application it is linked to. This listing is NOT paginated: it returns a plain array. Read-only: nothing changes. Failures: - `404` — no such application in your organization. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: listApplicationProviders parameters: - description: Application ID. in: path name: id required: true schema: description: Application ID. examples: - plugin-identity type: string responses: "200": content: application/json: schema: items: $ref: "#/components/schemas/ProviderItemResponse" type: array description: OK "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: List Application Providers tags: - Application Providers x-mint: href: /pt/reference/platform/access-manager/list-application-providers post: description: |- Attaches an existing provider to an application. Linking is the step that makes a configuration live, so it is also the step that can break delivery. Test the provider first (`POST /v1/providers/{id}/test-send`). Failures: - `404` — no such application, or no such provider. - `409` — that provider is already linked to this application. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: linkProviderToApplication parameters: - description: Application ID. in: path name: id required: true schema: description: Application ID. examples: - plugin-identity type: string requestBody: content: application/json: schema: $ref: "#/components/schemas/ProviderItemInput" description: The provider to link, and how. required: true responses: "201": content: application/json: schema: $ref: "#/components/schemas/ProviderItemResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Conflict "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Link Provider to Application tags: - Application Providers x-mint: href: /pt/reference/platform/access-manager/link-provider-to-application /v1/applications/{id}/providers/{providerId}: delete: description: |- Detaches a provider from an application. The provider itself is untouched and stays in the catalog for other applications; only this application stops using it. ⚠️ If it was the DEFAULT for its category and nothing else of that category is linked, the application has no channel left: its verification mail or its MFA codes stop being delivered. Link a replacement and make it default before unlinking the last one. On success the response has no body (204). Failures: - `404` — no such application, or that provider is not linked to it. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: unlinkProviderFromApplication parameters: - description: Application ID. in: path name: id required: true schema: description: Application ID. examples: - plugin-identity type: string - description: Provider ID. in: path name: providerId required: true schema: description: Provider ID. examples: - smtp-primary type: string responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Unlink Provider from Application tags: - Application Providers x-mint: href: /pt/reference/platform/access-manager/unlink-provider-from-application patch: description: |- Changes how one provider is used by one application. Anything you omit is left alone. This edits the LINK, not the provider: the provider's own credentials are changed with `PATCH /v1/providers/{id}`, and a change there affects every application linked to it, while a change here affects only this one. Failures: - `404` — no such application, or that provider is not linked to it. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: updateApplicationProviderLink parameters: - description: Application ID. in: path name: id required: true schema: description: Application ID. examples: - plugin-identity type: string - description: Provider ID. in: path name: providerId required: true schema: description: Provider ID. examples: - smtp-primary type: string requestBody: content: application/json: schema: $ref: "#/components/schemas/ProviderItemUpdateInput" description: The link members to update. required: true responses: "200": content: application/json: schema: $ref: "#/components/schemas/ProviderItemResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Update Provider Link tags: - Application Providers x-mint: href: /pt/reference/platform/access-manager/update-application-provider-link /v1/applications/{id}/providers/{providerId}/default: patch: description: |- Makes one linked provider the application's default for its category — the one its messages go through when nothing more specific applies. An application can have several providers of a category linked but only one default, so this call also DEMOTES whichever was default before. That demotion is silent and is the part worth knowing: promoting a provider is how delivery moves off the previous one. Failures: - `404` — no such application, or that provider is not linked to it. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: setApplicationProviderAsDefault parameters: - description: Application ID. in: path name: id required: true schema: description: Application ID. examples: - plugin-identity type: string - description: Provider ID. in: path name: providerId required: true schema: description: Provider ID. examples: - smtp-primary type: string responses: "200": content: application/json: schema: $ref: "#/components/schemas/ProviderItemResponse" description: OK "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Set Provider as Default tags: - Application Providers x-mint: href: /pt/reference/platform/access-manager/set-default-application-provider /v1/declarations/{slug}: put: description: |- Creates or replaces the access-manager declaration for the given plugin slug. Called by the product itself, at start-up, with its own M2M token. The body has two sections and each is replaced ONLY when present, so a product can publish one without touching the other: - the ACCESS section — `permissions`, `roles` and `m2m` together (a permission names the roles it grants to, so they are applied as one full sync: what the section no longer declares is removed). Served in single-tenant deployments only; in multi-tenant it answers `501`. - the SCOPE section — `scope.dimensions`, the dimensions the product's routes address instances by, and `partners`, the product's opt-in to partner credentials (either alone is the section), plus `levels` in the scope-only form. It replaces the product's scope catalog wholesale and is served in single- AND multi-tenant deployments: the catalog is global per product. Every partner write is validated against it, and `GET /v1/scope-catalog/{product}` reads it back. A body carrying both sections in multi-tenant applies the scope section and then answers `501` for the access section. Failures: `422` — the manifest is malformed (the message lists every violation), declares neither section, its `service` is not the slug, no application is registered for the calling client, or the identity provider refused the scope catalog; `403` — the token does not speak for the slug; `409` — the access section could not be persisted; `501` — the access section in a multi-tenant deployment; `503 IDE-0066` — the identity provider is unavailable, retry later; `500` — another dependency failed, retry. operationId: upsertDeclaration parameters: - description: Plugin slug that owns the declaration being upserted. in: path name: slug required: true schema: description: Plugin slug that owns the declaration being upserted. examples: - plugin-fees type: string requestBody: content: application/json: schema: $ref: "#/components/schemas/DeclarationManifest" description: Declaration manifest to upsert for the slug. required: true responses: "200": content: application/json: schema: $ref: "#/components/schemas/DeclarationResponseBody" description: OK "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Internal Server Error "503": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Service Unavailable default: content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Error security: - BearerAuth: [] summary: Upsert a plugin declaration tags: - Declarations x-mint: href: /pt/reference/platform/access-manager/upsert-a-plugin-declaration /v1/groups: get: description: |- Returns your organization's groups, one page at a time, each with the usernames of its members. A group is how permissions reach a person: you grant roles to a group and put people in it, rather than granting anyone individually. Called whenever the group list is shown, and after any create or delete to refresh it. `name` narrows the page by case-insensitive substring. Read-only: nothing changes. Only groups of the organization resolved from your token are ever returned. Failures: - `400 IDE-0018` — `limit` is above the deployment's maximum (100 by default). - `400 IDE-0019` — `page` is below 1. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: listGroups parameters: - description: Page number. explode: false in: query name: page schema: default: 1 description: Page number. examples: - 1 format: int64 type: integer - description: Items per page. explode: false in: query name: limit schema: default: 10 description: Items per page. examples: - 10 format: int64 type: integer - description: Filter by name (case-insensitive substring). explode: false in: query name: name schema: description: Filter by name (case-insensitive substring). type: string - description: "Filter by role ID (relational listing): only groups the role is granted to." explode: false in: query name: roleId schema: description: "Filter by role ID (relational listing): only groups the role is granted to." type: string - description: "Filter by user ID (relational listing): only groups the user belongs to." explode: false in: query name: userId schema: description: "Filter by user ID (relational listing): only groups the user belongs to." type: string responses: "200": content: application/json: schema: $ref: "#/components/schemas/GroupPagination" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: List Groups tags: - Groups x-mint: href: /pt/reference/platform/access-manager/list-groups post: description: |- Creates a group. `name` is the identifier you will address it by everywhere else — it is NOT a generated UUID, and it cannot be changed afterwards; `displayName` is the label people see and can be changed at any time. A new group is empty and grants nothing. Add people with `POST /v1/groups/{id}/users` and grant it roles with `POST /v1/roles/{id}/groups`; until both happen the group has no effect on anyone's access. Failures: - `400` — a required member is missing. - `409` — a group with that `name` already exists in your organization. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: createGroup requestBody: content: application/json: schema: $ref: "#/components/schemas/GroupInput" description: The group to create. required: true responses: "201": content: application/json: schema: $ref: "#/components/schemas/GroupFullResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "409": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Conflict "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Create a Group tags: - Groups x-mint: href: /pt/reference/platform/access-manager/create-a-group /v1/groups/{id}: delete: description: |- Removes an empty group permanently. A group that still has members, or that other groups are nested under, is NOT deleted: the request is refused and nothing changes. Remove the members with the group's member routes first — each of them then stops holding whatever the group granted, which for someone whose only access came through this group means losing it entirely. On success the response has no body (204). Failures: - `404` — no such group in your organization. - `409 IDE-1058` — the group still has members; remove them, then delete the group. - `409 IDE-1059` — other groups are nested under this one; delete or move them first. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: deleteGroup parameters: - description: Group ID. in: path name: id required: true schema: description: Group ID. examples: - midaz-viewer-group type: string responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Conflict "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Delete a Group tags: - Groups x-mint: href: /pt/reference/platform/access-manager/delete-a-group get: description: |- Returns one group with the usernames of its members. `{id}` is the group's `name` — a slug such as `midaz-viewer-group`, not a UUID. Called to open a group's detail screen, and before a PATCH. Read-only: nothing changes. To see what the group can DO, read the roles granted to it; this response carries membership, not permissions. Failures: - `404` — no such group in your organization. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: getGroup parameters: - description: Group ID. in: path name: id required: true schema: description: Group ID. examples: - midaz-viewer-group type: string responses: "200": content: application/json: schema: $ref: "#/components/schemas/GroupFullResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Retrieve Group details tags: - Groups x-mint: href: /pt/reference/platform/access-manager/retrieve-group-details patch: description: |- Changes a group's label and contact details. Anything you omit is left alone. The group's `name` — the identifier in `{id}` — CANNOT be changed here or anywhere else; it is what roles and memberships point at. Membership is not edited here either: use `POST /v1/groups/{id}/users` and its remove counterpart. The response carries the group's full projection, which is wider than the one `GET` returns. Failures: - `400` — a supplied member is malformed. - `404` — no such group in your organization. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: updateGroup parameters: - description: Group ID. in: path name: id required: true schema: description: Group ID. examples: - midaz-viewer-group type: string requestBody: content: application/json: schema: $ref: "#/components/schemas/GroupUpdateInput" description: The group members to update. required: true responses: "200": content: application/json: schema: $ref: "#/components/schemas/GroupFullResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Update a Group tags: - Groups x-mint: href: /pt/reference/platform/access-manager/update-a-group /v1/groups/{id}/users: post: description: |- Puts one or more people into a group. `{id}` is the group's `name`, a slug such as `midaz-viewer-group`; each entry in `users` is a user id. Called after a person is created, and whenever someone changes team. Adding somebody already in the group is not an error: the call is idempotent per member, so a partially applied form can safely be submitted again. On success the response has no body (204). Failures: - `400` — `users` is missing or empty. - `404` — no such group in your organization. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: addGroupMembers parameters: - description: Group ID. in: path name: id required: true schema: description: Group ID. examples: - midaz-viewer-group type: string requestBody: content: application/json: schema: $ref: "#/components/schemas/AssignUsersInput" description: The users to add to the group. required: true responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Add Members to a Group tags: - Groups x-mint: href: /pt/reference/platform/access-manager/assigns-users-to-a-group /v1/groups/{id}/users/remove: post: description: |- Takes several people out of a group in one call, naming them in the body. It is a POST rather than a DELETE because the members travel in a request body; `DELETE /v1/groups/{id}/users/{userId}` does the same thing for exactly one person. Both exist and both are supported — use whichever fits the screen you are building. Nobody is deleted: they keep their account and lose only what this group granted them, which for someone whose access came solely through it means losing all of it. Removing somebody who is not a member is not an error. On success the response has no body (204). Failures: - `400` — `users` is missing or empty. - `404` — no such group in your organization. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: removeGroupMembersBatch parameters: - description: Group ID. in: path name: id required: true schema: description: Group ID. examples: - midaz-viewer-group type: string requestBody: content: application/json: schema: $ref: "#/components/schemas/AssignUsersInput" description: The users to remove from the group. required: true responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Remove Members from a Group in Batch tags: - Groups x-mint: href: /pt/reference/platform/access-manager/removes-multiple-users-from-a-group-batch /v1/groups/{id}/users/{userId}: delete: description: |- Takes one person out of one group. `{id}` is the GROUP (a slug such as `midaz-viewer-group`) and `{userId}` is the PERSON — the order of the two matters, and swapping them removes a membership nobody asked to remove. The batch form, `POST /v1/groups/{id}/users/remove`, does the same thing for a list of people. The account is not deleted: it loses only what this group granted. Removing somebody who is not a member is not an error. On success the response has no body (204). Failures: - `404` — no such group in your organization. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: removeGroupMember parameters: - description: Group ID. in: path name: id required: true schema: description: Group ID. examples: - midaz-viewer-group type: string - description: User ID. in: path name: userId required: true schema: description: User ID. examples: - 00000000-0000-0000-0000-000000000000 type: string responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Remove one Member from a Group tags: - Groups x-mint: href: /pt/reference/platform/access-manager/removes-a-single-user-from-a-group /v1/partners: get: description: |- Returns your organization's partners, one page at a time, each with its full permissions and scope and with `applicationsCount` — how many M2M credentials currently point at it. The count is served here so a list screen does not have to issue one applications query per row, and it is also what tells you in advance whether a delete will be refused. Called whenever the partner list is shown, and after any create or delete to refresh it. Use `GET /v1/applications?partnerId=` to see WHICH credentials a partner holds. Read-only: nothing changes. Only partners of the organization resolved from your token are ever returned; there is no parameter that widens that. Failures: - `400 IDE-0018` — `limit` is above the deployment's maximum (100 by default). - `403` — your token does not hold the `partners` resource. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: listPartners parameters: - description: 1-based page number. explode: false in: query name: page schema: default: 1 description: 1-based page number. examples: - 1 format: int64 minimum: 1 type: integer - description: Page size. Bounded by the deployment's MAX_PAGINATION_LIMIT (100 by default); a larger value is refused with IDE-0018. explode: false in: query name: limit schema: default: 10 description: Page size. Bounded by the deployment's MAX_PAGINATION_LIMIT (100 by default); a larger value is refused with IDE-0018. examples: - 10 format: int64 minimum: 1 type: integer responses: "200": content: application/json: schema: $ref: "#/components/schemas/PartnerPagination" description: OK "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Internal Server Error "503": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Service Unavailable default: content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Error security: - BearerAuth: [] summary: List partners tags: - Partners x-mint: href: /pt/reference/platform/access-manager/list-partners post: description: |- Registers one of your customers as a partner and fixes, up front, everything its future credentials will be allowed to reach: `permissions` says WHAT it may do in each product (collections × verbs) and `scope` says WHERE (which organization, which ledgers). The two are combined with AND at every request, so a partner reaches only the intersection. This is the FIRST call in the flow. Nothing is issued here — no credential, no secret. Once the partner exists you create M2M applications against it with `POST /v1/applications { "partnerId": "" }`, one per product, and hand the resulting clientId/clientSecret to the customer. A partner with no application is inert. On success a new record is created in YOUR organization (resolved from your token — there is no tenant field to send) with a server-generated UUID `id`, state `active`, and the permissions, scope, validity window and IP allowlist you supplied. Nothing in any product changes: the scope values are recorded, never verified against the product and never created there. Failures: - `400 IDE-1042` — a scope `field` is not one the product's published scope catalog declares. `GET /v1/scope-catalog/{product}` lists the accepted dimensions; the message names the offending field. - `400 IDE-0001` (scope) — the product's catalog marks a dimension `required` and the scope has no line for it. - `400 IDE-0002` (scope) — several values on a dimension the catalog does not mark `multi`. - `400 IDE-1043` — a permission asks for a resource, an action, or a resource/action pair that no ONE enabled permission bound to your organization's `-editor-role` holds, or that role holds nothing in the product. That is the ceiling; you cannot delegate more than you hold. Each permission of the role counts on its own: a pair is allowed only when one permission holds both its resource and its action, so a verb held for one resource is never borrowed by another. The message names the offending resource, action or pair; drop it from the line, or have it granted to the editor role first. - `400 IDE-1054` — a permission names a product that is not ready for partners yet: it has not published a scope catalog, so a partner could not be narrowed to any of its instances. The message names the offending `permissions[i].product`; remove that line. - `400 IDE-1055` — a permission names a product that has a scope catalog but has not opted in to partners (its manifest does not declare `partners: true`; `GET /v1/scope-catalog/{product}` shows `partners: false`). Nothing in your request can change that: remove the line, or wait for the product to publish the opt-in. `errors[0].location` is `body.permissions[i].product`. - `400 IDE-1056` — a permission grants a write (`post`, `put`, `patch`, `delete`) that the product performs at a level wider than the partner's scope: a partner confined to one ledger cannot be granted creating ledgers, which acts on the whole organization. The product's levels are in `GET /v1/scope-catalog/{product}` (`levels`). Remove that action, or scope the partner at the level the write needs. `errors[0].location` is `body.permissions[i]`; nothing is written. - `400 IDE-1052` — any other refusal of the identity provider; the message repeats its code and sentence. - `400 IDE-1044` — a product appears in `scope` but not in `permissions`, which would authorize nothing. - `400 IDE-1045` — `validUntil` is not later than `validFrom`. - `400 IDE-1047` — `"*"` was used in `permissions.resources` or `permissions.actions`. A wildcard means allow-all and is refused; list the values. - `400 IDE-1048` — `ipAllowlist` is an empty array. Omit it or send null to inherit the organization's list. - `400 IDE-0036` / `400 IDE-1050` — an `ipAllowlist` entry has an unparseable `cidr`, or the same network appears twice. - `409 IDE-1040` — `displayName` is already used by another partner of yours. - `403` — your token does not hold the `partners` resource. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: createPartner requestBody: content: application/json: schema: $ref: "#/components/schemas/PartnerInput" description: The partner to create. required: true responses: "201": content: application/json: schema: $ref: "#/components/schemas/PartnerResponse" description: Created "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Internal Server Error "503": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Service Unavailable default: content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Error security: - BearerAuth: [] summary: Create a partner tags: - Partners x-mint: href: /pt/reference/platform/access-manager/create-a-partner /v1/partners/ceiling: get: description: |- Returns the most a partner of your organization can be granted in one product: everything your organization's `-editor-role` holds, as one entry in `grants` per enabled permission bound to that role. It is the ceiling every partner write is checked against, so it is what a partner editor should offer. Read it PAIRWISE. A permission line may grant a `(resource, action)` only when ONE entry holds both — a verb an entry holds for one collection is never available for a collection another entry holds. `head` is granted together with `get`, inside the entry that holds `get`. Asking for more is refused on write with `400 IDE-1043`. Called when a partner editor opens a product, before it renders the grid of collections and verbs. The ceiling can narrow after a partner was written; a partner then keeps only what is still inside it. Read-only: nothing changes. The organization is always the one resolved from your token; there is no parameter that names another. An empty `grants` is a legitimate answer: the role holds nothing in the product, and no partner can be granted anything there. Failures: - `400 IDE-0001` — `product` is blank. - `400 IDE-1057` — the identity provider refused the request; the message repeats its code and sentence. - `403` — your token does not hold the `partners` resource. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: getPartnerCeiling parameters: - description: Product slug, as returned by GET /v1/applications/available. explode: false in: query name: product required: true schema: description: Product slug, as returned by GET /v1/applications/available. examples: - tracer minLength: 1 type: string responses: "200": content: application/json: schema: $ref: "#/components/schemas/PartnerCeiling" description: OK "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Internal Server Error "503": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Service Unavailable default: content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Error security: - BearerAuth: [] summary: Retrieve the partner ceiling of a product tags: - Partners x-mint: href: /pt/reference/platform/access-manager/retrieve-the-partner-ceiling-of-a-product /v1/partners/{id}: delete: description: |- Removes a partner permanently. This is not the way to pause a partner — use `PATCH` with `state: "suspended"` for that, which is reversible. Called at the end of a partner's life, after its credentials have been revoked. The delete is refused while any application still points at the partner, so the order is: delete the applications, then delete the partner. On success the record is gone and the response has no body (204). Failures: - `409 IDE-1049` — applications are still attached. The problem document's `errors` list names each blocking application. - `404 IDE-1046` — no such partner in your organization. - `422` — `id` is not a UUID. - `403` — your token does not hold the `partners` resource. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: deletePartner parameters: - description: Identifier of the partner to delete. in: path name: id required: true schema: description: Identifier of the partner to delete. examples: - 00000000-0000-0000-0000-000000000000 format: uuid type: string responses: "204": description: No Content "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Internal Server Error "503": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Service Unavailable default: content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Error security: - BearerAuth: [] summary: Delete a partner tags: - Partners x-mint: href: /pt/reference/platform/access-manager/delete-a-partner get: description: |- Returns one partner in full: its permissions, its scope, its validity window, its IP allowlist and how many applications are attached. Called to open a partner's detail screen, and before a PATCH — the update replaces `permissions` and `scope` wholesale rather than merging entry by entry, so an editor has to start from the current lists. Read-only: nothing changes. Failures: - `404 IDE-1046` — no such partner in your organization. An id that belongs to ANOTHER tenant answers exactly this, deliberately: telling the two apart would confirm another tenant's records exist. - `422` — `id` is not a UUID. - `403` — your token does not hold the `partners` resource. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: getPartner parameters: - description: Identifier of the partner, as returned by the create call. in: path name: id required: true schema: description: Identifier of the partner, as returned by the create call. examples: - 00000000-0000-0000-0000-000000000000 format: uuid type: string responses: "200": content: application/json: schema: $ref: "#/components/schemas/PartnerResponse" description: OK "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Internal Server Error "503": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Service Unavailable default: content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Error security: - BearerAuth: [] summary: Retrieve a partner tags: - Partners x-mint: href: /pt/reference/platform/access-manager/retrieve-a-partner patch: description: |- Changes a partner's access, its validity window, its IP allowlist or its state. Every member is optional and anything you omit is left alone — but `permissions` and `scope`, when supplied, REPLACE the stored list wholesale. There is no per-entry merge, because a merge would make "remove the last ledger" impossible to express. Called to widen or narrow a partner mid-life, and to suspend or reactivate one (`state: "suspended"` / `"active"`). Suspending is the reversible kill switch; deleting is not. `ipAllowlist` has THREE meanings here and they are not interchangeable: omit the member to leave the list as it is, send `null` to go back to inheriting the organization's list, send entries to replace it with the partner's own. An empty array is refused. `validFrom` and `validUntil` work the same way, one bound at a time: omit the member to keep the stored bound, send an RFC 3339 instant to set it, send `null` to remove it and leave the window open on that side (no start date: honoured from now on; no end date: never expires — a partner already past its end date is honoured again unless it is suspended). An empty string is refused with `422`. When you send only one bound it is checked against the other one as stored: moving `validFrom` to or past the stored `validUntil`, or `validUntil` to or before the stored `validFrom`, is `400 IDE-1045` and nothing is written. To move a window to a later period, send both bounds in the same request. What changes: the stored record, and with it every future authorization. The change takes effect on the next authorization decision, including for access tokens already issued to this partner. Token issuance is refused while the partner is suspended or outside its validity window, and from an address outside its IP allowlist; a permission or scope change does not stop issuance, it limits what the token can do. To cut a partner off, suspend it. Failures: every code `POST` can return, applied to the record as it will be after the patch (`IDE-1042`, `IDE-1043`, `IDE-1044`, `IDE-1045`, `IDE-1047`, `IDE-1048`, `IDE-0036`, `IDE-1050`, `IDE-1052`, `409 IDE-1040`), plus: - `400 IDE-1054` — the product is not ready for partners yet: it has not published a scope catalog. Raised only when the request sends `permissions`: a partner that already holds such a line can still be suspended, reactivated or renamed, and the line can be removed. - `400 IDE-1055` — a permission names a product that has not opted in to partners. Like IDE-1054 it is raised only when the request sends `permissions`, for every line; remove the line to proceed. - `400 IDE-1056` is checked when either `permissions` or `scope` changes: granting a write and narrowing the scope under a write already granted both put the write above the scope. Narrow the scope and drop the write in the same update. - `404 IDE-1046` — no such partner in your organization. - `403` — your token does not hold the `partners` resource. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: updatePartner parameters: - description: Identifier of the partner to modify. in: path name: id required: true schema: description: Identifier of the partner to modify. examples: - 00000000-0000-0000-0000-000000000000 format: uuid type: string requestBody: content: application/json: schema: $ref: "#/components/schemas/PartnerUpdateInput" description: The members to change. Anything omitted is left as it is. required: true responses: "200": content: application/json: schema: $ref: "#/components/schemas/PartnerResponse" description: OK "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Internal Server Error "503": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Service Unavailable default: content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Error security: - BearerAuth: [] summary: Update a partner tags: - Partners x-mint: href: /pt/reference/platform/access-manager/update-a-partner /v1/passkey/policy: get: description: |- Says whether your organization offers passkey sign-in, and whether it signs in through an SSO provider. The option belongs to the organization resolved from your token; nothing in the request names another one. Passkeys and SSO exclude each other: passkeys cannot be turned on while an SSO provider is active, and an SSO provider cannot be configured while passkeys are on. While passkeys are on, a person who has a passkey cannot sign in with a password (403 AUT-1019 on the password grant); everyone else signs in with password and second factor as before. Turning passkeys off lets everyone sign in with a password again; passkeys stay stored. Read-only: nothing changes. Failures: - `404` — the application backing your organization's login was not found. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: getPasskeyPolicy responses: "200": content: application/json: schema: $ref: "#/components/schemas/PasskeyPolicyResponse" description: OK "401": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Get passkey policy tags: - Passkey x-mint: href: /pt/reference/platform/access-manager/get-passkey-policy patch: description: |- Turns passkey sign-in on or off for your organization. Sending the value already stored changes nothing. The option belongs to the organization resolved from your token; nothing in the request names another one. Passkeys and SSO exclude each other: passkeys cannot be turned on while an SSO provider is active, and an SSO provider cannot be configured while passkeys are on. While passkeys are on, a person who has a passkey cannot sign in with a password (403 AUT-1019 on the password grant); everyone else signs in with password and second factor as before. Turning passkeys off lets everyone sign in with a password again; passkeys stay stored. Failures: - `400` — the body is malformed, or `enabled` is missing. - `404` — the application backing your organization's login was not found. - `409 IDE-1068` — an SSO provider is active; remove it before turning passkeys on. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: setPasskeyPolicy requestBody: content: application/json: schema: $ref: "#/components/schemas/PasskeyPolicyInput" description: The passkey option for the caller's organization. required: true responses: "200": content: application/json: schema: $ref: "#/components/schemas/PasskeyPolicyResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Conflict "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Update passkey policy tags: - Passkey x-mint: href: /pt/reference/platform/access-manager/update-passkey-policy /v1/permissions: get: description: |- Returns the catalog of permissions this deployment knows about, one page at a time. A permission is the smallest unit of access — a resource and the verbs allowed on it. You do not create them: each product DECLARES its own through `PUT /v1/declarations/{slug}` and the server reconciles the catalog, which is why this family is read-only. Read this to find out what you can put INTO a role. `product` narrows to one product's declarations and `resource` to one collection; `name` is the substring match. This is not the list of what a partner can be granted in a product: that is everything your organization's `-editor-role` holds, which can span more permissions than `product` returns here. Read it from `GET /v1/partners/ceiling?product=`. Read-only: nothing changes. Failures: - `400 IDE-0018` — `limit` is above the deployment's maximum (100 by default). - `400 IDE-0019` — `page` is below 1. - `400 IDE-1041` — `product` is not a known catalog slug. The message lists the catalog. A whitespace-only `product` is treated as absent instead. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: listPermissions parameters: - description: Page number. explode: false in: query name: page schema: default: 1 description: Page number. examples: - 1 format: int64 type: integer - description: Items per page. explode: false in: query name: limit schema: default: 10 description: Items per page. examples: - 10 format: int64 type: integer - description: Filter by name (case-insensitive substring). explode: false in: query name: name schema: description: Filter by name (case-insensitive substring). type: string - description: Filter by the resource the permission governs, e.g. accounts. explode: false in: query name: resource schema: description: Filter by the resource the permission governs, e.g. accounts. type: string - description: Filter by the product that declared the permission, e.g. midaz. explode: false in: query name: product schema: description: Filter by the product that declared the permission, e.g. midaz. type: string responses: "200": content: application/json: schema: $ref: "#/components/schemas/PermissionPagination" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: List Permissions tags: - Permissions x-mint: href: /pt/reference/platform/access-manager/list-permissions /v1/permissions/{id}: get: description: |- Returns one permission: the resource it governs, the actions it allows, and the product that declared it. `{id}` is the permission's name — a slug, not a UUID. Read-only: nothing changes. A permission existing in the catalog says nothing about who HOLDS it; for that, read a role's permissions or a user's effective permissions. Failures: - `404` — no permission with that name is declared in this deployment. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: getPermission parameters: - description: Permission ID. in: path name: id required: true schema: description: Permission ID. examples: - midaz-accounts-get type: string responses: "200": content: application/json: schema: $ref: "#/components/schemas/PermissionResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Retrieve Permission details tags: - Permissions x-mint: href: /pt/reference/platform/access-manager/retrieve-permission-details /v1/providers: get: description: |- Returns the message and login providers configured for your organization, one page at a time. A provider is an outbound channel: an SMTP or e-mail service that carries verification and password-reset mail, an SMS service that carries MFA codes, or an OAuth identity provider people sign in through. Filter with `category` — `Email`, `SMS` or `OAuth`. Read-only: nothing changes. A provider listed here is configured but not necessarily in USE — what makes it live is being linked to an application (`GET /v1/applications/{id}/providers`). Failures: - `400 IDE-0018` — `limit` is above the deployment's maximum (100 by default). - `400 IDE-0019` — `page` is below 1. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: listProviders parameters: - description: "Filter by provider category: Email, SMS or OAuth." explode: false in: query name: category schema: description: "Filter by provider category: Email, SMS or OAuth." examples: - Email type: string - description: Page number. explode: false in: query name: page schema: default: 1 description: Page number. examples: - 1 format: int64 type: integer - description: Items per page. explode: false in: query name: limit schema: default: 10 description: Items per page. examples: - 10 format: int64 type: integer responses: "200": content: application/json: schema: $ref: "#/components/schemas/ProviderPagination" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: List Providers tags: - Providers x-mint: href: /pt/reference/platform/access-manager/list-providers post: description: |- Registers a message or login provider and stores its credentials. Creating a provider does NOT put it in use. It becomes live only when it is linked to an application (`POST /v1/applications/{id}/providers`), so a new provider is inert and safe to configure ahead of time. The credentials are stored but not verified here. To find out whether they actually work, call `POST /v1/providers/{id}/test-send`, which sends one real message. Failures: - `400` — a required member is missing or malformed. - `409` — a provider with that name already exists. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: createProvider requestBody: content: application/json: schema: $ref: "#/components/schemas/ProviderInput" description: The provider to create. required: true responses: "201": content: application/json: schema: $ref: "#/components/schemas/ProviderResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "409": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Conflict "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Create a Provider tags: - Providers x-mint: href: /pt/reference/platform/access-manager/create-a-provider /v1/providers/{id}: delete: description: |- Removes a provider and its stored credentials permanently. ⚠️ Any application still linked to it loses that channel. Deleting the provider that carries SMS MFA codes means second factors stop being delivered; deleting the one that carries e-mail means password-reset codes stop arriving. Unlink it from every application first (`DELETE /v1/applications/{id}/providers/{providerId}`) and confirm another provider covers the category. On success the response has no body (204). Failures: - `404` — no such provider in your organization. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: deleteProvider parameters: - description: Provider ID. in: path name: id required: true schema: description: Provider ID. examples: - smtp-primary type: string responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Delete a Provider tags: - Providers x-mint: href: /pt/reference/platform/access-manager/delete-a-provider get: description: |- Returns one provider's configuration. Secrets are not returned in full. Read this to see how a provider is configured and which category it serves, not to recover a credential. Read-only: nothing changes. Failures: - `404` — no such provider in your organization. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: getProvider parameters: - description: Provider ID. in: path name: id required: true schema: description: Provider ID. examples: - smtp-primary type: string responses: "200": content: application/json: schema: $ref: "#/components/schemas/ProviderResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Retrieve Provider details tags: - Providers x-mint: href: /pt/reference/platform/access-manager/retrieve-a-provider patch: description: |- Changes a provider's configuration or credentials. Anything you omit is left alone. ⚠️ A provider that is LINKED to an application is live: changing its credentials here takes effect on the next message it carries, with no confirmation step. If that provider carries SMS MFA codes, a wrong credential stops second factors from arriving and locks people out — verify with `POST /v1/providers/{id}/test-send` after changing it. Failures: - `400` — a supplied member is malformed. - `404` — no such provider in your organization. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: updateProvider parameters: - description: Provider ID. in: path name: id required: true schema: description: Provider ID. examples: - smtp-primary type: string requestBody: content: application/json: schema: $ref: "#/components/schemas/ProviderUpdateInput" description: The provider members to update. required: true responses: "200": content: application/json: schema: $ref: "#/components/schemas/ProviderResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Update a Provider tags: - Providers x-mint: href: /pt/reference/platform/access-manager/update-a-provider /v1/providers/{id}/test-send: post: description: |- Sends ONE REAL message through a stored provider, to a destination you name, so you can find out whether its credentials work before anyone depends on them. This is not a dry run: a real e-mail or SMS is delivered and, for SMS, may be billed by the carrier. The two failure modes are deliberately distinguishable, because they call for opposite actions: - `422 IDE-1016` — the provider REJECTED the credentials. Fatal: fix the configuration. - `400 IDE-1017` — the credentials were accepted but the message was not delivered. The configuration may be perfectly fine — a trial account that refuses unverified recipients answers exactly this. Other failures: - `404` — no such provider in your organization. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: testSendProvider parameters: - description: Provider ID. in: path name: id required: true schema: description: Provider ID. examples: - smtp-primary type: string requestBody: content: application/json: schema: $ref: "#/components/schemas/ProviderTestSendInput" description: Where to send the single test message. required: true responses: "200": content: application/json: schema: $ref: "#/components/schemas/ProviderTestSendResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Test send through a Provider tags: - Providers x-mint: href: /pt/reference/platform/access-manager/test-send-through-a-provider /v1/roles: get: description: |- Returns your organization's roles, one page at a time. A role is a named bundle of permissions. It is what you grant to a group (or, less commonly, straight to a person); the permissions inside it are what the holder may then do. Called whenever the role list is shown, and after any create or delete to refresh it. The filters are relational, not text matching: `userId` narrows to the roles that user holds and `groupId` to the roles granted to that group, which is how you answer "what does this person have?" without walking every role. `name` is the substring match. Read-only: nothing changes. Failures: - `400 IDE-0018` — `limit` is above the deployment's maximum (100 by default). - `400 IDE-0019` — `page` is below 1. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: listRoles parameters: - description: Page number. explode: false in: query name: page schema: default: 1 description: Page number. examples: - 1 format: int64 type: integer - description: Items per page. explode: false in: query name: limit schema: default: 10 description: Items per page. examples: - 10 format: int64 type: integer - description: Filter by name (case-insensitive substring). explode: false in: query name: name schema: description: Filter by name (case-insensitive substring). type: string - description: "Filter by user ID (relational listing): only roles the user holds." explode: false in: query name: userId schema: description: "Filter by user ID (relational listing): only roles the user holds." type: string - description: "Filter by group ID (relational listing): only roles granted to the group." explode: false in: query name: groupId schema: description: "Filter by group ID (relational listing): only roles granted to the group." type: string responses: "200": content: application/json: schema: $ref: "#/components/schemas/RolePagination" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: List Roles tags: - Roles x-mint: href: /pt/reference/platform/access-manager/list-roles post: description: |- Creates a role. `name` is the identifier you will address it by everywhere else — it is NOT a generated UUID and cannot be changed afterwards. A new role grants nothing until you put permissions in it (`POST /v1/roles/{id}/permissions`) and give it to someone (`POST /v1/roles/{id}/groups` or `POST /v1/roles/{id}/users`). Prefer granting to a GROUP. Failures: - `400` — a required member is missing or malformed. - `409` — a role with that `name` already exists in your organization. - `422 IDE-1062` — `description` starts with `ri-declared:`, which is reserved for the roles Lerian services declare. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: createRole requestBody: content: application/json: schema: $ref: "#/components/schemas/RoleInput" description: The role to create. required: true responses: "201": content: application/json: schema: $ref: "#/components/schemas/RoleResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "409": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Conflict "422": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Create a Role tags: - Roles x-mint: href: /pt/reference/platform/access-manager/create-a-role /v1/roles/{id}: delete: description: |- Removes a role permanently, and with it every grant of that role — to groups and to people alike. Nobody is deleted, but everyone who held access ONLY through this role loses it without a per-holder confirmation. On success the response has no body (204). Failures: - `404` — no such role in your organization. - `422 IDE-1061` — the role is reserved for machine credentials; the service that declared it removes it. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: deleteRole parameters: - description: Role ID. in: path name: id required: true schema: description: Role ID. examples: - midaz-editor type: string responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Delete a Role tags: - Roles x-mint: href: /pt/reference/platform/access-manager/delete-a-role get: description: |- Returns one role. `{id}` is the role's `name` — a slug such as `midaz-editor`, not a UUID. Called to open a role's detail screen, and before a PATCH. The permissions inside the role are read separately with `GET /v1/roles/{id}/permissions`. Read-only: nothing changes. Failures: - `404` — no such role in your organization. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: getRole parameters: - description: Role ID. in: path name: id required: true schema: description: Role ID. examples: - midaz-editor type: string responses: "200": content: application/json: schema: $ref: "#/components/schemas/RoleResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Retrieve Role details tags: - Roles x-mint: href: /pt/reference/platform/access-manager/retrieve-role-details patch: description: |- Changes a role's label and description. Anything you omit is left alone. The role's `name` — the identifier in `{id}` — CANNOT be changed here or anywhere else; it is what grants point at. The permissions inside the role are not edited here either: use `POST /v1/roles/{id}/permissions` and its remove counterpart. So this endpoint cannot widen or narrow anybody's access, which is why it is the least dangerous call in the family. Failures: - `400` — a supplied member is malformed. - `404` — no such role in your organization. - `422 IDE-1062` — the change would set, alter or remove a `description` starting with `ri-declared:`, which belongs to the service that declared the role. Resending the current description unchanged is accepted. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: updateRole parameters: - description: Role ID. in: path name: id required: true schema: description: Role ID. examples: - midaz-editor type: string requestBody: content: application/json: schema: $ref: "#/components/schemas/RoleUpdateInput" description: The role members to update. required: true responses: "200": content: application/json: schema: $ref: "#/components/schemas/RoleResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Update a Role tags: - Roles x-mint: href: /pt/reference/platform/access-manager/update-a-role /v1/roles/{id}/groups: post: description: |- Gives one or more groups a role. Everybody in those groups can do what the role allows, and so can anybody added to them later. This is the normal way access is granted here: grant to the group once, then manage people by membership. `{id}` is the role's slug; each entry in `groups` is a group's `name`, such as `midaz-viewer-group`. Granting a role a group already holds is not an error. On success the response has no body (204). Failures: - `400` — `groups` is missing or empty. - `404` — no such role in your organization. - `422 IDE-1061` — the role is reserved for machine credentials; no group may hold it. Revoking it stays open. - `422 IDE-1067` — the role is declared by a Lerian product, which alone decides the groups it is granted to; the message names it. Grant the access by adding people to the role itself, or to a group the product already grants it to. Nothing is granted when any of the groups is new. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: grantRoleToGroups parameters: - description: Role ID. in: path name: id required: true schema: description: Role ID. examples: - midaz-editor type: string requestBody: content: application/json: schema: $ref: "#/components/schemas/AssignGroupsInput" description: The groups to grant the role to. required: true responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Grant a Role to Groups tags: - Roles x-mint: href: /pt/reference/platform/access-manager/assigns-groups-to-a-role /v1/roles/{id}/groups/remove: post: description: |- Takes a role away from several groups at once, naming them in the body. It is a POST rather than a DELETE because the groups travel in a request body; `DELETE /v1/roles/{id}/groups/{groupId}` does the same for exactly one. The groups themselves are untouched and keep their members. Revoking from a group that does not hold the role is not an error. On success the response has no body (204). Failures: - `400` — `groups` is missing or empty. - `404` — no such role in your organization. - `422 IDE-1067` — the role is declared by a Lerian product, which alone decides the groups it is granted to, and one of the groups holds it; the message names the role. Change who has the access by adding or removing people on the role itself, or in a group the product grants it to. Nothing is revoked. A role reserved for machine credentials stays open to revoke. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: revokeRoleFromGroupsBatch parameters: - description: Role ID. in: path name: id required: true schema: description: Role ID. examples: - midaz-editor type: string requestBody: content: application/json: schema: $ref: "#/components/schemas/AssignGroupsInput" description: The groups to revoke the role from. required: true responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Revoke a Role from Groups in Batch tags: - Roles x-mint: href: /pt/reference/platform/access-manager/removes-multiple-groups-from-a-role-batch /v1/roles/{id}/groups/{groupId}: delete: description: |- Takes a role away from one group. `{id}` is the ROLE and `{groupId}` is the GROUP — both are slugs, so the order of the two is the only thing telling them apart, and swapping them revokes a grant nobody asked to revoke. The batch form, `POST /v1/roles/{id}/groups/remove`, does the same for a list. The group itself is untouched and keeps its members. Revoking from a group that does not hold the role is not an error. On success the response has no body (204). Failures: - `404` — no such role in your organization. - `422 IDE-1067` — the role is declared by a Lerian product, which alone decides the groups it is granted to, and the group holds it. Change who has the access by adding or removing people on the role itself, or in a group the product grants it to. A role reserved for machine credentials stays open to revoke. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: revokeRoleFromGroup parameters: - description: Role ID. in: path name: id required: true schema: description: Role ID. examples: - midaz-editor type: string - description: Group ID. in: path name: groupId required: true schema: description: Group ID. examples: - midaz-viewer-group type: string responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Revoke a Role from one Group tags: - Roles x-mint: href: /pt/reference/platform/access-manager/removes-a-single-group-from-a-role /v1/roles/{id}/permissions: get: description: |- Returns every permission the role carries, as a plain array — this listing is NOT paginated. A role is a named bundle of permissions; this is what is inside the bundle. Called to open a role's detail screen, and before adding or removing entries so the form starts from the current state. Read-only: nothing changes. It answers "what does this role allow?", not "who holds it?" — for the holders, list users or groups filtered by this role. Failures: - `404` — no such role in your organization. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: listRolePermissions parameters: - description: Role ID. in: path name: id required: true schema: description: Role ID. examples: - midaz-editor type: string responses: "200": content: application/json: schema: items: $ref: "#/components/schemas/PermissionResponse" type: array description: OK "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: List the Permissions of a Role tags: - Roles x-mint: href: /pt/reference/platform/access-manager/returns-the-permissions-assigned-to-a-role post: description: |- Widens a role: everyone who already holds it — directly, or through a group — can do the added things. `{id}` is the role's `name`, a slug such as `midaz-editor`; each entry in `permissions` is a permission id. There is no separate step to push the change out to holders; the role IS the grant. Adding a permission the role already carries is not an error, so a partially applied form can safely be submitted again. On success the response has no body (204). Failures: - `400` — `permissions` is missing or empty. - `404` — one of the permissions does not exist. - `422 IDE-1061` — a permission is reserved for machine credentials, so no role a person may hold can carry it; or the role itself is, so it takes no permission here. - `422 IDE-1066` — a permission is declared by a Lerian product, which alone decides the roles that hold it (this includes the M2M permission of a Lerian service's credential); the message names it. Grant the access by adding people to one of the product's roles, or to a group that role is granted to. Permissions earlier in the list are already added. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: addRolePermissions parameters: - description: Role ID. in: path name: id required: true schema: description: Role ID. examples: - midaz-editor type: string requestBody: content: application/json: schema: $ref: "#/components/schemas/AssignPermissionsInput" description: The permissions to add to the role. required: true responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Add Permissions to a Role tags: - Roles x-mint: href: /pt/reference/platform/access-manager/assigns-permissions-to-a-role /v1/roles/{id}/permissions/remove: post: description: |- Narrows a role by several permissions at once, naming them in the body. It is a POST rather than a DELETE because the permissions travel in a request body; `DELETE /v1/roles/{id}/permissions/{permId}` does the same for exactly one. Both exist and both are supported. Removing an existing permission the role does not carry is not an error. On success the response has no body (204). Failures: - `400` — `permissions` is missing or empty. - `404` — one of the permissions does not exist. - `422 IDE-1066` — a permission holding the role is declared by a Lerian product, which alone decides the roles that hold it (this includes the M2M permission of a Lerian service's credential); the message names it. Change who has the access by adding or removing people on the role, or in a group it is granted to; a machine permission has no client-side change. Permissions earlier in the list are already removed. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: removeRolePermissionsBatch parameters: - description: Role ID. in: path name: id required: true schema: description: Role ID. examples: - midaz-editor type: string requestBody: content: application/json: schema: $ref: "#/components/schemas/AssignPermissionsInput" description: The permissions to remove from the role. required: true responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Remove Permissions from a Role in Batch tags: - Roles x-mint: href: /pt/reference/platform/access-manager/removes-multiple-permissions-from-a-role-batch /v1/roles/{id}/permissions/{permId}: delete: description: |- Takes one permission out of one role. `{id}` is the ROLE and `{permId}` is the PERMISSION — both are slugs, so the order of the two is what tells them apart, and swapping them narrows something nobody asked to narrow. The batch form, `POST /v1/roles/{id}/permissions/remove`, does the same for a list. Removing an existing permission the role does not carry is not an error. On success the response has no body (204). Failures: - `404` — the permission does not exist. - `422 IDE-1066` — the permission is declared by a Lerian product, which alone decides the roles that hold it (this includes the M2M permission of a Lerian service's credential), and it holds the role. Change who has the access by adding or removing people on the role, or in a group it is granted to; a machine permission has no client-side change. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: removeRolePermission parameters: - description: Role ID. in: path name: id required: true schema: description: Role ID. examples: - midaz-editor type: string - description: Permission ID. in: path name: permId required: true schema: description: Permission ID. examples: - midaz-editor-permission type: string responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Remove one Permission from a Role tags: - Roles x-mint: href: /pt/reference/platform/access-manager/removes-a-single-permission-from-a-role /v1/roles/{id}/users: post: description: |- Gives one or more people a role directly, without putting them in a group. This is the exception rather than the rule: the usual path is to grant the role to a group (`POST /v1/roles/{id}/groups`) and put people in it. Use it for a genuinely individual case. Granting it to somebody who already holds it is not an error. On success the response has no body (204). Failures: - `400` — `users` is missing or empty. - `404` — no such role in your organization, or one of the users does not exist. - `422 IDE-1061` — the role is reserved for machine credentials; no person may hold it. Revoking it stays open. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: grantRoleToUsers parameters: - description: Role ID. in: path name: id required: true schema: description: Role ID. examples: - midaz-editor type: string requestBody: content: application/json: schema: $ref: "#/components/schemas/AssignUsersInput" description: The users to grant the role to. required: true responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Grant a Role to Users tags: - Roles x-mint: href: /pt/reference/platform/access-manager/assigns-users-to-a-role /v1/roles/{id}/users/remove: post: description: |- Takes a role away from several people at once, naming them in the body. It is a POST rather than a DELETE because the people travel in a request body; `DELETE /v1/roles/{id}/users/{userId}` does the same for exactly one. Only the DIRECT grant is revoked. Somebody who also holds this role through a group keeps it, and the call still answers 204 — if the intent is to remove their access entirely, take them out of the group too. Revoking from somebody who does not hold the role is not an error. On success the response has no body (204). Failures: - `400` — `users` is missing or empty. - `404` — no such role in your organization. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: revokeRoleFromUsersBatch parameters: - description: Role ID. in: path name: id required: true schema: description: Role ID. examples: - midaz-editor type: string requestBody: content: application/json: schema: $ref: "#/components/schemas/AssignUsersInput" description: The users to revoke the role from. required: true responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Revoke a Role from Users in Batch tags: - Roles x-mint: href: /pt/reference/platform/access-manager/removes-multiple-users-from-a-role-batch /v1/roles/{id}/users/{userId}: delete: description: |- Takes a role away from one person. `{id}` is the ROLE and `{userId}` is the PERSON — the order of the two matters, and swapping them revokes a grant nobody asked to revoke. The batch form, `POST /v1/roles/{id}/users/remove`, does the same for a list. Only the DIRECT grant is revoked: if the person also holds this role through a group they keep it, and the call still answers 204. Revoking from somebody who does not hold the role is not an error. On success the response has no body (204). Failures: - `404` — no such role in your organization. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: revokeRoleFromUser parameters: - description: Role ID. in: path name: id required: true schema: description: Role ID. examples: - midaz-editor type: string - description: User ID. in: path name: userId required: true schema: description: User ID. examples: - 00000000-0000-0000-0000-000000000000 type: string responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Revoke a Role from one User tags: - Roles x-mint: href: /pt/reference/platform/access-manager/removes-a-single-user-from-a-role /v1/scope-catalog: get: description: |- Returns, for every product that has published one, the dimensions a partner can be scoped on in that product — the WHERE half of a partner, next to the collections and verbs of its permissions. Each product declares its own catalog when it starts, so the list follows the products actually deployed; a product absent from it publishes none. Called when a partner editor opens, to render one picker per dimension in tree order (the first dimension is the top of the funnel; each later one narrows inside it). The rules a partner write is held to come from here: a `required` dimension must have a scope line (`IDE-0001`), a dimension that is not `multi` takes one value (`IDE-0002`), and listing or creating in a dimension's `collection` is denied to a partner scoped on it, because that is where its siblings live. Read-only and global: the catalog describes the product, not your organization, so every caller sees the same list. Failures: - `403` — your token does not hold the `partners` resource. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: listScopeCatalogs responses: "200": content: application/json: schema: $ref: "#/components/schemas/ScopeCatalogList" description: OK "500": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Internal Server Error "503": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Service Unavailable default: content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Error security: - BearerAuth: [] summary: List scope catalogs tags: - Partners x-mint: href: /pt/reference/platform/access-manager/list-scope-catalogs /v1/scope-catalog/{product}: get: description: |- Returns the dimensions one product lets a partner be scoped on, in tree order, with the rules each one carries: `required`, `multi`, and the `collection` its siblings live in. `name` is the value to send as `field` on a partner's `scope` line; values are the product's own identifiers (as its list APIs return them) and are not checked for existence. Called by a partner editor that already knows which product it is scoping, and before a create or an update to know which lines the write will need. Read-only and global: the same for every organization. Failures: - `404 IDE-1053` — the product has not published a scope catalog. None of its partners can be scoped until it does. - `403` — your token does not hold the `partners` resource. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: getScopeCatalog parameters: - description: Product slug, as returned by GET /v1/applications/available. in: path name: product required: true schema: description: Product slug, as returned by GET /v1/applications/available. examples: - midaz minLength: 1 type: string responses: "200": content: application/json: schema: $ref: "#/components/schemas/ScopeCatalog" description: OK "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Internal Server Error "503": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Service Unavailable default: content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Error security: - BearerAuth: [] summary: Retrieve a product's scope catalog tags: - Partners x-mint: href: /pt/reference/platform/access-manager/retrieve-a-product-s-scope-catalog /v1/security/ip-allowlist: get: description: |- Returns the IP addresses and CIDR blocks your organization accepts requests from, and which surfaces that restriction is enforced on. An EMPTY `entries` list means the allowlist is OFF; read it as "not enforcing", never as "locked down". The organization is resolved from your token. There is no parameter naming another one, so this cannot read someone else's allowlist. Read-only: nothing changes. Failures: - `403` — two different failures share this status, so read the `code`. `AUT-1020` is a permissions problem: your token lacks the `security` resource. With `AUT-0021` it is the LOCKOUT case: your own address is outside the allowlist you are trying to read. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: getIPAllowlist responses: "200": content: application/json: schema: $ref: "#/components/schemas/IPAllowlistResponse" description: OK "401": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Forbidden "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Get Organization IP Allowlist tags: - Security x-mint: href: /pt/reference/platform/access-manager/get-organization-ip-allowlist put: description: |- Replaces the addresses your organization accepts requests from. ⚠️ THIS IS THE CALL THAT CAN LOCK YOU OUT. Read `GET /v1/security/ip-allowlist` first, and keep your own address in the list. `entries` is REQUIRED and replaces the stored list wholesale — there is no per-entry merge. Bare addresses are widened to host routes (`/32`, `/128`) and CIDRs are canonicalized on save, so what you read back may be spelled differently from what you sent. An explicit EMPTY list turns the allowlist OFF; omitting the member is a `400`, never a silent wipe. Each entry is either a bare string (`"203.0.113.0/24"`) or a labeled object (`{"cidr": "203.0.113.0/24", "description": "São Paulo office"}`), and the two forms can be mixed. A string is stored with an empty description. Only `cidr` is validated and only `cidr` decides whether a request is allowed; `description` is free text for your administrators and is stored as sent. When the same network appears twice, the first entry — and its description — is kept. `scopes` is the member to be careful with, because it has THREE meanings: - OMIT it — the surfaces currently enforced are left exactly as they are. - Send `[]` — enforcement is turned off on every surface, while the entries stay stored. - Send values — enforcement applies to exactly those surfaces. So an entries-only update must OMIT `scopes`. Failures: - `400 IDE-0036` — an entry is not a valid IP or CIDR, or a labeled entry has no `cidr`. The message names the offending value. - `400` — a scope is not one this deployment enforces, or `entries` was omitted. - `403` — as on the read: `AUT-1020`, a permissions problem, or `AUT-0021`, the lockout case. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: setIPAllowlist requestBody: content: application/json: schema: $ref: "#/components/schemas/IPAllowlistInput" description: The allowlist to store. entries is required; omitting scopes leaves the enforcement surfaces unchanged. required: true responses: "200": content: application/json: schema: $ref: "#/components/schemas/IPAllowlistResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Forbidden "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Set Organization IP Allowlist tags: - Security x-mint: href: /pt/reference/platform/access-manager/set-organization-ip-allowlist /v1/sso/policy: patch: description: |- Failures: - `400` — the policy payload is malformed. - `404` — the application backing your organization's login was not found. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: setSSOPolicy requestBody: content: application/json: schema: $ref: "#/components/schemas/SSOPolicyInput" description: The login policy to apply to the caller's tenant. required: true responses: "200": content: application/json: schema: $ref: "#/components/schemas/SSOPolicyResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Update SSO login policy tags: - SSO x-mint: href: /pt/reference/platform/access-manager/update-sso-login-policy /v1/sso/provider: delete: description: |- Removes your organization's SSO provider configuration. ⚠️ Sign-in through that provider stops working immediately. Unlike the other deletes in this API, this one answers `200`, not `204`. Failures: - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: deleteSSOProvider responses: "200": content: application/json: schema: $ref: "#/components/schemas/SSOProviderConfigResponse" description: OK "401": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Delete SSO provider configuration tags: - SSO x-mint: href: /pt/reference/platform/access-manager/delete-sso-provider-configuration get: description: |- Returns your organization's SSO provider configuration — the identity provider your people sign in through. A tenant has AT MOST ONE active OAuth provider, so this route needs no id: it reads the one belonging to the organization resolved from your token, and cannot be pointed at another tenant's. It is a composed view over the generic `/v1/providers` catalog, which is still where Email and SMS providers are managed. Read-only: nothing changes. Failures: - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: getSSOProvider responses: "200": content: application/json: schema: $ref: "#/components/schemas/SSOProviderConfigResponse" description: OK "401": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Get SSO provider configuration tags: - SSO x-mint: href: /pt/reference/platform/access-manager/get-sso-provider-configuration put: description: |- Creates or REPLACES your organization's SSO provider configuration. ⚠️ A configuration that is accepted here but wrong at the identity provider locks people out at the login screen. Validate the configuration first with `POST /v1/sso/provider/preflight`, which writes nothing. Failures: - `400` — the configuration is malformed. - `409 IDE-1069` — your organization offers passkey sign-in; turn passkeys off (`PATCH /v1/passkey/policy`) before configuring SSO. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: upsertSSOProvider requestBody: content: application/json: schema: $ref: "#/components/schemas/SSOProviderConfigInput" description: The SSO provider configuration to store. required: true responses: "200": content: application/json: schema: $ref: "#/components/schemas/SSOProviderConfigResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Conflict "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Upsert SSO provider configuration tags: - SSO x-mint: href: /pt/reference/platform/access-manager/upsert-sso-provider-configuration /v1/sso/provider/preflight: post: description: |- Validates a candidate SSO configuration and WRITES NOTHING. Call it before `PUT /v1/sso/provider`. The upsert is the call that can lock an organization out of its own login screen; this one costs nothing, so there is no reason to skip it. The response is a report, not a yes/no: it names what it could and could not verify. Failures: - `400` — the candidate configuration is malformed enough that it cannot be checked at all. operationId: preflightSSOProvider requestBody: content: application/json: schema: $ref: "#/components/schemas/SSOProviderConfigInput" description: The candidate configuration to validate. Nothing is stored. required: true responses: "200": content: application/json: schema: $ref: "#/components/schemas/SSOProviderPreflight" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Preflight an SSO provider configuration tags: - SSO x-mint: href: /pt/reference/platform/access-manager/preflight-an-sso-provider-configuration /v1/users: get: description: |- Returns your organization's users, one page at a time, each with the groups it belongs to and its MFA status. Called whenever the user list is shown, and after any create or delete to refresh it. `name`, `roleId` and `groupId` narrow the page; they combine, and an empty value is ignored. Read-only: nothing changes. Only users of the organization resolved from your token are ever returned; there is no parameter that widens that. ⚠️ `mfa` is TRI-STATE on this route and the null is meaningful: it means the per-user MFA read did not complete, NOT that the member has no MFA. Render it as unknown. The single-user read (`GET /v1/users/{id}`) always resolves it. Failures: - `400 IDE-0018` — `limit` is above the deployment's maximum (100 by default). - `400 IDE-0019` — `page` is below 1. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: listUsers parameters: - description: Page number. explode: false in: query name: page schema: default: 1 description: Page number. examples: - 1 format: int64 type: integer - description: Items per page. explode: false in: query name: limit schema: default: 10 description: Items per page. examples: - 10 format: int64 type: integer - description: Filter by name (case-insensitive substring). explode: false in: query name: name schema: description: Filter by name (case-insensitive substring). type: string - description: Filter by role ID (relational listing). explode: false in: query name: roleId schema: description: Filter by role ID (relational listing). type: string - description: Filter by group ID (relational listing). explode: false in: query name: groupId schema: description: Filter by group ID (relational listing). type: string responses: "200": content: application/json: schema: $ref: "#/components/schemas/UserPagination" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: List Users tags: - Users x-mint: href: /pt/reference/platform/access-manager/list-users post: description: |- Creates a user in your organization and places it in the groups you name, which is what gives it its permissions. This is the first call in a member's life cycle. The password you supply is the initial one; the member changes it through `PATCH /v1/users/{id}/update-password`, and an administrator resets it through `PATCH /v1/users/{id}/reset-password`. `phone` and `countryCode` travel TOGETHER — the identity provider validates the number against the country and refuses an unresolvable pair. Failures: - `400` — a required member is missing, or `email`/`phone` is malformed. - `409 IDE-0017` — the username or e-mail already belongs to another user. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: createUser requestBody: content: application/json: schema: $ref: "#/components/schemas/UserInput" description: The user to create. required: true responses: "201": content: application/json: schema: $ref: "#/components/schemas/UserResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Conflict "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Create a user tags: - Users x-mint: href: /pt/reference/platform/access-manager/create-user /v1/users/forgot-password/reset: post: description: |- Spends the code mailed by `POST /v1/users/forgot-password/send-code` and sets the new password. PUBLIC: no bearer token, by design. Available only where the deployment enables password recovery. Second and last call of the flow. The code is single-use and expires; a wrong or stale code is refused and the password is unchanged. On success the response has no body (204) and the member can sign in with the new password. Failures: - `400` — the code is wrong or expired, or the new password fails the password policy. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: resetForgotPassword requestBody: content: application/json: schema: $ref: "#/components/schemas/ForgotPasswordResetInput" description: The emailed code and the replacement password. required: true responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable summary: Reset a password with a verification code tags: - Users x-mint: href: /pt/reference/platform/access-manager/reset-a-password-with-a-verification-code /v1/users/forgot-password/send-code: post: description: |- Mails a one-time code to a member who cannot sign in. PUBLIC: this route takes NO bearer token, because the caller has no way to obtain one. Available only where the deployment enables password recovery. First of two calls. The second is `POST /v1/users/forgot-password/reset`, which spends the code and sets the new password. Possession of the emailed code is the only credential in the flow. On success the response has no body (204). It answers the same way whether or not the address belongs to a known member, so the route cannot be used to enumerate them. Failures: - `400` — the e-mail is missing or malformed. operationId: sendForgotPasswordCode requestBody: content: application/json: schema: $ref: "#/components/schemas/ForgotPasswordSendCodeInput" description: Who is asking to reset their password. required: true responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable summary: Request a password reset code tags: - Users x-mint: href: /pt/reference/platform/access-manager/request-a-password-reset-code /v1/users/{id}: delete: description: |- Removes a user permanently. Its group and role memberships go with it; nothing else in the organization changes. On success the response has no body (204). Failures: - `400` — `{id}` is not a UUID. - `404` — no such user in your organization. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: deleteUser parameters: - description: User ID. in: path name: id required: true schema: description: User ID. examples: - 00000000-0000-0000-0000-000000000000 type: string responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Delete a user tags: - Users x-mint: href: /pt/reference/platform/access-manager/delete-user get: description: |- Returns one user's full administrative record: identity, contact details, and the groups it holds. Called to open a user's detail screen, and before a PATCH. A member reading their OWN record uses `GET /v1/users/{id}/profile` instead, which returns a reduced projection and does not require an administrator's role. Read-only: nothing changes. Only users of the organization resolved from your token are returned. Failures: - `400` — `{id}` is not a UUID. - `404` — no such user in your organization. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: getUser parameters: - description: User ID. in: path name: id required: true schema: description: User ID. examples: - 00000000-0000-0000-0000-000000000000 type: string responses: "200": content: application/json: schema: $ref: "#/components/schemas/UserResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Retrieve User details tags: - Users x-mint: href: /pt/reference/platform/access-manager/retrieve-user-details patch: description: |- Changes a user's identity and contact details, and its group membership. This is the ADMINISTRATIVE merge and it can touch e-mail, name and group membership at once. A member changing their own phone number uses `PATCH /v1/users/{id}/phone` instead, which writes only those two fields — routing a self-service form through this merge would put group membership inside its blast radius. An empty `phone` here is IGNORED, not cleared; clearing is `DELETE /v1/users/{id}/phone`. The response echoes the members you submitted, not a re-read of the record. Failures: - `400` — `{id}` is not a UUID, or a supplied member is malformed. - `404` — no such user in your organization. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: updateUser parameters: - description: User ID. in: path name: id required: true schema: description: User ID. examples: - 00000000-0000-0000-0000-000000000000 type: string requestBody: content: application/json: schema: $ref: "#/components/schemas/UserUpdateInput" description: The user members to update. required: true responses: "200": content: application/json: schema: $ref: "#/components/schemas/UserUpdateInput" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Update a user tags: - Users x-mint: href: /pt/reference/platform/access-manager/update-user /v1/users/{id}/effective-permissions: get: description: |- Called to answer "why can this person do that?" without walking groups and roles by hand. It is the resolved view. Read-only: nothing changes. Failures: - `400` — the request could not be read. - `404` — no such user in your organization. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: getUserEffectivePermissions parameters: - description: User ID. in: path name: id required: true schema: description: User ID. examples: - 00000000-0000-0000-0000-000000000000 type: string responses: "200": content: application/json: schema: items: $ref: "#/components/schemas/EffectivePermissionResponse" type: array description: OK "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Get user effective permissions tags: - Users x-mint: href: /pt/reference/platform/access-manager/get-effective-permissions /v1/users/{id}/mfa: delete: description: |- Turns OFF every second factor on the account at once. After this a password alone signs the member in. SELF-SERVICE ONLY: `{id}` must be the caller's own user id. An administrative role does not open this route for somebody else, and there is no administrative equivalent of it. To clear somebody else's factors, an administrator removes them one at a time with `DELETE /v1/users/{id}/mfa/admin/{mfaType}` — including a legacy `sms` enrollment, which is what unblocks `DELETE /v1/users/{id}/phone`. To remove one channel and keep the others, use `DELETE /v1/users/{id}/mfa/{mfaType}` instead — this route is the whole-account switch and does not ask which. The body carries a 6-digit `code` proving an ENABLED factor: the member's preferred method when it is enabled, otherwise their only enabled one, and the authenticator when both are enabled with no usable preference. For `app` it is the current passcode from their authenticator app; for `email`, the code mailed by `POST /v1/users/{id}/mfa/disable/challenge`. A mailed code never proves the reset for a member without the `email` channel enabled. The code is checked after the account-state refusals, so a request that was going to fail anyway never spends it. On success the response has no body (204). Failures: - `400 IDE-0007` / `IDE-0001` / `IDE-0002` — the body is missing or malformed. - `400 IDE-0041` — MFA is not enabled on the account, or only a legacy `sms` enrollment is left (clear it with `DELETE /v1/users/{id}/mfa/sms`). - `400 IDE-0042` — the code is wrong (or, for `app`, already used). - `400 IDE-0060` — no live mailed code: none was requested, it expired, or it was spent. - `400 IDE-0061` — the mailed code was answered wrongly too many times; request a new one. - `400 IDE-0063` — the authorization server locked authenticator verification; wait. - `400 IDE-0045` — the MFA operation could not be completed. - `404 IDE-0013` — `{id}` is not the token's subject. Distinct from `IDE-0057`, the 403 the self-scope guard raises on the profile routes. - `404` — no such user. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: disableMFA parameters: - description: User ID. in: path name: id required: true schema: description: User ID. examples: - 00000000-0000-0000-0000-000000000000 type: string requestBody: content: application/json: schema: $ref: "#/components/schemas/MFADisableInput" description: Confirmation code proving the preferred method. required: true responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Unauthorized "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Disable MFA tags: - MFA x-mint: href: /pt/reference/platform/access-manager/disable-mfa get: description: |- Returns which second factors the account holds, which is preferred, and whether MFA is on at all. This is the read a member makes about their own account — the self-service profile (`GET /v1/users/{id}/profile`) deliberately leaves MFA out and points here. Read-only. The response carries `Cache-Control: no-store`: knowing which factors an account holds is exactly what an attacker wants before choosing an approach. Failures: - `404` — no such user. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: getMFAStatus parameters: - description: User ID. in: path name: id required: true schema: description: User ID. examples: - 00000000-0000-0000-0000-000000000000 type: string responses: "200": content: application/json: schema: $ref: "#/components/schemas/MFAStatusResponse" description: OK headers: Cache-Control: schema: type: string "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Get MFA Status tags: - MFA x-mint: href: /pt/reference/platform/access-manager/get-mfa-status /v1/users/{id}/mfa/admin/enable: post: description: |- Enables a second factor on ANOTHER member's account, and returns that member's recovery codes. `{id}` is the TARGET — the member being protected — not the administrator. The administrator is identified by the token. This is the route for onboarding someone who cannot complete enrollment themselves, and it skips the three-step self-service flow entirely: there is no device to prove, so nothing is verified. That is why it is granted to administrative roles only. ⚠️ The response body IS the target member's credential and is shown once. Hand it to them over a channel you trust. Failures: - `400` — the channel is unknown, or the target account lacks what it needs. - `403` — your token does not hold the administrative MFA resource. - `404` — no such user. - `409` — that channel is already enabled for the target. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: adminEnableMFA parameters: - description: Target User ID — the member whose MFA is being enabled, NOT the administrator. in: path name: id required: true schema: description: Target User ID — the member whose MFA is being enabled, NOT the administrator. examples: - 00000000-0000-0000-0000-000000000000 type: string requestBody: content: application/json: schema: $ref: "#/components/schemas/MFAAdminEnableInput" description: Which channel to enable on the target account. required: true responses: "200": content: application/json: schema: $ref: "#/components/schemas/MFARecoveryCodesResponse" description: OK headers: Cache-Control: schema: type: string "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Conflict "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Admin Enable MFA tags: - MFA x-mint: href: /pt/reference/platform/access-manager/admin-enable-mfa /v1/users/{id}/mfa/admin/{mfaType}: delete: description: |- Turns off one of ANOTHER member's channels — the route for a member locked out by a lost device, or by a legacy `sms` enrollment. `{id}` is the TARGET, not the administrator. `app`, `email` and `sms` are all accepted. `sms` is CLEARING ONLY — the channel is retired and cannot be re-enrolled — and this is the only route that can clear it for somebody else: the whole-account reset `DELETE /v1/users/{id}/mfa` refuses an administrator's token, and a member holding only a legacy `sms` enrollment cannot sign in to obtain their own. Clearing it also unblocks `DELETE /v1/users/{id}/phone`. ⚠️ This LOWERS someone else's protection without their participation, and it is the step an attacker who reaches an administrative token would take first. No confirmation code is taken, by design: an administrator holds neither the member's authenticator nor their mailbox, so there is no code they could legitimately produce. The administrative MFA resource is what authorizes this route. On success the response has no body (204). Failures: - `400` — the channel name is not one this deployment serves. - `403` — your token does not hold the administrative MFA resource. - `404` — no such user. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: adminDisableMFA parameters: - description: Target User ID — the member whose channel is being disabled, NOT the administrator. in: path name: id required: true schema: description: Target User ID — the member whose channel is being disabled, NOT the administrator. examples: - 00000000-0000-0000-0000-000000000000 type: string - description: "Which channel to disable: app, email, or sms (a legacy enrollment that can be cleared but never re-enrolled)." in: path name: mfaType required: true schema: description: "Which channel to disable: app, email, or sms (a legacy enrollment that can be cleared but never re-enrolled)." examples: - app type: string responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Admin Disable MFA tags: - MFA x-mint: href: /pt/reference/platform/access-manager/admin-disable-mfa /v1/users/{id}/mfa/disable/challenge: post: description: |- Mails a 6-digit confirmation code to the member's account e-mail, for the disables that are proven by e-mail: `DELETE /v1/users/{id}/mfa/email`, and `DELETE /v1/users/{id}/mfa` when e-mail is the factor that proves it. Only a member with the `email` channel enabled is sent one. The authenticator channel needs NO challenge — `DELETE /v1/users/{id}/mfa/app` is proven by the current passcode from the member's authenticator app — and a legacy `sms` clear needs no code at all. There is no request body: the destination is the address already on the account, never one the caller supplies. Self-service only; `{id}` must be the caller's own user id. Sends are budgeted per member. On success the response has no body (204). Failures: - `400 IDE-0041` — MFA is not enabled on the account. - `400 IDE-0048` — the account has no e-mail to send to. - `400 IDE-0049` — no disable on this account is proven by a mailed code: the `email` channel is not enabled (for example, an authenticator-only member, whatever their preference). - `400 IDE-0045` — the code could not be sent or the challenge could not be recorded. - `400 IDE-0062` — the send budget for the current window is spent; wait before asking again. - `404 IDE-0013` — `{id}` is not the token's subject. - `404` — no such user. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: initiateMFADisableChallenge parameters: - description: User ID. in: path name: id required: true schema: description: User ID. examples: - 00000000-0000-0000-0000-000000000000 type: string responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Unauthorized "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Request an MFA disable confirmation code tags: - MFA x-mint: href: /pt/reference/platform/access-manager/request-an-mfa-disable-confirmation-code /v1/users/{id}/mfa/enable: post: description: |- Turns a VERIFIED channel on. From here the account is protected: the next sign-in asks for the second factor. Third and last of the enrollment calls. Before doing this, make sure the recovery codes have been stored. On success the response has no body (204). Failures: - `400` — the channel was never verified. - `404` — no such user. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: enableMFA parameters: - description: User ID. in: path name: id required: true schema: description: User ID. examples: - 00000000-0000-0000-0000-000000000000 type: string requestBody: content: application/json: schema: $ref: "#/components/schemas/MFAEnableInput" description: Which verified channel to enable. required: true responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Conflict "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Enable MFA tags: - MFA x-mint: href: /pt/reference/platform/access-manager/enable-mfa /v1/users/{id}/mfa/preferred: patch: description: |- Chooses which enabled channel is offered first at sign-in. It changes the order, never what is enabled — nothing is turned on or off here, and the account is exactly as protected afterwards. On success the response has no body (204). Failures: - `400` — that channel is not enabled on the account. - `404` — no such user. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: setPreferredMFA parameters: - description: User ID. in: path name: id required: true schema: description: User ID. examples: - 00000000-0000-0000-0000-000000000000 type: string requestBody: content: application/json: schema: $ref: "#/components/schemas/MFAPreferredInput" description: Which enabled channel to prefer. required: true responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Set Preferred MFA Method tags: - MFA x-mint: href: /pt/reference/platform/access-manager/set-preferred-mfa-method /v1/users/{id}/mfa/recovery-codes: post: description: |- Issues a fresh set of recovery codes and INVALIDATES the previous set immediately. ⚠️ The response body IS the credential. These codes bypass every second factor, they are returned once and never again, and anyone holding one can sign in without the device. Store them where the account's password is stored, not next to it. Call this when the old set was used up, exposed, or lost. The response carries `Cache-Control: no-store`. Failures: - `400` — MFA is not enabled on the account, so there is nothing to recover. - `404` — no such user. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: regenerateMFARecoveryCodes parameters: - description: User ID. in: path name: id required: true schema: description: User ID. examples: - 00000000-0000-0000-0000-000000000000 type: string responses: "200": content: application/json: schema: $ref: "#/components/schemas/MFARecoveryCodesResponse" description: OK headers: Cache-Control: schema: type: string "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Unauthorized "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Regenerate MFA Recovery Codes tags: - MFA x-mint: href: /pt/reference/platform/access-manager/regenerate-mfa-recovery-codes /v1/users/{id}/mfa/setup: post: description: |- Begins enrolling one second factor and returns what the device needs to complete it — for an authenticator app, the secret and its QR code; for e-mail, a code is sent to the address already on the account. Two channels are served: `app` and `email`. SMS is not one of them, and asking for it is refused. First of THREE calls, and none of them alone protects anything: setup, then `POST /v1/users/{id}/mfa/verify` to prove the device works, then `POST /v1/users/{id}/mfa/enable` to turn it on. A channel left after step one or two is not protecting the account. Failures: - `400` — the channel is not one this service serves. - `404` — no such user. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: setupMFA parameters: - description: User ID. in: path name: id required: true schema: description: User ID. examples: - 00000000-0000-0000-0000-000000000000 type: string requestBody: content: application/json: schema: $ref: "#/components/schemas/MFASetupInput" description: Which channel to enrol. required: true responses: "200": content: application/json: schema: $ref: "#/components/schemas/MFASetupResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Initiate MFA Setup tags: - MFA x-mint: href: /pt/reference/platform/access-manager/initiate-mfa-setup /v1/users/{id}/mfa/verify: post: description: |- Proves the enrolling device works, by sending back the code it produced or received. Second of the three enrollment calls. It does NOT turn the factor on — `POST .../mfa/enable` does. Verifying and stopping there leaves the account exactly as protected as before. On success the response has no body (204). Failures: - `400` — the code is wrong or expired. - `404` — no such user. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: verifyMFA parameters: - description: User ID. in: path name: id required: true schema: description: User ID. examples: - 00000000-0000-0000-0000-000000000000 type: string requestBody: content: application/json: schema: $ref: "#/components/schemas/MFAVerifyInput" description: The code produced by the enrolling device. required: true responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Verify MFA Setup tags: - MFA x-mint: href: /pt/reference/platform/access-manager/verify-mfa-passcode /v1/users/{id}/mfa/{mfaType}: delete: description: |- Turns off ONE channel — `app`, `email`, or a legacy `sms` enrollment — and leaves the others in place. The body carries a 6-digit `code` that must prove THE CHANNEL BEING REMOVED: for `app`, the current passcode from the member's authenticator (there is no challenge step); for `email`, the code mailed by `POST /v1/users/{id}/mfa/disable/challenge`. Neither channel accepts the other's code. `sms` is accepted for CLEARING ONLY. The channel was retired: it cannot be enrolled, cannot be chosen as the preferred method, and is never offered at sign-in. An enrollment recorded before the retirement can still be removed here, which is also what unblocks `DELETE /v1/users/{id}/phone`. It is the ONE channel that needs no code and no body: SMS is refused at sign-in, and there is no SMS proof to demand. A member whose ONLY factor is a legacy `sms` enrollment cannot sign in to call this route themselves — an administrator clears it for them with `DELETE /v1/users/{id}/mfa/admin/sms`. Removing the last enabled channel leaves the account with no second factor, the same end state as `DELETE /v1/users/{id}/mfa`, so check `GET /v1/users/{id}/mfa` first if that is not the intention. On success the response has no body (204). Failures: - `400` — the channel name is not one this deployment serves. - `400 IDE-0007` / `IDE-0001` / `IDE-0002` — `app` or `email` with the body missing or malformed. - `400 IDE-0042` — the code is wrong (or, for `app`, already used). - `400 IDE-0060` — `email` with no live mailed code: none was requested, it expired, or it was spent. - `400 IDE-0061` — the mailed code was answered wrongly too many times; request a new one. - `400 IDE-0063` — the authorization server locked authenticator verification; wait. - `400 IDE-0045` — the MFA operation could not be completed. - `404` — no such user. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: disableMFAChannel parameters: - description: User ID. in: path name: id required: true schema: description: User ID. examples: - 00000000-0000-0000-0000-000000000000 type: string - description: "Which channel to disable: app, email, or sms (a legacy enrollment that can be cleared but never re-enrolled)." in: path name: mfaType required: true schema: description: "Which channel to disable: app, email, or sms (a legacy enrollment that can be cleared but never re-enrolled)." examples: - app type: string requestBody: content: application/json: schema: $ref: "#/components/schemas/MFADisableInput" description: Confirmation code proving the channel being removed. Required for app and email; omitted for sms. responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Unauthorized "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Disable a single MFA channel tags: - MFA x-mint: href: /pt/reference/platform/access-manager/disable-a-single-mfa-channel /v1/users/{id}/passkeys: delete: description: |- Removes the account's passkey. `removed` is false when there was none; that is not an error. Allowed while the organization's passkey option is off. SELF-SERVICE ONLY: `{id}` must be the caller's own user id, and the call carries the caller's own token. Needs a sign-in of the last few minutes (`PASSKEY_RECENT_AUTH_SEC`, 600 seconds by default). Failures: - `403 IDE-1070` — the sign-in is not recent enough; sign in again. - `404 IDE-0013` — `{id}` is not the caller. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: deletePasskey parameters: - description: Caller's own User ID. in: path name: id required: true schema: description: Caller's own User ID. examples: - 00000000-0000-0000-0000-000000000000 type: string responses: "200": content: application/json: schema: $ref: "#/components/schemas/PasskeyRemoveResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Delete Passkey tags: - Passkey x-mint: href: /pt/reference/platform/access-manager/delete-passkey get: description: |- Says whether the account has a passkey, how its authenticator is reached, and whether the organization offers passkey sign-in (`enabled`). It answers whether the option is on or off. SELF-SERVICE ONLY: `{id}` must be the caller's own user id, and the call carries the caller's own token. The response carries `Cache-Control: no-store`. Failures: - `404 IDE-0013` — `{id}` is not the caller. - `404` — no such user, or the organization has no default application. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: getPasskey parameters: - description: Caller's own User ID. in: path name: id required: true schema: description: Caller's own User ID. examples: - 00000000-0000-0000-0000-000000000000 type: string responses: "200": content: application/json: schema: $ref: "#/components/schemas/PasskeyStatusResponse" description: OK headers: Cache-Control: schema: type: string "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Get Passkey tags: - Passkey x-mint: href: /pt/reference/platform/access-manager/get-passkey /v1/users/{id}/passkeys/begin: post: description: |- First of two calls that add a passkey. Answers the WebAuthn creation options for `navigator.credentials.create` and an `enrollmentToken`; send both the token and the created credential to `POST /v1/users/{id}/passkeys/finish` within 5 minutes. SELF-SERVICE ONLY: `{id}` must be the caller's own user id, and the call carries the caller's own token. One passkey per account. Needs a sign-in of the last few minutes (`PASSKEY_RECENT_AUTH_SEC`, 600 seconds by default). The response carries `Cache-Control: no-store`. Failures: - `403 IDE-1070` — the sign-in is not recent enough; sign in again. - `404 IDE-0013` — `{id}` is not the caller. - `409 IDE-1073` — the organization does not offer passkey sign-in. - `409 IDE-1071` — the account already has a passkey. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: beginPasskeyEnrollment parameters: - description: Caller's own User ID. in: path name: id required: true schema: description: Caller's own User ID. examples: - 00000000-0000-0000-0000-000000000000 type: string responses: "200": content: application/json: schema: $ref: "#/components/schemas/PasskeyEnrollBeginResponse" description: OK headers: Cache-Control: schema: type: string "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Conflict "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Begin Passkey Enrollment tags: - Passkey x-mint: href: /pt/reference/platform/access-manager/begin-passkey-enrollment /v1/users/{id}/passkeys/finish: post: description: |- Second of two calls that add a passkey: sends the credential the browser created, with the `enrollmentToken` the begin answered. An enrollment works once. SELF-SERVICE ONLY: `{id}` must be the caller's own user id, and the call carries the caller's own token. Failures: - `400 IDE-1072` — the enrollment is unknown, expired, already used or begun by another user, the credential is empty, or the identity provider refused the credential; begin again. - `400` — the body is malformed. - `404 IDE-0013` — `{id}` is not the caller. - `409 IDE-1071` — the account already has a passkey. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: finishPasskeyEnrollment parameters: - description: Caller's own User ID. in: path name: id required: true schema: description: Caller's own User ID. examples: - 00000000-0000-0000-0000-000000000000 type: string requestBody: content: application/json: schema: $ref: "#/components/schemas/PasskeyEnrollFinishInput" description: The enrollment token and the credential the browser created. required: true responses: "200": content: application/json: schema: $ref: "#/components/schemas/PasskeyEnrollFinishResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Conflict "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Finish Passkey Enrollment tags: - Passkey x-mint: href: /pt/reference/platform/access-manager/finish-passkey-enrollment /v1/users/{id}/permissions: get: description: |- Returns only what was granted to this person DIRECTLY, as a plain array — this listing is NOT paginated. Read this one when you want to know what an administrator attached to the account itself. It is NOT the answer to "what can this person do?": permissions also arrive through roles and through groups, and those do not appear here: a permission is listed only when it names this user itself, never because a role held by the user or by one of their groups carries it. `GET /v1/users/{id}/effective-permissions` is the resolved view, with the source of each grant. Read-only: nothing changes. A person with no direct grants returns an empty array, not a 404. Failures: - `404` — no such user in your organization. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: listUserPermissions parameters: - description: User ID. in: path name: id required: true schema: description: User ID. examples: - 00000000-0000-0000-0000-000000000000 type: string responses: "200": content: application/json: schema: items: $ref: "#/components/schemas/PermissionResponse" type: array description: OK "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: List the Direct Permissions of a User tags: - Users x-mint: href: /pt/reference/platform/access-manager/returns-the-permissions-assigned-to-a-user post: description: |- Grants permissions straight to one person, bypassing roles and groups. Reach for this last. A direct grant has to be revoked person by person. The maintainable path is to grant the role to a group and manage membership. Granting a permission the person already holds directly is not an error. On success the response has no body (204). Failures: - `400` — `permissions` is missing or empty. - `404` — no such user in your organization, or one of the permissions does not exist. - `422 IDE-1061` — a permission is reserved for machine credentials; no person may hold it. Removing it stays open. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: addUserPermissions parameters: - description: User ID. in: path name: id required: true schema: description: User ID. examples: - 00000000-0000-0000-0000-000000000000 type: string requestBody: content: application/json: schema: $ref: "#/components/schemas/AssignPermissionsInput" description: The permissions to grant to the user. required: true responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Add Permissions to a User tags: - Users x-mint: href: /pt/reference/platform/access-manager/assigns-permissions-to-a-user /v1/users/{id}/permissions/remove: post: description: |- Revokes several direct grants, naming them in the body. It is a POST rather than a DELETE because the permissions travel in a request body; `DELETE /v1/users/{id}/permissions/{permId}` does the same for exactly one. Only the DIRECT grant goes. If the same permission also reaches the person through a role or a group, they keep it and the call still answers 204 — check `GET /v1/users/{id}/effective-permissions` afterwards if the intent was to take the ability away. Revoking a permission the person does not hold directly is not an error. On success the response has no body (204). Failures: - `400` — `permissions` is missing or empty. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: removeUserPermissionsBatch parameters: - description: User ID. in: path name: id required: true schema: description: User ID. examples: - 00000000-0000-0000-0000-000000000000 type: string requestBody: content: application/json: schema: $ref: "#/components/schemas/AssignPermissionsInput" description: The permissions to revoke from the user. required: true responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Remove Permissions from a User in Batch tags: - Users x-mint: href: /pt/reference/platform/access-manager/removes-multiple-permissions-from-a-user-batch /v1/users/{id}/permissions/{permId}: delete: description: |- Revokes one direct grant. `{id}` is the PERSON and `{permId}` is the PERMISSION — the order of the two matters, and swapping them revokes a grant nobody asked to revoke. The batch form, `POST /v1/users/{id}/permissions/remove`, does the same for a list. Only the DIRECT grant goes: if the permission also reaches the person through a role or group they keep it, and the call still answers 204. Revoking a permission the person does not hold directly is not an error. On success the response has no body (204). Failures: - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: removeUserPermission parameters: - description: User ID. in: path name: id required: true schema: description: User ID. examples: - 00000000-0000-0000-0000-000000000000 type: string - description: Permission ID. in: path name: permId required: true schema: description: Permission ID. examples: - midaz-editor-permission type: string responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Remove one Permission from a User tags: - Users x-mint: href: /pt/reference/platform/access-manager/removes-a-single-permission-from-a-user /v1/users/{id}/phone: delete: description: |- Clears the user's phone number and country code together. Idempotent: removing an already-absent phone succeeds. Refused while a legacy SMS MFA enrollment is still recorded for the user, because its codes were delivered to that number. This is NOT achievable through `PATCH /v1/users/{id}`, which ignores an empty phone by design. TWO kinds of caller reach this route and they are authorized differently: a member clearing their OWN number needs no administrative role, while anyone clearing SOMEONE ELSE'S needs the same grant that `PATCH /v1/users/{id}` requires. On success the response has no body (204). Failures: - `400` — `{id}` is not a UUID. - `401` — no bearer token. - `403` — you may not act on this user. - `404` — no such user. - `409 IDE-0056` — a legacy SMS MFA enrollment is still recorded for this user. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: deleteUserPhone parameters: - description: Target User ID. in: path name: id required: true schema: description: Target User ID. examples: - 00000000-0000-0000-0000-000000000000 type: string responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Conflict "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Remove user phone number tags: - Users x-mint: href: /pt/reference/platform/access-manager/remove-an-user-s-phone-number patch: description: |- Sets your phone number and country code. BOTH are required and they travel together: the identity provider validates the number against the country and refuses an unresolvable pair. This is the self-service twin of the administrative `PATCH /v1/users/{id}`. An empty phone here is refused with 400 rather than clearing anything — clearing is `DELETE /v1/users/{id}/phone`. Any authenticated member may call this for THEMSELVES; an `{id}` other than your token's subject is refused with `403 IDE-0057`. On success the response has no body (204). Failures: - `400` — `{id}` is not a UUID, or the number/country pair is malformed or empty. - `401` — no bearer token. - `403 IDE-0057` — `{id}` is not you. - `404` — no such user. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: updateOwnPhone parameters: - description: Caller's own User ID. in: path name: id required: true schema: description: Caller's own User ID. examples: - 00000000-0000-0000-0000-000000000000 type: string requestBody: content: application/json: schema: $ref: "#/components/schemas/UserPhoneInput" description: The phone number and country code, which travel together. required: true responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Set own user phone number tags: - Users x-mint: href: /pt/reference/platform/access-manager/set-the-caller-s-phone-number /v1/users/{id}/profile: get: description: |- Returns a REDUCED projection of your own record: id, name, username, e-mail, phone and country code. Groups, roles, permissions and MFA state are deliberately left out — read your MFA state from `GET /v1/users/{id}/mfa`, and the full record is the administrative `GET /v1/users/{id}`. Any authenticated member may call this, without an administrator's role — but only for THEMSELVES: an `{id}` other than your token's subject is refused with `403 IDE-0057`. Read-only: nothing changes. The response carries `Cache-Control: no-store`, because it holds your e-mail and phone number. Failures: - `400` — `{id}` is not a UUID. - `401` — no bearer token. - `403 IDE-0057` — `{id}` is not you. - `404` — no such user. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: getOwnProfile parameters: - description: Caller's own User ID. in: path name: id required: true schema: description: Caller's own User ID. examples: - 00000000-0000-0000-0000-000000000000 type: string responses: "200": content: application/json: schema: $ref: "#/components/schemas/OwnProfileResponse" description: OK headers: Cache-Control: schema: type: string "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Retrieve own user profile tags: - Users x-mint: href: /pt/reference/platform/access-manager/retrieve-the-caller-s-own-profile /v1/users/{id}/reset-password: patch: description: |- Sets a user's password WITHOUT the old one. This is the administrative reset, used when a member cannot sign in and cannot complete the e-mailed-code flow either. There is no possession check on this route — the authorization IS the check — so it is granted narrowly. On success the response has no body (204). Failures: - `400` — `{id}` is not a UUID, or the new password fails the password policy. - `404` — no such user. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: resetUserPassword parameters: - description: User ID. in: path name: id required: true schema: description: User ID. examples: - 00000000-0000-0000-0000-000000000000 type: string requestBody: content: application/json: schema: $ref: "#/components/schemas/UserResetPasswordInput" description: The replacement password. required: true responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Reset a user password tags: - Users x-mint: href: /pt/reference/platform/access-manager/reset-user-password /v1/users/{id}/tenants: get: description: |- Lists the tenants your e-mail has an active account in, oldest tenant first. Each item says whether it is your default tenant (`isDefault`, where your next sign-in goes), whether it is the tenant of the token making this request (`isCurrent`), and whether it has an active single sign-on provider (`ssoEnabled`). When you have no default tenant, every `isDefault` is false. Any authenticated member may call this for THEMSELVES; an `{id}` other than your token's subject is refused with `403 IDE-0057`. The e-mail is read from your own user record, never from the request. Read-only. The response carries `Cache-Control: no-store`. Failures: - `400` — `{id}` is not a UUID. - `401` — no bearer token. - `403 IDE-0057` — `{id}` is not you. - `404` — no such user. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: listOwnTenants parameters: - description: Caller's own User ID. in: path name: id required: true schema: description: Caller's own User ID. examples: - 00000000-0000-0000-0000-000000000000 type: string responses: "200": content: application/json: schema: $ref: "#/components/schemas/UserTenantsResponse" description: OK headers: Cache-Control: schema: type: string "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: List own tenants tags: - Users x-mint: href: /pt/reference/platform/access-manager/list-own-tenants /v1/users/{id}/tenants/default: put: description: |- Makes `tenantId` your default tenant: your next sign-in goes there. Setting the tenant that is already your default succeeds again. `tenantId` must be one of the tenants `GET /v1/users/{id}/tenants` lists. Any other value is refused with the same `403 IDE-0057` as another user's `{id}`, which does not say why. Any authenticated member may call this for THEMSELVES; an `{id}` other than your token's subject is refused with `403 IDE-0057`. On success the response has no body (204). Failures: - `400` — `{id}` is not a UUID, or `tenantId` is missing or empty. - `401` — no bearer token. - `403 IDE-0057` — `{id}` is not you, or you have no active account in that tenant. - `404` — no such user. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: setOwnDefaultTenant parameters: - description: Caller's own User ID. in: path name: id required: true schema: description: Caller's own User ID. examples: - 00000000-0000-0000-0000-000000000000 type: string requestBody: content: application/json: schema: $ref: "#/components/schemas/DefaultTenantInput" description: The tenant that becomes the default. required: true responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Set own default tenant tags: - Users x-mint: href: /pt/reference/platform/access-manager/set-own-default-tenant /v1/users/{id}/update-password: patch: description: |- Changes a password by proving possession of the current one. Send both the old and the new password. This is the self-service change. An administrator setting a password WITHOUT the old one uses `PATCH /v1/users/{id}/reset-password`. On success the response has no body (204). Failures: - `400` — `{id}` is not a UUID, the old password is wrong, or the new one fails the password policy. - `404` — no such user. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: updateUserPassword parameters: - description: User ID. in: path name: id required: true schema: description: User ID. examples: - 00000000-0000-0000-0000-000000000000 type: string requestBody: content: application/json: schema: $ref: "#/components/schemas/UserPasswordInput" description: The current password and the replacement. required: true responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Not Found "422": content: application/problem+json: schema: $ref: "#/components/schemas/Detail" description: Unprocessable Entity "500": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPError" description: Service Unavailable security: - BearerAuth: [] summary: Update a user password tags: - Users x-mint: href: /pt/reference/platform/access-manager/update-user-password tags: - description: "M2M-only: each plugin declares its own permissions, roles and M2M contract, and the server reconciles them." name: Declarations - description: "A tenant administrator's customers. Each partner holds what its credentials may DO (permissions, per product) and WHERE they may do it (scope, per product and dimension); an M2M application attached to one is confined to that intersection. Administrator-only: authorized on the \"partners\" resource, and every route resolves the owning organization from the caller's token." name: Partners servers: - url: https://identity.sandbox.lerian.net