Organizations

Operations of the Identity API (public). Paths are relative to your deployment's API host.

GET /api/identity-api/organizations

GET / (organizations)

Executes find all for organizations within the authenticated request context. Validate request DTO constraints and return the documented response contract.

Authentication: bearer token (Authorization: Bearer <token>)

POST /api/identity-api/organizations

POST / (organizations)

Executes create for organizations within the authenticated request context. Validate request DTO constraints and return the documented response contract.

Authentication: bearer token (Authorization: Bearer <token>)

Request body: application/json CreateOrganizationDto

GET /api/identity-api/organizations/{id}

GET :id (organizations)

Executes find one for organizations within the authenticated request context. Validate request DTO constraints and return the documented response contract.

Authentication: bearer token (Authorization: Bearer <token>)

PATCH /api/identity-api/organizations/{orgId}

PATCH :orgId (organizations)

Executes update by owner for organizations within the authenticated request context. Validate request DTO constraints and return the documented response contract.

Authentication: bearer token (Authorization: Bearer <token>)

Request body: application/json UpdateOrganizationByOwnerDto

GET /api/identity-api/organizations/{orgId}/activity

GET :orgId/activity (organizations)

Executes get organization activity for organizations within the authenticated request context. Validate request DTO constraints and return the documented response contract.

Authentication: bearer token (Authorization: Bearer <token>)

GET /api/identity-api/organizations/{orgId}/invitations

GET :orgId/invitations (organizations)

Lists the organization's invitations (owner/admin). Also honours a DELEGATED person context addressed to identity-api (workload:identity-api) whose delegation lends identity:user.organization-invitations.list@1: the delegation must be live, of this organization, its resource scope empty, exactly org:<orgId>, or naming org:<orgId> (a bound operation names exactly that organization), and the realm's delegation policy hook must allow the exercise; the person's own owner/admin role is still required. Refusals: 403 DELEGATION_OPERATION_NOT_LENT, DELEGATION_TARGET_OUTSIDE_SCOPE, DELEGATION_POLICY_DENIED (the hook's code in details.policyCode), 503 DELEGATION_POLICY_UNAVAILABLE.

Authentication: bearer token (Authorization: Bearer <token>)

POST /api/identity-api/organizations/{orgId}/invitations

POST :orgId/invitations (organizations)

Executes create invitation for organizations within the authenticated request context. Validate request DTO constraints and return the documented response contract.

Authentication: bearer token (Authorization: Bearer <token>)

Request body: application/json CreateInvitationDto

POST /api/identity-api/organizations/{orgId}/invitations/{id}/deliver

POST :orgId/invitations/:id/deliver (organizations)

Delivers an invitation: replaces its code with a fresh one (the previous code stops working), builds the accept link on the named application's declared invitation accept URI, and sends it by mail as the calling administrator. A mail that is not sent never fails or cancels the invitation: the answer states the outcome (SENT, FAILED, UNKNOWN, NOT_CONFIGURED). 400 INVITATION_ACCEPT_URI_UNDECLARED when the application declares no accept URI.

Authentication: bearer token (Authorization: Bearer <token>)

Request body: application/json DeliverInvitationDto

DELETE /api/identity-api/organizations/{orgId}/invitations/{invitationId}

DELETE :orgId/invitations/:invitationId (organizations)

Revokes one of the organization's invitations (owner/admin). Also honours a DELEGATED person context addressed to identity-api (workload:identity-api) whose delegation lends identity:user.organization-invitation.revoke@1: the delegation must be live, of this organization, its resource scope empty, exactly org:<orgId>, or naming org:<orgId>/invitation:<invitationId> (a bound operation names exactly that invitation), and the realm's delegation policy hook must allow the exercise; the person's own owner/admin role is still required. Refusals: 403 DELEGATION_OPERATION_NOT_LENT, DELEGATION_TARGET_OUTSIDE_SCOPE, DELEGATION_POLICY_DENIED (the hook's code in details.policyCode), 503 DELEGATION_POLICY_UNAVAILABLE.

Authentication: bearer token (Authorization: Bearer <token>)

GET /api/identity-api/organizations/{orgId}/members

GET :orgId/members (organizations)

Lists the organization's member directory, with substring search over display name and email plus skip/take paging. Readable by any member of the organization when the realm policy directoryVisibleToMembers is on (the default), and by organization owners/admins only when it is off; a caller who is not a member is refused either way. A reader without administrator authority receives only id, displayName and email per entry.

Authentication: bearer token (Authorization: Bearer <token>)

DELETE /api/identity-api/organizations/{orgId}/members/me

DELETE :orgId/members/me (organizations)

The caller leaves the organization. The owner of a shared organization must transfer first (403); the last active administrator or owner must grant another member the role first: 409 ORG_LAST_ADMIN / ORG_LAST_OWNER.

Authentication: bearer token (Authorization: Bearer <token>)

PATCH /api/identity-api/organizations/{orgId}/members/{userId}

PATCH :orgId/members/:userId (organizations)

Changes a member's organization role (owner/admin; only an owner grants owner or admin, or changes the role of an owner or admin). Demoting the last active administrator or owner is refused: 409 ORG_LAST_ADMIN / ORG_LAST_OWNER.

Authentication: bearer token (Authorization: Bearer <token>)

Request body: application/json ChangeMemberRoleDto

GET /api/identity-api/organizations/{orgId}/scim-credentials

GET :orgId/scim-credentials (organizations)

Lists the organization's SCIM credentials (owner/admin), newest first. Never carries a token.

Authentication: bearer token (Authorization: Bearer <token>)

POST /api/identity-api/organizations/{orgId}/scim-credentials

POST :orgId/scim-credentials (organizations)

Issues a SCIM provisioning credential for the organization (owner/admin). The token is shown once. At most two credentials are ACTIVE at a time: 409 SCIM_CREDENTIAL_LIMIT_REACHED.

Authentication: bearer token (Authorization: Bearer <token>)

Request body: application/json IssueScimCredentialDto

DELETE /api/identity-api/organizations/{orgId}/scim-credentials/{credentialId}

DELETE :orgId/scim-credentials/:credentialId (organizations)

Revokes a SCIM credential now (owner/admin). Revoking a revoked credential changes nothing.

Authentication: bearer token (Authorization: Bearer <token>)

POST /api/identity-api/organizations/{orgId}/scim-credentials/{credentialId}/rotate

POST :orgId/scim-credentials/:credentialId/rotate (organizations)

Replaces an ACTIVE SCIM credential (owner/admin): a new token is issued and shown once; the old one stays accepted for the rotation overlap (at most 24 hours), then never. 409 SCIM_CREDENTIAL_NOT_ACTIVE otherwise.

Authentication: bearer token (Authorization: Bearer <token>)

POST /api/identity-api/organizations/{orgId}/users/{userId}

POST :orgId/users/:userId (organizations)

Executes add user for organizations within the authenticated request context. Validate request DTO constraints and return the documented response contract.

Authentication: bearer token (Authorization: Bearer <token>)

Request body: application/json AddOrganizationMemberDto

DELETE /api/identity-api/organizations/{orgId}/users/{userId}

DELETE :orgId/users/:userId (organizations)

Removes a member from the organization (owner/admin). The owner cannot be removed, an admin cannot remove another admin, and the last active administrator or owner cannot be removed: 409 ORG_LAST_ADMIN / ORG_LAST_OWNER. Also honours a DELEGATED person context addressed to identity-api (workload:identity-api) whose delegation lends identity:user.organization-member.remove@1: the delegation must be live, of this organization, its resource scope empty, exactly org:<orgId>, or naming org:<orgId>/member:<userId> (a bound operation names exactly that member), and the realm's delegation policy hook must allow the exercise; the person's own owner/admin role is still required. Refusals: 403 DELEGATION_OPERATION_NOT_LENT, DELEGATION_TARGET_OUTSIDE_SCOPE, DELEGATION_POLICY_DENIED (the hook's code in details.policyCode), 503 DELEGATION_POLICY_UNAVAILABLE.

Authentication: bearer token (Authorization: Bearer <token>)