{ "openapi": "3.1.0", "info": { "title": "Event Catalog", "description": "OpenAPI specification for Auth0 Event Catalog", "version": "0.13.2" }, "components": { "schemas": { "connection.created": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "connection.created", "type": "object", "properties": { "specversion": { "description": "The version of the CloudEvents specification which the event uses.", "type": "string", "enum": [ "1.0" ], "x-auth0-owner": "platform-streaming-foundations" }, "type": { "type": "string", "const": "connection.created", "description": "The type of the event which has happened." }, "source": { "type": "string", "examples": [ "urn:auth0:example.auth0app.com" ], "description": "The source of the event. This will take the form 'urn:auth0:.'." }, "id": { "description": "A unique identifier for the event.", "type": "string", "examples": [ "evt_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "evt_[a-zA-Z0-9]{22}" }, "time": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "An ISO-8601 timestamp indicating when the event physically occurred." }, "data": { "description": "The event payload.", "type": "object", "properties": { "object": { "description": "The event content.", "oneOf": [ { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" }, "cross_app_access": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "options": { "description": "Options for the 'oidc' connection", "type": "object", "properties": { "authorization_endpoint": { "description": "URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/authorize" ], "minLength": 8, "maxLength": 2083, "format": "uri" }, "client_id": { "type": "string", "examples": [ "abc123def456ghi789" ], "minLength": 0, "maxLength": 255, "description": "OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider." }, "connection_settings": { "description": "OAuth 2.0 PKCE (Proof Key for Code Exchange) settings. PKCE enhances security for public clients by preventing authorization code interception attacks. 'auto' (recommended) uses the strongest method supported by the IdP.", "type": "object", "properties": { "pkce": { "description": "PKCE configuration.", "type": "string", "enum": [ "auto", "S256", "plain", "disabled" ] } }, "unevaluatedProperties": { "not": {} } }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 1000, "description": "Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication." }, "dpop_signing_alg": { "description": "Algorithm used for DPoP proof JWT signing. Applicable when strategy=oidc or okta.", "type": "string", "enum": [ "ES256", "ES384", "ES512", "Ed25519" ] }, "federated_connections_access_tokens": { "description": "Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.", "type": "object", "properties": { "active": { "type": "boolean", "description": "Enables refresh tokens and access tokens collection for federated connections" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "icon_url": { "description": "https url of the icon to be shown", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "id_token_session_expiry_supported": { "type": "boolean", "description": "Indicates whether the identity provider supports session expiry via the id_token. If true, the system will use the session_expiry claim in the id_token to determine session expiry." }, "id_token_signed_response_algs": { "type": "array", "items": { "type": "string", "enum": [ "ES256", "ES384", "PS256", "PS384", "RS256", "RS384", "RS512" ], "description": "Algorithm allowed to verify the ID tokens." }, "description": "List of algorithms allowed to verify the ID tokens. Applicable when strategy=oidc or okta." }, "issuer": { "description": "The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.", "type": "string", "examples": [ "https://accounts.example.com" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "jwks_uri": { "description": "URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.", "type": "string", "examples": [ "https://provider.example.com/.well-known/jwks.json" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "oidc_metadata": { "description": "OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata", "type": "object", "properties": { "acr_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "urn:mace:incommon:iap:silver" ], "maxLength": 100 }, "minItems": 0, "maxItems": 30, "description": "A list of the Authentication Context Class References that this OP supports" }, "authorization_endpoint": { "description": "URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/authorize" ], "minLength": 8, "maxLength": 2083, "format": "uri" }, "claim_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "normal" ], "maxLength": 25 }, "minItems": 0, "maxItems": 10, "description": "JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims." }, "claims_locales_supported": { "type": "array", "items": { "type": "string", "examples": [ "en-US" ], "maxLength": 50 }, "minItems": 0, "maxItems": 100, "description": "Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values." }, "claims_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false." }, "claims_supported": { "type": "array", "items": { "type": "string", "examples": [ "sub" ], "maxLength": 100 }, "minItems": 0, "maxItems": 150, "description": "JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list." }, "code_challenge_methods_supported": { "type": "array", "items": { "type": "string", "examples": [ "S256" ], "maxLength": 20 }, "minItems": 0, "maxItems": 10, "description": "JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636." }, "display_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "page" ], "maxLength": 10 }, "minItems": 0, "maxItems": 6, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used." }, "dpop_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "ES256" ], "maxLength": 14 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing." }, "end_session_endpoint": { "type": "string", "examples": [ "https://provider.example.com/oauth/logout" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme." }, "grant_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "authorization_code" ], "maxLength": 100 }, "minItems": 0, "maxItems": 20, "description": "A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"]." }, "id_token_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RSA-OAEP" ], "maxLength": 14 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT" }, "id_token_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT]." }, "id_token_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10, "description": "JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata)." }, "minItems": 1, "maxItems": 26, "description": "A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518" }, "issuer": { "description": "The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.", "type": "string", "examples": [ "https://accounts.example.com" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "jwks_uri": { "description": "URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.", "type": "string", "examples": [ "https://provider.example.com/.well-known/jwks.json" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "op_policy_uri": { "type": "string", "examples": [ "https://provider.example.com/policy" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given." }, "op_tos_uri": { "type": "string", "examples": [ "https://provider.example.com/terms" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given." }, "registration_endpoint": { "type": "string", "examples": [ "https://provider.example.com/oauth/register" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration" }, "request_object_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RSA-OAEP" ], "maxLength": 28 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference." }, "request_object_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference." }, "request_object_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256." }, "request_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false." }, "request_uri_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false." }, "require_request_uri_registration": { "type": "boolean", "description": "Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false." }, "response_modes_supported": { "type": "array", "items": { "type": "string", "examples": [ "query" ], "maxLength": 20 }, "minItems": 0, "maxItems": 16, "description": "A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]" }, "response_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "code" ], "maxLength": 40 }, "minItems": 1, "maxItems": 40, "description": "A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values" }, "scopes_supported": { "type": "array", "items": { "type": "string", "examples": [ "openid" ], "maxLength": 100 }, "minItems": 0, "maxItems": 7000, "description": "A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED" }, "service_documentation": { "type": "string", "examples": [ "https://provider.example.com/docs" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation." }, "subject_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "public" ], "minLength": 0, "maxLength": 100 }, "minItems": 0, "maxItems": 20, "description": "A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public" }, "token_endpoint": { "description": "URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/token" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "token_endpoint_auth_methods_supported": { "type": "array", "items": { "type": "string", "examples": [ "client_secret_basic" ], "maxLength": 60 }, "minItems": 0, "maxItems": 14, "description": "JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749]." }, "token_endpoint_auth_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 24, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used." }, "ui_locales_supported": { "type": "array", "items": { "type": "string", "examples": [ "en-US" ], "maxLength": 50 }, "minItems": 0, "maxItems": 150, "description": "Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values." }, "userinfo_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]." }, "userinfo_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]." }, "userinfo_endpoint": { "description": "Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.", "type": "string", "examples": [ "https://provider.example.com/oauth/userinfo" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "userinfo_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included." } }, "required": [ "authorization_endpoint", "id_token_signing_alg_values_supported", "issuer", "jwks_uri" ], "unevaluatedProperties": { "not": {} } }, "schema_version": { "description": "The internal schema version of the connection options.", "type": "string", "enum": [ "openid-1.0.0", "oidc-v4" ] }, "scope": { "type": "string", "examples": [ "openid profile email" ], "minLength": 6, "maxLength": 255, "description": "Space-separated list of OAuth 2.0 scopes requested during authorization. Must include 'openid' (required by OIDC spec). Common values: 'openid profile email'. Additional scopes depend on the identity provider." }, "send_back_channel_nonce": { "type": "boolean", "description": "When true and type is 'back_channel', includes a cryptographic nonce in authorization requests to prevent replay attacks. The identity provider must include this nonce in the ID token for validation." }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "tenant_domain": { "description": "Tenant domain", "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255 }, "token_endpoint": { "description": "URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/token" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "token_endpoint_auth_method": { "description": "Authentication method used at the identity provider's token endpoint. 'client_secret_post' sends credentials in the request body; 'private_key_jwt' uses a signed JWT assertion for enhanced security. Applicable when strategy=oidc or okta.", "type": "string", "enum": [ "client_secret_post", "private_key_jwt" ] }, "token_endpoint_auth_signing_alg": { "description": "Algorithm used to sign client_assertions. Applicable when strategy=oidc or okta.", "type": "string", "enum": [ "ES256", "ES384", "PS256", "PS384", "RS256", "RS384", "RS512" ] }, "token_endpoint_jwtca_aud_format": { "description": "Specifies the format of the aud (audience) claim included in the JWT used for client authentication at the token endpoint. Accepted values are: 'issuer' (the aud claim is set to the OIDC issuer URL) or 'token_endpoint' (the aud claim is set to the token endpoint URL).", "type": "string", "enum": [ "issuer", "token_endpoint" ] }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "useOauthSpecScope": { "type": "boolean", "description": "When true, uses space-delimited scopes (per OAuth 2.0 spec) instead of comma-delimited when calling the identity provider's authorization endpoint. Only relevant when using the connection_scope parameter. See https://auth0.com/docs/authenticate/identity-providers/adding-scopes-for-an-external-idp#pass-scopes-to-authorize-endpoint" }, "userinfo_endpoint": { "description": "Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.", "type": "string", "examples": [ "https://provider.example.com/oauth/userinfo" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "attribute_map": { "description": "Configuration for mapping claims from the identity provider to Auth0 user profile attributes. Allows customizing which IdP claims populate user fields and how they are transformed.", "type": "object", "properties": { "attributes": { "description": "Object containing mapping details for incoming claims", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "userinfo_scope": { "type": "string", "examples": [ "openid profile email" ], "minLength": 0, "maxLength": 255, "description": "Scopes to send to the IdP's Userinfo endpoint" }, "mapping_mode": { "description": "Method used to map incoming claims when strategy=oidc.", "type": "string", "enum": [ "bind_all", "use_map" ] } }, "unevaluatedProperties": { "not": {} } }, "discovery_url": { "type": "string", "examples": [ "https://provider.example.com/.well-known/openid-configuration" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the identity provider's OIDC Discovery endpoint (/.well-known/openid-configuration). When provided and oidc_metadata is empty, Auth0 automatically retrieves the provider's configuration including endpoints and supported features." }, "type": { "description": "OIDC communication channel type. 'back_channel' (confidential client) exchanges tokens server-side for stronger security; 'front_channel' handles responses in the browser.", "type": "string", "enum": [ "back_channel", "front_channel" ] } }, "required": [ "client_id" ], "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "oidc", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'okta' connection", "type": "object", "properties": { "authorization_endpoint": { "description": "URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/authorize" ], "minLength": 8, "maxLength": 2083, "format": "uri" }, "client_id": { "type": "string", "examples": [ "abc123def456ghi789" ], "minLength": 0, "maxLength": 255, "description": "OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider." }, "connection_settings": { "description": "OAuth 2.0 PKCE (Proof Key for Code Exchange) settings. PKCE enhances security for public clients by preventing authorization code interception attacks. 'auto' (recommended) uses the strongest method supported by the IdP.", "type": "object", "properties": { "pkce": { "description": "PKCE configuration.", "type": "string", "enum": [ "auto", "S256", "plain", "disabled" ] } }, "unevaluatedProperties": { "not": {} } }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 1000, "description": "Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication." }, "dpop_signing_alg": { "description": "Algorithm used for DPoP proof JWT signing. Applicable when strategy=oidc or okta.", "type": "string", "enum": [ "ES256", "ES384", "ES512", "Ed25519" ] }, "federated_connections_access_tokens": { "description": "Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.", "type": "object", "properties": { "active": { "type": "boolean", "description": "Enables refresh tokens and access tokens collection for federated connections" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "icon_url": { "description": "https url of the icon to be shown", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "id_token_session_expiry_supported": { "type": "boolean", "description": "Indicates whether the identity provider supports session expiry via the id_token. If true, the system will use the session_expiry claim in the id_token to determine session expiry." }, "id_token_signed_response_algs": { "type": "array", "items": { "type": "string", "enum": [ "ES256", "ES384", "PS256", "PS384", "RS256", "RS384", "RS512" ], "description": "Algorithm allowed to verify the ID tokens." }, "description": "List of algorithms allowed to verify the ID tokens. Applicable when strategy=oidc or okta." }, "issuer": { "description": "The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.", "type": "string", "examples": [ "https://accounts.example.com" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "jwks_uri": { "description": "URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.", "type": "string", "examples": [ "https://provider.example.com/.well-known/jwks.json" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "oidc_metadata": { "description": "OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata", "type": "object", "properties": { "acr_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "urn:mace:incommon:iap:silver" ], "maxLength": 100 }, "minItems": 0, "maxItems": 30, "description": "A list of the Authentication Context Class References that this OP supports" }, "authorization_endpoint": { "description": "URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/authorize" ], "minLength": 8, "maxLength": 2083, "format": "uri" }, "claim_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "normal" ], "maxLength": 25 }, "minItems": 0, "maxItems": 10, "description": "JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims." }, "claims_locales_supported": { "type": "array", "items": { "type": "string", "examples": [ "en-US" ], "maxLength": 50 }, "minItems": 0, "maxItems": 100, "description": "Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values." }, "claims_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false." }, "claims_supported": { "type": "array", "items": { "type": "string", "examples": [ "sub" ], "maxLength": 100 }, "minItems": 0, "maxItems": 150, "description": "JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list." }, "code_challenge_methods_supported": { "type": "array", "items": { "type": "string", "examples": [ "S256" ], "maxLength": 20 }, "minItems": 0, "maxItems": 10, "description": "JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636." }, "display_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "page" ], "maxLength": 10 }, "minItems": 0, "maxItems": 6, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used." }, "dpop_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "ES256" ], "maxLength": 14 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing." }, "end_session_endpoint": { "type": "string", "examples": [ "https://provider.example.com/oauth/logout" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme." }, "grant_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "authorization_code" ], "maxLength": 100 }, "minItems": 0, "maxItems": 20, "description": "A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"]." }, "id_token_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RSA-OAEP" ], "maxLength": 14 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT" }, "id_token_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT]." }, "id_token_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10, "description": "JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata)." }, "minItems": 1, "maxItems": 26, "description": "A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518" }, "issuer": { "description": "The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.", "type": "string", "examples": [ "https://accounts.example.com" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "jwks_uri": { "description": "URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.", "type": "string", "examples": [ "https://provider.example.com/.well-known/jwks.json" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "op_policy_uri": { "type": "string", "examples": [ "https://provider.example.com/policy" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given." }, "op_tos_uri": { "type": "string", "examples": [ "https://provider.example.com/terms" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given." }, "registration_endpoint": { "type": "string", "examples": [ "https://provider.example.com/oauth/register" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration" }, "request_object_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RSA-OAEP" ], "maxLength": 28 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference." }, "request_object_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference." }, "request_object_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256." }, "request_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false." }, "request_uri_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false." }, "require_request_uri_registration": { "type": "boolean", "description": "Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false." }, "response_modes_supported": { "type": "array", "items": { "type": "string", "examples": [ "query" ], "maxLength": 20 }, "minItems": 0, "maxItems": 16, "description": "A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]" }, "response_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "code" ], "maxLength": 40 }, "minItems": 1, "maxItems": 40, "description": "A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values" }, "scopes_supported": { "type": "array", "items": { "type": "string", "examples": [ "openid" ], "maxLength": 100 }, "minItems": 0, "maxItems": 7000, "description": "A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED" }, "service_documentation": { "type": "string", "examples": [ "https://provider.example.com/docs" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation." }, "subject_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "public" ], "minLength": 0, "maxLength": 100 }, "minItems": 0, "maxItems": 20, "description": "A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public" }, "token_endpoint": { "description": "URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/token" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "token_endpoint_auth_methods_supported": { "type": "array", "items": { "type": "string", "examples": [ "client_secret_basic" ], "maxLength": 60 }, "minItems": 0, "maxItems": 14, "description": "JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749]." }, "token_endpoint_auth_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 24, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used." }, "ui_locales_supported": { "type": "array", "items": { "type": "string", "examples": [ "en-US" ], "maxLength": 50 }, "minItems": 0, "maxItems": 150, "description": "Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values." }, "userinfo_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]." }, "userinfo_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]." }, "userinfo_endpoint": { "description": "Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.", "type": "string", "examples": [ "https://provider.example.com/oauth/userinfo" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "userinfo_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included." } }, "required": [ "authorization_endpoint", "id_token_signing_alg_values_supported", "issuer", "jwks_uri" ], "unevaluatedProperties": { "not": {} } }, "schema_version": { "description": "The internal schema version of the connection options.", "type": "string", "enum": [ "openid-1.0.0", "oidc-v4" ] }, "scope": { "type": "string", "examples": [ "openid profile email" ], "minLength": 6, "maxLength": 255, "description": "Space-separated list of OAuth 2.0 scopes requested during authorization. Must include 'openid' (required by OIDC spec). Common values: 'openid profile email'. Additional scopes depend on the identity provider." }, "send_back_channel_nonce": { "type": "boolean", "description": "When true and type is 'back_channel', includes a cryptographic nonce in authorization requests to prevent replay attacks. The identity provider must include this nonce in the ID token for validation." }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "tenant_domain": { "description": "Tenant domain", "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255 }, "token_endpoint": { "description": "URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/token" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "token_endpoint_auth_method": { "description": "Authentication method used at the identity provider's token endpoint. 'client_secret_post' sends credentials in the request body; 'private_key_jwt' uses a signed JWT assertion for enhanced security. Applicable when strategy=oidc or okta.", "type": "string", "enum": [ "client_secret_post", "private_key_jwt" ] }, "token_endpoint_auth_signing_alg": { "description": "Algorithm used to sign client_assertions. Applicable when strategy=oidc or okta.", "type": "string", "enum": [ "ES256", "ES384", "PS256", "PS384", "RS256", "RS384", "RS512" ] }, "token_endpoint_jwtca_aud_format": { "description": "Specifies the format of the aud (audience) claim included in the JWT used for client authentication at the token endpoint. Accepted values are: 'issuer' (the aud claim is set to the OIDC issuer URL) or 'token_endpoint' (the aud claim is set to the token endpoint URL).", "type": "string", "enum": [ "issuer", "token_endpoint" ] }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "useOauthSpecScope": { "type": "boolean", "description": "When true, uses space-delimited scopes (per OAuth 2.0 spec) instead of comma-delimited when calling the identity provider's authorization endpoint. Only relevant when using the connection_scope parameter. See https://auth0.com/docs/authenticate/identity-providers/adding-scopes-for-an-external-idp#pass-scopes-to-authorize-endpoint" }, "userinfo_endpoint": { "description": "Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.", "type": "string", "examples": [ "https://provider.example.com/oauth/userinfo" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "attribute_map": { "description": "Mapping of claims received from the identity provider (IdP)", "type": "object", "properties": { "attributes": { "description": "Object containing mapping details for incoming claims", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "userinfo_scope": { "type": "string", "examples": [ "openid profile email" ], "minLength": 0, "maxLength": 255, "description": "Scopes to send to the IdP's Userinfo endpoint" }, "mapping_mode": { "description": "Method used to map incoming claims when strategy=okta.", "type": "string", "enum": [ "basic_profile", "use_map" ] } }, "unevaluatedProperties": { "not": {} } }, "domain": { "type": "string", "examples": [ "dev-123456.okta.com" ], "minLength": 4, "maxLength": 255, "description": "Domain of the Okta organization (e.g., dev-123456.okta.com). Should be just the domain of the okta server with no scheme or trailing backslash. Discovery runs only when connection.options.oidc_metadata is empty and a domain is provided" }, "type": { "description": "Connection type", "type": "string", "enum": [ "back_channel" ] } }, "required": [ "client_id" ], "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "okta", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'samlp' connection", "type": "object", "properties": { "assertion_decryption_settings": { "description": "Settings for SAML assertion decryption.", "type": "object", "properties": { "algorithm_exceptions": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 100 }, "maxItems": 10, "description": "A list of insecure algorithms to allow for SAML assertion decryption." }, "algorithm_profile": { "description": "The algorithm profile to use for decrypting SAML assertions.", "type": "string", "enum": [ "v2026-1" ] } }, "required": [ "algorithm_profile" ], "unevaluatedProperties": { "not": {} } }, "cert": { "type": "string", "minLength": 1, "maxLength": 10240, "description": "X.509 signing certificate from the identity provider in .der format. Used to validate signatures in SAML Responses and Assertions. This is an alternative to signingCert and is kept for backward compatibility. Prefer using signingCert instead.", "deprecated": true }, "cert_rollover_notification": { "type": "string", "format": "date-time", "description": "Timestamp of the last certificate expiring soon notification." }, "digestAlgorithm": { "description": "Algorithm used for computing digest values when signing SAML requests and logout requests. Defaults to 'sha256'.", "type": "string", "enum": [ "sha1", "sha256" ] }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 50001, "description": "Domain aliases for the connection" }, "entityId": { "description": "The entity identifier (Issuer) for the SAML Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'. This value is included in SAML AuthnRequest messages sent to the identity provider.", "type": "string", "examples": [ "urn:auth0:my-tenant:my-connection" ], "minLength": 1, "maxLength": 128 }, "expires": { "type": "string", "format": "date-time", "description": "ISO 8601 formatted datetime indicating when the identity provider's signing certificate expires." }, "icon_url": { "description": "URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "idpinitiated": { "description": "Configuration for IdP-Initiated SAML Single Sign-On. When enabled, allows users to initiate login directly from their SAML identity provider without first visiting Auth0. The IdP must include the connection parameter in the post-back URL (Assertion Consumer Service URL).", "type": "object", "properties": { "client_authorizequery": { "type": "string", "minLength": 1, "maxLength": 2048, "description": "The query string sent to the default application" }, "client_id": { "type": "string", "minLength": 1, "maxLength": 256, "description": "The client ID to use for IdP-initiated login requests." }, "client_protocol": { "description": "The response protocol used to communicate with the default application.", "type": "string", "enum": [ "oidc", "samlp", "wsfed" ] }, "enabled": { "type": "boolean", "description": "When true, enables IdP-initiated login support for this SAML connection. Allows users to log in directly from the identity provider without first visiting Auth0." } }, "unevaluatedProperties": { "not": {} } }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "protocolBinding": { "description": "SAML protocol binding mechanism for sending authentication requests to the identity provider.", "type": "string", "enum": [ "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST", "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" ] }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "signatureAlgorithm": { "description": "Algorithm used to sign SAML authentication requests and logout requests using the connection's signing key. Common values: 'rsa-sha256' (RSA signature with SHA-256 digest) or 'rsa-sha1'. Defaults to 'rsa-sha256'.", "type": "string", "enum": [ "rsa-sha1", "rsa-sha256" ] }, "signInEndpoint": { "description": "Identity provider's SAML SingleSignOnService endpoint URL where Auth0 sends SAML authentication requests. This is the primary login URL for the SAML connection. Required unless using metadataUrl or metadataXml.", "type": "string", "examples": [ "https://idp.example.com/saml/sso" ], "minLength": 8, "maxLength": 2048, "format": "uri" }, "signingCert": { "description": "Base64-encoded X.509 certificate from the identity provider used to validate signatures in SAML responses and assertions. The certificate is decoded and used for cryptographic signature verification.", "type": "string", "examples": [ "MIIDDTCCAfWgAwIBAgIJALFkBP7GVlWkMA0GCSqGSIb3DQEBCwUAMCUxIzAhBgNV" ], "minLength": 1, "maxLength": 10240 }, "signSAMLRequest": { "type": "boolean", "description": "When true, Auth0 signs SAML authentication requests using the connection's signing key. The signature includes the request's digest and is validated by the identity provider. Defaults to false (unsigned requests)." }, "subject": { "description": "Certificate Subject Distinguished Name (DN) extracted from the identity provider's signing certificate.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "tenant_domain": { "description": "For SAML connections, the tenant domain used to construct the login endpoint URL. Can be a string for single-tenant or an array of strings for multi-tenant validation.", "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255 }, "thumbprints": { "type": "array", "items": { "type": "string", "examples": [ "ef34ab56cd78901234567890123456789012efab" ], "minLength": 40, "maxLength": 40 }, "minItems": 0, "maxItems": 1, "description": "SHA-1 thumbprints (fingerprints) of the identity provider's signing certificates. Automatically computed from signingCert during connection creation. Each thumbprint must be a 40-character hexadecimal string." }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "debug": { "type": "boolean", "description": "When true, enables detailed SAML debugging by issuing 'w' (warning) events in tenant logs containing SAML request/response details. WARNING: Potentially exposes sensitive user information (PII, credentials) and should only be enabled temporarily for debugging purposes." }, "deflate": { "type": "boolean", "description": "When true, enables DEFLATE compression for SAML requests sent via HTTP-Redirect binding." }, "destinationUrl": { "type": "string", "examples": [ "https://idp.example.com/saml/sso" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "The URL where Auth0 will send SAML authentication requests (the Identity Provider's SSO URL). Must be a valid HTTPS URL." }, "disableFieldsMapFix": { "type": "boolean", "description": "When true, disables the automatic correction of the fieldsMap configuration to ensure proper mapping of SAML attributes to user profile fields. Defaults to false (fieldsMap fix enabled)." }, "disableSignout": { "type": "boolean", "description": "When true, disables sending SAML logout requests (SingleLogoutService) to the identity provider during user sign-out. The user will be logged out of Auth0 but will remain logged into the identity provider. Defaults to false (federated logout enabled)." }, "discovery_url": { "type": "string", "examples": [ "https://provider.example.com/.well-known/openid-configuration" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the identity provider's OIDC Discovery endpoint (/.well-known/openid-configuration). When provided and oidc_metadata is empty, Auth0 automatically retrieves the provider's configuration including endpoints and supported features. Used with Cross App Access.", "x-release-lifecycle": "EA" }, "fieldsMap": { "description": "Maps SAML assertion attributes from the identity provider to Auth0 user profile attributes. Format: { 'auth0_field': 'saml_attribute' } or { 'auth0_field': ['saml_attr1', 'saml_attr2'] } for fallback options. Merged with default mappings for email, name, given_name, family_name, and groups.", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "fieldsMapJsonRaw": { "type": "string", "minLength": 0, "maxLength": 8192, "description": "Raw JSON string representation of the fieldsMap configuration. Used internally for storage and retrieval of the fieldsMap object." }, "global_token_revocation_jwt_iss": { "type": "string", "minLength": 1, "maxLength": 1024, "description": "Expected 'iss' (Issuer) claim value for JWT tokens in Global Token Revocation requests from the identity provider. When configured, Auth0 validates the JWT issuer matches this value before processing token revocation. Must be used together with global_token_revocation_jwt_sub." }, "global_token_revocation_jwt_sub": { "type": "string", "minLength": 1, "maxLength": 1024, "description": "Expected 'sub' (Subject) claim value for JWT tokens in Global Token Revocation requests from the identity provider. When configured, Auth0 validates the JWT subject matches this value before processing token revocation. Must be used together with global_token_revocation_jwt_iss." }, "metadataUrl": { "type": "string", "examples": [ "https://idp.example.com/saml/metadata" ], "minLength": 8, "maxLength": 2048, "format": "uri", "description": "HTTPS URL to the identity provider's SAML metadata document. When provided, Auth0 automatically fetches and parses the metadata to extract signInEndpoint, signOutEndpoint, signingCert, signSAMLRequest, and protocolBinding. Use metadataUrl OR metadataXml, not both." }, "oidc_metadata": { "description": "OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata. Used with Cross App Access.", "x-release-lifecycle": "EA", "type": "object", "properties": { "acr_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "urn:mace:incommon:iap:silver" ], "maxLength": 100 }, "minItems": 0, "maxItems": 30, "description": "A list of the Authentication Context Class References that this OP supports" }, "authorization_endpoint": { "description": "URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/authorize" ], "minLength": 8, "maxLength": 2083, "format": "uri" }, "claim_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "normal" ], "maxLength": 25 }, "minItems": 0, "maxItems": 10, "description": "JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims." }, "claims_locales_supported": { "type": "array", "items": { "type": "string", "examples": [ "en-US" ], "maxLength": 50 }, "minItems": 0, "maxItems": 100, "description": "Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values." }, "claims_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false." }, "claims_supported": { "type": "array", "items": { "type": "string", "examples": [ "sub" ], "maxLength": 100 }, "minItems": 0, "maxItems": 150, "description": "JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list." }, "code_challenge_methods_supported": { "type": "array", "items": { "type": "string", "examples": [ "S256" ], "maxLength": 20 }, "minItems": 0, "maxItems": 10, "description": "JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636." }, "display_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "page" ], "maxLength": 10 }, "minItems": 0, "maxItems": 6, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used." }, "dpop_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "ES256" ], "maxLength": 14 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing." }, "end_session_endpoint": { "type": "string", "examples": [ "https://provider.example.com/oauth/logout" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme." }, "grant_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "authorization_code" ], "maxLength": 100 }, "minItems": 0, "maxItems": 20, "description": "A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"]." }, "id_token_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RSA-OAEP" ], "maxLength": 14 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT" }, "id_token_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT]." }, "id_token_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10, "description": "JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata)." }, "minItems": 1, "maxItems": 26, "description": "A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518" }, "issuer": { "description": "The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.", "type": "string", "examples": [ "https://accounts.example.com" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "jwks_uri": { "description": "URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.", "type": "string", "examples": [ "https://provider.example.com/.well-known/jwks.json" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "op_policy_uri": { "type": "string", "examples": [ "https://provider.example.com/policy" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given." }, "op_tos_uri": { "type": "string", "examples": [ "https://provider.example.com/terms" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given." }, "registration_endpoint": { "type": "string", "examples": [ "https://provider.example.com/oauth/register" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration" }, "request_object_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RSA-OAEP" ], "maxLength": 28 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference." }, "request_object_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference." }, "request_object_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256." }, "request_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false." }, "request_uri_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false." }, "require_request_uri_registration": { "type": "boolean", "description": "Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false." }, "response_modes_supported": { "type": "array", "items": { "type": "string", "examples": [ "query" ], "maxLength": 20 }, "minItems": 0, "maxItems": 16, "description": "A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]" }, "response_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "code" ], "maxLength": 40 }, "minItems": 1, "maxItems": 40, "description": "A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values" }, "scopes_supported": { "type": "array", "items": { "type": "string", "examples": [ "openid" ], "maxLength": 100 }, "minItems": 0, "maxItems": 7000, "description": "A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED" }, "service_documentation": { "type": "string", "examples": [ "https://provider.example.com/docs" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation." }, "subject_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "public" ], "minLength": 0, "maxLength": 100 }, "minItems": 0, "maxItems": 20, "description": "A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public" }, "token_endpoint": { "description": "URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/token" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "token_endpoint_auth_methods_supported": { "type": "array", "items": { "type": "string", "examples": [ "client_secret_basic" ], "maxLength": 60 }, "minItems": 0, "maxItems": 14, "description": "JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749]." }, "token_endpoint_auth_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 24, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used." }, "ui_locales_supported": { "type": "array", "items": { "type": "string", "examples": [ "en-US" ], "maxLength": 50 }, "minItems": 0, "maxItems": 150, "description": "Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values." }, "userinfo_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]." }, "userinfo_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]." }, "userinfo_endpoint": { "description": "Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.", "type": "string", "examples": [ "https://provider.example.com/oauth/userinfo" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "userinfo_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included." } }, "required": [ "authorization_endpoint", "id_token_signing_alg_values_supported", "issuer", "jwks_uri" ], "unevaluatedProperties": { "not": {} } }, "recipientUrl": { "type": "string", "examples": [ "https://idp.example.com/saml/acs" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "The URL where Auth0 will send SAML authentication requests (the Identity Provider's SSO URL). Must be a valid HTTPS URL." }, "requestTemplate": { "type": "string", "minLength": 1, "maxLength": 10240, "description": "Custom XML template for SAML authentication requests. Supports variable substitution using @@variableName@@ syntax. When not provided, uses default SAML AuthnRequest template. See https://auth0.com/docs/authenticate/protocols/saml/saml-sso-integrations/configure-auth0-saml-service-provider#customize-the-request-template" }, "signOutEndpoint": { "type": "string", "examples": [ "https://idp.example.com/saml/slo" ], "minLength": 8, "maxLength": 2048, "format": "uri", "description": "Identity provider's SAML SingleLogoutService endpoint URL where Auth0 sends logout requests for federated sign-out. When not provided, defaults to signInEndpoint. Only used if disableSignout is false." }, "user_id_attribute": { "type": "string", "minLength": 1, "maxLength": 2396, "description": "Custom SAML assertion attribute to use as the unique user identifier. When provided, this attribute is prepended to the default user_id mapping list with highest priority. Accepts a string (single SAML attribute name)." } }, "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "samlp", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'pingfederate' connection", "type": "object", "properties": { "assertion_decryption_settings": { "description": "Settings for SAML assertion decryption.", "type": "object", "properties": { "algorithm_exceptions": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 100 }, "maxItems": 10, "description": "A list of insecure algorithms to allow for SAML assertion decryption." }, "algorithm_profile": { "description": "The algorithm profile to use for decrypting SAML assertions.", "type": "string", "enum": [ "v2026-1" ] } }, "required": [ "algorithm_profile" ], "unevaluatedProperties": { "not": {} } }, "cert": { "type": "string", "minLength": 1, "maxLength": 10240, "description": "X.509 signing certificate from the identity provider in .der format. Used to validate signatures in SAML Responses and Assertions. This is an alternative to signingCert and is kept for backward compatibility. Prefer using signingCert instead.", "deprecated": true }, "cert_rollover_notification": { "type": "string", "format": "date-time", "description": "Timestamp of the last certificate expiring soon notification." }, "digestAlgorithm": { "description": "Algorithm used for computing digest values when signing SAML requests and logout requests. Defaults to 'sha256'.", "type": "string", "enum": [ "sha1", "sha256" ] }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 50001, "description": "Domain aliases for the connection" }, "entityId": { "description": "The entity identifier (Issuer) for the SAML Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'. This value is included in SAML AuthnRequest messages sent to the identity provider.", "type": "string", "examples": [ "urn:auth0:my-tenant:my-connection" ], "minLength": 1, "maxLength": 128 }, "expires": { "type": "string", "format": "date-time", "description": "ISO 8601 formatted datetime indicating when the identity provider's signing certificate expires." }, "icon_url": { "description": "URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "idpinitiated": { "description": "Configuration for IdP-Initiated SAML Single Sign-On. When enabled, allows users to initiate login directly from their SAML identity provider without first visiting Auth0. The IdP must include the connection parameter in the post-back URL (Assertion Consumer Service URL).", "type": "object", "properties": { "client_authorizequery": { "type": "string", "minLength": 1, "maxLength": 2048, "description": "The query string sent to the default application" }, "client_id": { "type": "string", "minLength": 1, "maxLength": 256, "description": "The client ID to use for IdP-initiated login requests." }, "client_protocol": { "description": "The response protocol used to communicate with the default application.", "type": "string", "enum": [ "oidc", "samlp", "wsfed" ] }, "enabled": { "type": "boolean", "description": "When true, enables IdP-initiated login support for this SAML connection. Allows users to log in directly from the identity provider without first visiting Auth0." } }, "unevaluatedProperties": { "not": {} } }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "protocolBinding": { "description": "SAML protocol binding mechanism for sending authentication requests to the identity provider.", "type": "string", "enum": [ "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST", "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" ] }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "signatureAlgorithm": { "description": "Algorithm used to sign SAML authentication requests and logout requests using the connection's signing key. Common values: 'rsa-sha256' (RSA signature with SHA-256 digest) or 'rsa-sha1'. Defaults to 'rsa-sha256'.", "type": "string", "enum": [ "rsa-sha1", "rsa-sha256" ] }, "signInEndpoint": { "description": "Identity provider's SAML SingleSignOnService endpoint URL where Auth0 sends SAML authentication requests. This is the primary login URL for the SAML connection. Required unless using metadataUrl or metadataXml.", "type": "string", "examples": [ "https://idp.example.com/saml/sso" ], "minLength": 8, "maxLength": 2048, "format": "uri" }, "signingCert": { "description": "Base64-encoded X.509 certificate from the identity provider used to validate signatures in SAML responses and assertions. The certificate is decoded and used for cryptographic signature verification.", "type": "string", "examples": [ "MIIDDTCCAfWgAwIBAgIJALFkBP7GVlWkMA0GCSqGSIb3DQEBCwUAMCUxIzAhBgNV" ], "minLength": 1, "maxLength": 10240 }, "signSAMLRequest": { "type": "boolean", "description": "When true, Auth0 signs SAML authentication requests using the connection's signing key. The signature includes the request's digest and is validated by the identity provider. Defaults to false (unsigned requests)." }, "subject": { "description": "Certificate Subject Distinguished Name (DN) extracted from the identity provider's signing certificate.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "tenant_domain": { "description": "For SAML connections, the tenant domain used to construct the login endpoint URL. Can be a string for single-tenant or an array of strings for multi-tenant validation.", "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255 }, "thumbprints": { "type": "array", "items": { "type": "string", "examples": [ "ef34ab56cd78901234567890123456789012efab" ], "minLength": 40, "maxLength": 40 }, "minItems": 0, "maxItems": 1, "description": "SHA-1 thumbprints (fingerprints) of the identity provider's signing certificates. Automatically computed from signingCert during connection creation. Each thumbprint must be a 40-character hexadecimal string." }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "pingFederateBaseUrl": { "type": "string", "examples": [ "https://pingfederate.example.com" ], "minLength": 8, "maxLength": 256, "format": "uri", "description": "URL provided by PingFederate which returns information used for creating the connection" } }, "required": [ "pingFederateBaseUrl" ], "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "pingfederate", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'adfs' connection", "type": "object", "properties": { "adfs_server": { "type": "string", "examples": [ "adfs.example.com" ], "minLength": 0, "maxLength": 2048, "description": "ADFS federation metadata host or XML URL used to discover WS-Fed endpoints and certificates. Errors if adfs_server and fedMetadataXml are both absent." }, "cert_rollover_notification": { "type": "string", "format": "date-time", "description": "Timestamp of the last certificate expiring soon notification." }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 1000, "description": "Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication." }, "entityId": { "description": "The entity identifier (Issuer) for the ADFS Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'.", "type": "string", "examples": [ "urn:auth0:my-tenant:my-connection" ], "minLength": 1, "maxLength": 128 }, "fedMetadataXml": { "type": "string", "minLength": 1, "maxLength": 102400, "description": "Inline XML alternative to 'adfs_server'. Cannot be set together with 'adfs_server'." }, "icon_url": { "description": "URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "prev_thumbprints": { "type": "array", "items": { "type": "string", "examples": [ "AB12CD34EF56789012345678901234567890ABCD" ], "minLength": 0, "maxLength": 64, "description": "Certificate thumbprints for ADFS and Azure AD connections." }, "minItems": 0, "maxItems": 20, "description": "Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string." }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "should_trust_email_verified_connection": { "description": "Choose how Auth0 sets the email_verified field in the user profile.", "type": "string", "enum": [ "never_set_emails_as_verified", "always_set_emails_as_verified" ] }, "signInEndpoint": { "description": "Passive Requestor (WS-Fed) sign-in endpoint discovered from metadata or provided explicitly.", "type": "string", "examples": [ "https://idp.example.com/saml/sso" ], "minLength": 8, "maxLength": 2048, "format": "uri" }, "tenant_domain": { "description": "Tenant domain", "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255 }, "thumbprints": { "type": "array", "items": { "type": "string", "examples": [ "AB12CD34EF56789012345678901234567890ABCD" ], "minLength": 0, "maxLength": 64, "description": "Certificate thumbprints for ADFS and Azure AD connections." }, "minItems": 0, "maxItems": 20, "description": "Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string." }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "user_id_attribute": { "type": "string", "minLength": 1, "maxLength": 128, "description": "Custom ADFS claim to use as the unique user identifier. When provided, this attribute is prepended to the default user_id mapping list with highest priority. Accepts a string (single ADFS claim name)." } }, "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "adfs", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'ad' connection", "type": "object", "properties": { "agentIP": { "description": "IP address of the AD connector agent used to validate that authentication requests originate from the corporate network for Kerberos authentication (managed by the AD Connector agent).", "type": "string", "examples": [ "192.168.1.10" ], "minLength": 2, "maxLength": 39 }, "agentMode": { "type": "boolean", "description": "When enabled, allows direct username/password authentication through the AD connector agent instead of WS-Federation protocol (managed by the AD Connector agent)." }, "agentVersion": { "type": "string", "examples": [ "1.4.2" ], "minLength": 5, "maxLength": 12, "description": "Version identifier of the installed AD connector agent software (managed by the AD Connector agent)." }, "brute_force_protection": { "type": "boolean", "description": "Enables Auth0's brute force protection to prevent credential stuffing attacks. When enabled, blocks suspicious login attempts from specific IP addresses after repeated failures." }, "certAuth": { "type": "boolean", "description": "Enables client SSL certificate authentication for the AD connector, requiring HTTPS on the sign-in endpoint" }, "certs": { "type": "array", "items": { "type": "string", "examples": [ "MIIDDTCCAfWgAwIBAgIJALFkBP7GVlWkMA0GCSqGSIb3DQEBCwUAMCUxIzAhBgNVBAMTGmV4YW1wbGUuYXV0aDAuY29tIENlcnQgQ0EwHhcNMjUwMTAxMDAwMDAwWhcNMjYwMTAxMDAwMDAwWjAUMRIwEAYDVQQDEwlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC7o4qne60TB3wolFrzabc1234567890ABCDEFG" ], "minLength": 256, "maxLength": 3072 }, "minItems": 0, "maxItems": 2, "description": "Array of X.509 certificates in PEM format used for validating SAML signatures from the AD identity provider (managed by the AD Connector agent)." }, "disable_cache": { "type": "boolean", "description": "When enabled, disables caching of AD connector authentication results to ensure real-time validation against the directory" }, "disable_self_service_change_password": { "type": "boolean", "description": "When enabled, hides the 'Forgot Password' link on login pages to prevent users from initiating self-service password resets" }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 1000, "description": "List of domain names that can be used with identifier-first authentication flow to route users to this AD connection; each domain must be a valid DNS name up to 256 characters" }, "icon_url": { "description": "https url of the icon to be shown", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "ips": { "type": "array", "items": { "type": "string", "examples": [ "192.168.1.10" ], "minLength": 2, "maxLength": 39 }, "minItems": 0, "maxItems": 256, "description": "Array of IP address ranges in CIDR notation used to determine if authentication requests originate from the corporate network for Kerberos or certificate authentication." }, "kerberos": { "type": "boolean", "description": "Enables Windows Integrated Authentication (Kerberos) for seamless SSO when users authenticate from within the corporate network IP ranges" }, "kerberos_only": { "type": "boolean", "description": "When true, restricts the connection to Kerberos-only authentication, disallowing username/password fallback." }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "signInEndpoint": { "type": "string", "examples": [ "https://ad-connector.example.com" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "The sign-in endpoint type for the AD-LDAP connector agent (managed by the AD Connector agent)." }, "tenant_domain": { "type": "string", "examples": [ "corp.example.com" ], "minLength": 1, "maxLength": 512, "format": "hostname", "description": "Primary AD domain hint used for HRD and discovery." }, "thumbprints": { "type": "array", "items": { "type": "string", "examples": [ "8233ec9c12a44625d4a64ee413651fd928b5168f" ], "minLength": 40, "maxLength": 40 }, "minItems": 0, "maxItems": 2, "description": "Array of certificate SHA-1 thumbprints for validating signatures. Managed by Auth0 when using the AD Connector agent." }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} } }, "unevaluatedProperties": { "not": {} } }, "strategy": { "type": "string", "const": "ad", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'google-apps' connection", "type": "object", "properties": { "admin_access_token_expiresin": { "type": "string", "format": "date-time", "description": "Expiration timestamp for the `admin_access_token` in ISO 8601 format. Auth0 uses this value to determine when to refresh the token." }, "allow_setting_login_scopes": { "type": "boolean", "description": "When true, allows customization of OAuth scopes requested during user login. Custom scopes are appended to the mandatory email and profile scopes. When false or omitted, only the default email and profile scopes are used. This property is automatically enabled when Token Vault or Connected Accounts features are activated." }, "api_enable_groups": { "type": "boolean", "description": "Enables integration with the Google Workspace Admin SDK Directory API for groups. When true, Auth0 can synchronize groups & group memberships and supports inbound directory provisioning for groups. Defaults to false." }, "api_enable_users": { "type": "boolean", "description": "Enables integration with the Google Workspace Admin SDK Directory API. When true, Auth0 can retrieve extended user attributes (admin status, suspension status, group memberships) and supports inbound directory provisioning (SCIM). Defaults to true." }, "client_id": { "type": "string", "examples": [ "123456789-abc123def456.apps.googleusercontent.com" ], "minLength": 1, "maxLength": 128, "description": "Your Google OAuth 2.0 client ID. You can find this in your [Google Cloud Console](https://console.cloud.google.com/apis/credentials) under the OAuth 2.0 Client IDs section." }, "domain": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 1024, "description": "Primary Google Workspace domain name that users must belong to." }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 1000, "description": "Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication." }, "email": { "type": "boolean", "description": "Whether the OAuth flow requests the `email` scope." }, "ext_agreed_terms": { "type": "boolean", "description": "Fetches the `agreedToTerms` flag from the Google Directory profile." }, "ext_groups": { "type": "boolean", "description": "Enables enrichment with Google group memberships (required for `ext_groups_extended`)." }, "ext_groups_extended": { "type": "boolean", "description": "Controls whether enriched group entries include `id`, `email`, `name` (true) or only the group name (false); can only be set when `ext_groups` is true." }, "ext_is_admin": { "type": "boolean", "description": "Fetches the Google Directory admin flag for the signing-in user." }, "ext_is_suspended": { "type": "boolean", "description": "Fetches the Google Directory suspended flag for the signing-in user." }, "federated_connections_access_tokens": { "description": "Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.", "type": "object", "properties": { "active": { "type": "boolean", "description": "Enables refresh tokens and access tokens collection for federated connections" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "handle_login_from_social": { "type": "boolean", "description": "When enabled, users who sign in with their Google account through a social login will be automatically routed to this Google Workspace connection if their email domain matches the configured tenant_domain or domain_aliases. This ensures enterprise users authenticate through their organization's Google Workspace identity provider rather than through a generic Google social login, enabling access to directory-based attributes and enforcing organizational security policies. Defaults to true for new connections." }, "icon_url": { "description": "URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "map_user_id_to_id": { "type": "boolean", "description": "Determines how Auth0 generates the user_id for Google Workspace users. When false (default), the user's email address is used. When true, Google's stable numeric user ID is used instead, which persists even if the user's email changes. This setting can only be configured when creating the connection and cannot be changed afterward." }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "profile": { "type": "boolean", "description": "Whether the OAuth flow requests the `profile` scope." }, "scope": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 255 }, "minItems": 1, "maxItems": 64, "description": "Additional OAuth scopes requested beyond the default `email profile` scopes; ignored unless `allow_setting_login_scopes` is true." }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "tenant_domain": { "description": "The Google Workspace primary domain used to identify the organization during authentication.", "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255 }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} } }, "required": [ "client_id" ], "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "google-apps", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'waad' connection", "type": "object", "properties": { "api_enable_users": { "type": "boolean", "description": "Enable users API" }, "app_domain": { "type": "string", "examples": [ "contoso.onmicrosoft.com" ], "minLength": 0, "maxLength": 255, "description": "The Azure AD application domain (e.g., 'contoso.onmicrosoft.com'). Used primarily with WS-Federation protocol and Azure AD v1 endpoints." }, "app_id": { "type": "string", "examples": [ "api://contoso-azure-app" ], "minLength": 0, "maxLength": 500, "description": "The Application ID URI (App ID URI) for the Azure AD application. Required when using Azure AD v1 with the Resource Owner Password flow. Used to identify the resource being requested in OAuth token requests." }, "basic_profile": { "type": "boolean", "description": "Includes basic user profile information from Azure AD (name, email, given_name, family_name). Always enabled and required - represents the minimum profile data retrieved during authentication." }, "cert_rollover_notification": { "type": "string", "format": "date-time", "description": "Timestamp of the last certificate expiring soon notification." }, "client_id": { "type": "string", "examples": [ "12345678-1234-1234-1234-123456789012" ], "minLength": 0, "maxLength": 100, "description": "OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider." }, "domain": { "type": "string", "examples": [ "contoso.onmicrosoft.com" ], "minLength": 0, "maxLength": 512, "description": "The primary Azure AD tenant domain (e.g., 'contoso.onmicrosoft.com' or 'contoso.com')." }, "domain_aliases": { "type": "array", "items": { "type": "string", "minLength": 0, "maxLength": 255 }, "minItems": 0, "maxItems": 1000, "description": "Alternative domain names associated with this Azure AD tenant. Allows users from multiple verified domains to authenticate through this connection. Can be an array of domain strings." }, "ext_groups": { "type": "boolean", "description": "When enabled (true), retrieves and stores Azure AD security group memberships for the user. Requires Microsoft Graph API permissions (Directory.Read.All). Allows configuring max_groups_to_retrieve." }, "ext_nested_groups": { "type": "boolean", "description": "When true, stores all groups the user is member of, including transitive group memberships (groups within groups). When false (default), only direct group memberships are included." }, "ext_profile": { "type": "boolean", "description": "When enabled (true), retrieves extended profile attributes from Azure AD via Microsoft Graph API (job title, department, office location, etc.). Requires Graph API permissions. Only available with Azure AD v1 or when explicitly enabled for v2." }, "federated_connections_access_tokens": { "description": "Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.", "type": "object", "properties": { "active": { "type": "boolean", "description": "Enables refresh tokens and access tokens collection for federated connections" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "granted": { "type": "boolean", "description": "Indicates whether admin consent has been granted for the required Azure AD permissions. Read-only status field managed by Auth0 during the OAuth authorization flow." }, "icon_url": { "description": "URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "identity_api": { "description": "The Azure AD endpoint version for authentication. 'microsoft-identity-platform-v2.0' (recommended, default) supports modern OAuth 2.0 features. 'azure-active-directory-v1.0' is the legacy endpoint with protocol limitations. Selection affects available features.", "type": "string", "enum": [ "microsoft-identity-platform-v2.0", "azure-active-directory-v1.0" ] }, "max_groups_to_retrieve": { "type": "string", "examples": [ "100" ], "minLength": 0, "maxLength": 10, "description": "Maximum number of Azure AD groups to retrieve per user during authentication. Helps prevent performance issues for users in many groups. Only applies when ext_groups is enabled. Leave empty to use platform default." }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "scope": { "type": "array", "items": { "type": "string", "minLength": 0, "maxLength": 100 }, "minItems": 0, "maxItems": 100, "description": "OAuth 2.0 scopes to request from Azure AD during authentication. Each scope represents a permission (e.g., 'User.Read', 'Group.Read.All'). Only applies with Microsoft Identity Platform v2.0. See Microsoft Graph permissions reference for available scopes." }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "should_trust_email_verified_connection": { "description": "Choose how Auth0 sets the email_verified field in the user profile.", "type": "string", "enum": [ "never_set_emails_as_verified", "always_set_emails_as_verified" ] }, "tenant_domain": { "anyOf": [ { "type": "string", "examples": [ "contoso.onmicrosoft.com" ], "minLength": 0, "maxLength": 512, "format": "hostname", "description": "Azure AD tenant domain as a hostname (e.g. contoso.onmicrosoft.com)." }, { "type": "string", "format": "uuid", "description": "Azure AD tenant domain as a UUID tenant ID." } ], "description": "The Azure AD tenant domain or tenant ID (UUID). Auto-populated from the 'domain' field. Can be either a hostname (e.g., 'contoso.onmicrosoft.com') or a UUID tenant ID." }, "tenantId": { "type": "string", "examples": [ "12345678-1234-1234-1234-123456789012" ], "minLength": 36, "maxLength": 36, "format": "uuid", "description": "The Azure AD tenant ID as a UUID. The unique identifier for your Azure AD organization. Must be a valid 36-character UUID." }, "thumbprints": { "type": "array", "items": { "type": "string", "examples": [ "AB12CD34EF56789012345678901234567890ABCD" ], "minLength": 0, "maxLength": 64, "description": "Certificate thumbprints for ADFS and Azure AD connections." }, "minItems": 0, "maxItems": 20, "description": "Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string." }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "use_wsfed": { "type": "boolean", "description": "Indicates WS-Federation protocol usage. When true, uses WS-Federation; when false, uses OpenID Connect." }, "useCommonEndpoint": { "type": "boolean", "description": "When enabled (true), uses the Azure AD common endpoint for multi-tenant authentication. Allows users from any Azure AD organization to sign in. Requires userid_attribute set to 'sub' (not 'oid'). Cannot be used with SCIM provisioning. Defaults to false." }, "userid_attribute": { "description": "The Azure AD claim to use as the unique user identifier. 'oid' (Object ID) is recommended for single-tenant connections and required for SCIM. 'sub' (Subject) is required for multi-tenant/common endpoint. Only applies with OpenID Connect protocol.", "type": "string", "enum": [ "oid", "sub" ] }, "waad_protocol": { "description": "The authentication protocol for Azure AD v1 endpoints. 'openid-connect' (default, recommended) uses modern OAuth 2.0/OIDC. 'ws-federation' is a legacy SAML-based protocol for older integrations. Only available with Azure AD v1 API.", "type": "string", "enum": [ "ws-federation", "openid-connect" ] } }, "required": [ "client_id" ], "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "waad", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" } ] }, "previous_object": { "description": "The event content as it was prior to the change described by this event, when applicable.", "oneOf": [ { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" }, "cross_app_access": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "options": { "description": "Options for the 'oidc' connection", "type": "object", "properties": { "authorization_endpoint": { "description": "URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/authorize" ], "minLength": 8, "maxLength": 2083, "format": "uri" }, "client_id": { "type": "string", "examples": [ "abc123def456ghi789" ], "minLength": 0, "maxLength": 255, "description": "OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider." }, "connection_settings": { "description": "OAuth 2.0 PKCE (Proof Key for Code Exchange) settings. PKCE enhances security for public clients by preventing authorization code interception attacks. 'auto' (recommended) uses the strongest method supported by the IdP.", "type": "object", "properties": { "pkce": { "description": "PKCE configuration.", "type": "string", "enum": [ "auto", "S256", "plain", "disabled" ] } }, "unevaluatedProperties": { "not": {} } }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 1000, "description": "Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication." }, "dpop_signing_alg": { "description": "Algorithm used for DPoP proof JWT signing. Applicable when strategy=oidc or okta.", "type": "string", "enum": [ "ES256", "ES384", "ES512", "Ed25519" ] }, "federated_connections_access_tokens": { "description": "Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.", "type": "object", "properties": { "active": { "type": "boolean", "description": "Enables refresh tokens and access tokens collection for federated connections" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "icon_url": { "description": "https url of the icon to be shown", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "id_token_session_expiry_supported": { "type": "boolean", "description": "Indicates whether the identity provider supports session expiry via the id_token. If true, the system will use the session_expiry claim in the id_token to determine session expiry." }, "id_token_signed_response_algs": { "type": "array", "items": { "type": "string", "enum": [ "ES256", "ES384", "PS256", "PS384", "RS256", "RS384", "RS512" ], "description": "Algorithm allowed to verify the ID tokens." }, "description": "List of algorithms allowed to verify the ID tokens. Applicable when strategy=oidc or okta." }, "issuer": { "description": "The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.", "type": "string", "examples": [ "https://accounts.example.com" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "jwks_uri": { "description": "URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.", "type": "string", "examples": [ "https://provider.example.com/.well-known/jwks.json" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "oidc_metadata": { "description": "OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata", "type": "object", "properties": { "acr_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "urn:mace:incommon:iap:silver" ], "maxLength": 100 }, "minItems": 0, "maxItems": 30, "description": "A list of the Authentication Context Class References that this OP supports" }, "authorization_endpoint": { "description": "URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/authorize" ], "minLength": 8, "maxLength": 2083, "format": "uri" }, "claim_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "normal" ], "maxLength": 25 }, "minItems": 0, "maxItems": 10, "description": "JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims." }, "claims_locales_supported": { "type": "array", "items": { "type": "string", "examples": [ "en-US" ], "maxLength": 50 }, "minItems": 0, "maxItems": 100, "description": "Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values." }, "claims_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false." }, "claims_supported": { "type": "array", "items": { "type": "string", "examples": [ "sub" ], "maxLength": 100 }, "minItems": 0, "maxItems": 150, "description": "JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list." }, "code_challenge_methods_supported": { "type": "array", "items": { "type": "string", "examples": [ "S256" ], "maxLength": 20 }, "minItems": 0, "maxItems": 10, "description": "JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636." }, "display_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "page" ], "maxLength": 10 }, "minItems": 0, "maxItems": 6, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used." }, "dpop_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "ES256" ], "maxLength": 14 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing." }, "end_session_endpoint": { "type": "string", "examples": [ "https://provider.example.com/oauth/logout" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme." }, "grant_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "authorization_code" ], "maxLength": 100 }, "minItems": 0, "maxItems": 20, "description": "A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"]." }, "id_token_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RSA-OAEP" ], "maxLength": 14 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT" }, "id_token_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT]." }, "id_token_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10, "description": "JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata)." }, "minItems": 1, "maxItems": 26, "description": "A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518" }, "issuer": { "description": "The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.", "type": "string", "examples": [ "https://accounts.example.com" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "jwks_uri": { "description": "URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.", "type": "string", "examples": [ "https://provider.example.com/.well-known/jwks.json" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "op_policy_uri": { "type": "string", "examples": [ "https://provider.example.com/policy" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given." }, "op_tos_uri": { "type": "string", "examples": [ "https://provider.example.com/terms" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given." }, "registration_endpoint": { "type": "string", "examples": [ "https://provider.example.com/oauth/register" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration" }, "request_object_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RSA-OAEP" ], "maxLength": 28 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference." }, "request_object_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference." }, "request_object_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256." }, "request_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false." }, "request_uri_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false." }, "require_request_uri_registration": { "type": "boolean", "description": "Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false." }, "response_modes_supported": { "type": "array", "items": { "type": "string", "examples": [ "query" ], "maxLength": 20 }, "minItems": 0, "maxItems": 16, "description": "A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]" }, "response_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "code" ], "maxLength": 40 }, "minItems": 1, "maxItems": 40, "description": "A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values" }, "scopes_supported": { "type": "array", "items": { "type": "string", "examples": [ "openid" ], "maxLength": 100 }, "minItems": 0, "maxItems": 7000, "description": "A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED" }, "service_documentation": { "type": "string", "examples": [ "https://provider.example.com/docs" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation." }, "subject_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "public" ], "minLength": 0, "maxLength": 100 }, "minItems": 0, "maxItems": 20, "description": "A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public" }, "token_endpoint": { "description": "URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/token" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "token_endpoint_auth_methods_supported": { "type": "array", "items": { "type": "string", "examples": [ "client_secret_basic" ], "maxLength": 60 }, "minItems": 0, "maxItems": 14, "description": "JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749]." }, "token_endpoint_auth_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 24, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used." }, "ui_locales_supported": { "type": "array", "items": { "type": "string", "examples": [ "en-US" ], "maxLength": 50 }, "minItems": 0, "maxItems": 150, "description": "Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values." }, "userinfo_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]." }, "userinfo_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]." }, "userinfo_endpoint": { "description": "Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.", "type": "string", "examples": [ "https://provider.example.com/oauth/userinfo" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "userinfo_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included." } }, "required": [ "authorization_endpoint", "id_token_signing_alg_values_supported", "issuer", "jwks_uri" ], "unevaluatedProperties": { "not": {} } }, "schema_version": { "description": "The internal schema version of the connection options.", "type": "string", "enum": [ "openid-1.0.0", "oidc-v4" ] }, "scope": { "type": "string", "examples": [ "openid profile email" ], "minLength": 6, "maxLength": 255, "description": "Space-separated list of OAuth 2.0 scopes requested during authorization. Must include 'openid' (required by OIDC spec). Common values: 'openid profile email'. Additional scopes depend on the identity provider." }, "send_back_channel_nonce": { "type": "boolean", "description": "When true and type is 'back_channel', includes a cryptographic nonce in authorization requests to prevent replay attacks. The identity provider must include this nonce in the ID token for validation." }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "tenant_domain": { "description": "Tenant domain", "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255 }, "token_endpoint": { "description": "URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/token" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "token_endpoint_auth_method": { "description": "Authentication method used at the identity provider's token endpoint. 'client_secret_post' sends credentials in the request body; 'private_key_jwt' uses a signed JWT assertion for enhanced security. Applicable when strategy=oidc or okta.", "type": "string", "enum": [ "client_secret_post", "private_key_jwt" ] }, "token_endpoint_auth_signing_alg": { "description": "Algorithm used to sign client_assertions. Applicable when strategy=oidc or okta.", "type": "string", "enum": [ "ES256", "ES384", "PS256", "PS384", "RS256", "RS384", "RS512" ] }, "token_endpoint_jwtca_aud_format": { "description": "Specifies the format of the aud (audience) claim included in the JWT used for client authentication at the token endpoint. Accepted values are: 'issuer' (the aud claim is set to the OIDC issuer URL) or 'token_endpoint' (the aud claim is set to the token endpoint URL).", "type": "string", "enum": [ "issuer", "token_endpoint" ] }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "useOauthSpecScope": { "type": "boolean", "description": "When true, uses space-delimited scopes (per OAuth 2.0 spec) instead of comma-delimited when calling the identity provider's authorization endpoint. Only relevant when using the connection_scope parameter. See https://auth0.com/docs/authenticate/identity-providers/adding-scopes-for-an-external-idp#pass-scopes-to-authorize-endpoint" }, "userinfo_endpoint": { "description": "Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.", "type": "string", "examples": [ "https://provider.example.com/oauth/userinfo" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "attribute_map": { "description": "Configuration for mapping claims from the identity provider to Auth0 user profile attributes. Allows customizing which IdP claims populate user fields and how they are transformed.", "type": "object", "properties": { "attributes": { "description": "Object containing mapping details for incoming claims", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "userinfo_scope": { "type": "string", "examples": [ "openid profile email" ], "minLength": 0, "maxLength": 255, "description": "Scopes to send to the IdP's Userinfo endpoint" }, "mapping_mode": { "description": "Method used to map incoming claims when strategy=oidc.", "type": "string", "enum": [ "bind_all", "use_map" ] } }, "unevaluatedProperties": { "not": {} } }, "discovery_url": { "type": "string", "examples": [ "https://provider.example.com/.well-known/openid-configuration" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the identity provider's OIDC Discovery endpoint (/.well-known/openid-configuration). When provided and oidc_metadata is empty, Auth0 automatically retrieves the provider's configuration including endpoints and supported features." }, "type": { "description": "OIDC communication channel type. 'back_channel' (confidential client) exchanges tokens server-side for stronger security; 'front_channel' handles responses in the browser.", "type": "string", "enum": [ "back_channel", "front_channel" ] } }, "required": [ "client_id" ], "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "oidc", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'okta' connection", "type": "object", "properties": { "authorization_endpoint": { "description": "URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/authorize" ], "minLength": 8, "maxLength": 2083, "format": "uri" }, "client_id": { "type": "string", "examples": [ "abc123def456ghi789" ], "minLength": 0, "maxLength": 255, "description": "OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider." }, "connection_settings": { "description": "OAuth 2.0 PKCE (Proof Key for Code Exchange) settings. PKCE enhances security for public clients by preventing authorization code interception attacks. 'auto' (recommended) uses the strongest method supported by the IdP.", "type": "object", "properties": { "pkce": { "description": "PKCE configuration.", "type": "string", "enum": [ "auto", "S256", "plain", "disabled" ] } }, "unevaluatedProperties": { "not": {} } }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 1000, "description": "Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication." }, "dpop_signing_alg": { "description": "Algorithm used for DPoP proof JWT signing. Applicable when strategy=oidc or okta.", "type": "string", "enum": [ "ES256", "ES384", "ES512", "Ed25519" ] }, "federated_connections_access_tokens": { "description": "Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.", "type": "object", "properties": { "active": { "type": "boolean", "description": "Enables refresh tokens and access tokens collection for federated connections" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "icon_url": { "description": "https url of the icon to be shown", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "id_token_session_expiry_supported": { "type": "boolean", "description": "Indicates whether the identity provider supports session expiry via the id_token. If true, the system will use the session_expiry claim in the id_token to determine session expiry." }, "id_token_signed_response_algs": { "type": "array", "items": { "type": "string", "enum": [ "ES256", "ES384", "PS256", "PS384", "RS256", "RS384", "RS512" ], "description": "Algorithm allowed to verify the ID tokens." }, "description": "List of algorithms allowed to verify the ID tokens. Applicable when strategy=oidc or okta." }, "issuer": { "description": "The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.", "type": "string", "examples": [ "https://accounts.example.com" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "jwks_uri": { "description": "URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.", "type": "string", "examples": [ "https://provider.example.com/.well-known/jwks.json" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "oidc_metadata": { "description": "OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata", "type": "object", "properties": { "acr_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "urn:mace:incommon:iap:silver" ], "maxLength": 100 }, "minItems": 0, "maxItems": 30, "description": "A list of the Authentication Context Class References that this OP supports" }, "authorization_endpoint": { "description": "URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/authorize" ], "minLength": 8, "maxLength": 2083, "format": "uri" }, "claim_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "normal" ], "maxLength": 25 }, "minItems": 0, "maxItems": 10, "description": "JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims." }, "claims_locales_supported": { "type": "array", "items": { "type": "string", "examples": [ "en-US" ], "maxLength": 50 }, "minItems": 0, "maxItems": 100, "description": "Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values." }, "claims_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false." }, "claims_supported": { "type": "array", "items": { "type": "string", "examples": [ "sub" ], "maxLength": 100 }, "minItems": 0, "maxItems": 150, "description": "JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list." }, "code_challenge_methods_supported": { "type": "array", "items": { "type": "string", "examples": [ "S256" ], "maxLength": 20 }, "minItems": 0, "maxItems": 10, "description": "JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636." }, "display_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "page" ], "maxLength": 10 }, "minItems": 0, "maxItems": 6, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used." }, "dpop_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "ES256" ], "maxLength": 14 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing." }, "end_session_endpoint": { "type": "string", "examples": [ "https://provider.example.com/oauth/logout" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme." }, "grant_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "authorization_code" ], "maxLength": 100 }, "minItems": 0, "maxItems": 20, "description": "A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"]." }, "id_token_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RSA-OAEP" ], "maxLength": 14 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT" }, "id_token_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT]." }, "id_token_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10, "description": "JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata)." }, "minItems": 1, "maxItems": 26, "description": "A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518" }, "issuer": { "description": "The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.", "type": "string", "examples": [ "https://accounts.example.com" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "jwks_uri": { "description": "URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.", "type": "string", "examples": [ "https://provider.example.com/.well-known/jwks.json" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "op_policy_uri": { "type": "string", "examples": [ "https://provider.example.com/policy" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given." }, "op_tos_uri": { "type": "string", "examples": [ "https://provider.example.com/terms" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given." }, "registration_endpoint": { "type": "string", "examples": [ "https://provider.example.com/oauth/register" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration" }, "request_object_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RSA-OAEP" ], "maxLength": 28 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference." }, "request_object_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference." }, "request_object_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256." }, "request_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false." }, "request_uri_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false." }, "require_request_uri_registration": { "type": "boolean", "description": "Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false." }, "response_modes_supported": { "type": "array", "items": { "type": "string", "examples": [ "query" ], "maxLength": 20 }, "minItems": 0, "maxItems": 16, "description": "A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]" }, "response_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "code" ], "maxLength": 40 }, "minItems": 1, "maxItems": 40, "description": "A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values" }, "scopes_supported": { "type": "array", "items": { "type": "string", "examples": [ "openid" ], "maxLength": 100 }, "minItems": 0, "maxItems": 7000, "description": "A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED" }, "service_documentation": { "type": "string", "examples": [ "https://provider.example.com/docs" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation." }, "subject_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "public" ], "minLength": 0, "maxLength": 100 }, "minItems": 0, "maxItems": 20, "description": "A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public" }, "token_endpoint": { "description": "URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/token" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "token_endpoint_auth_methods_supported": { "type": "array", "items": { "type": "string", "examples": [ "client_secret_basic" ], "maxLength": 60 }, "minItems": 0, "maxItems": 14, "description": "JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749]." }, "token_endpoint_auth_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 24, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used." }, "ui_locales_supported": { "type": "array", "items": { "type": "string", "examples": [ "en-US" ], "maxLength": 50 }, "minItems": 0, "maxItems": 150, "description": "Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values." }, "userinfo_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]." }, "userinfo_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]." }, "userinfo_endpoint": { "description": "Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.", "type": "string", "examples": [ "https://provider.example.com/oauth/userinfo" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "userinfo_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included." } }, "required": [ "authorization_endpoint", "id_token_signing_alg_values_supported", "issuer", "jwks_uri" ], "unevaluatedProperties": { "not": {} } }, "schema_version": { "description": "The internal schema version of the connection options.", "type": "string", "enum": [ "openid-1.0.0", "oidc-v4" ] }, "scope": { "type": "string", "examples": [ "openid profile email" ], "minLength": 6, "maxLength": 255, "description": "Space-separated list of OAuth 2.0 scopes requested during authorization. Must include 'openid' (required by OIDC spec). Common values: 'openid profile email'. Additional scopes depend on the identity provider." }, "send_back_channel_nonce": { "type": "boolean", "description": "When true and type is 'back_channel', includes a cryptographic nonce in authorization requests to prevent replay attacks. The identity provider must include this nonce in the ID token for validation." }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "tenant_domain": { "description": "Tenant domain", "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255 }, "token_endpoint": { "description": "URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/token" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "token_endpoint_auth_method": { "description": "Authentication method used at the identity provider's token endpoint. 'client_secret_post' sends credentials in the request body; 'private_key_jwt' uses a signed JWT assertion for enhanced security. Applicable when strategy=oidc or okta.", "type": "string", "enum": [ "client_secret_post", "private_key_jwt" ] }, "token_endpoint_auth_signing_alg": { "description": "Algorithm used to sign client_assertions. Applicable when strategy=oidc or okta.", "type": "string", "enum": [ "ES256", "ES384", "PS256", "PS384", "RS256", "RS384", "RS512" ] }, "token_endpoint_jwtca_aud_format": { "description": "Specifies the format of the aud (audience) claim included in the JWT used for client authentication at the token endpoint. Accepted values are: 'issuer' (the aud claim is set to the OIDC issuer URL) or 'token_endpoint' (the aud claim is set to the token endpoint URL).", "type": "string", "enum": [ "issuer", "token_endpoint" ] }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "useOauthSpecScope": { "type": "boolean", "description": "When true, uses space-delimited scopes (per OAuth 2.0 spec) instead of comma-delimited when calling the identity provider's authorization endpoint. Only relevant when using the connection_scope parameter. See https://auth0.com/docs/authenticate/identity-providers/adding-scopes-for-an-external-idp#pass-scopes-to-authorize-endpoint" }, "userinfo_endpoint": { "description": "Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.", "type": "string", "examples": [ "https://provider.example.com/oauth/userinfo" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "attribute_map": { "description": "Mapping of claims received from the identity provider (IdP)", "type": "object", "properties": { "attributes": { "description": "Object containing mapping details for incoming claims", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "userinfo_scope": { "type": "string", "examples": [ "openid profile email" ], "minLength": 0, "maxLength": 255, "description": "Scopes to send to the IdP's Userinfo endpoint" }, "mapping_mode": { "description": "Method used to map incoming claims when strategy=okta.", "type": "string", "enum": [ "basic_profile", "use_map" ] } }, "unevaluatedProperties": { "not": {} } }, "domain": { "type": "string", "examples": [ "dev-123456.okta.com" ], "minLength": 4, "maxLength": 255, "description": "Domain of the Okta organization (e.g., dev-123456.okta.com). Should be just the domain of the okta server with no scheme or trailing backslash. Discovery runs only when connection.options.oidc_metadata is empty and a domain is provided" }, "type": { "description": "Connection type", "type": "string", "enum": [ "back_channel" ] } }, "required": [ "client_id" ], "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "okta", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'samlp' connection", "type": "object", "properties": { "assertion_decryption_settings": { "description": "Settings for SAML assertion decryption.", "type": "object", "properties": { "algorithm_exceptions": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 100 }, "maxItems": 10, "description": "A list of insecure algorithms to allow for SAML assertion decryption." }, "algorithm_profile": { "description": "The algorithm profile to use for decrypting SAML assertions.", "type": "string", "enum": [ "v2026-1" ] } }, "required": [ "algorithm_profile" ], "unevaluatedProperties": { "not": {} } }, "cert": { "type": "string", "minLength": 1, "maxLength": 10240, "description": "X.509 signing certificate from the identity provider in .der format. Used to validate signatures in SAML Responses and Assertions. This is an alternative to signingCert and is kept for backward compatibility. Prefer using signingCert instead.", "deprecated": true }, "cert_rollover_notification": { "type": "string", "format": "date-time", "description": "Timestamp of the last certificate expiring soon notification." }, "digestAlgorithm": { "description": "Algorithm used for computing digest values when signing SAML requests and logout requests. Defaults to 'sha256'.", "type": "string", "enum": [ "sha1", "sha256" ] }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 50001, "description": "Domain aliases for the connection" }, "entityId": { "description": "The entity identifier (Issuer) for the SAML Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'. This value is included in SAML AuthnRequest messages sent to the identity provider.", "type": "string", "examples": [ "urn:auth0:my-tenant:my-connection" ], "minLength": 1, "maxLength": 128 }, "expires": { "type": "string", "format": "date-time", "description": "ISO 8601 formatted datetime indicating when the identity provider's signing certificate expires." }, "icon_url": { "description": "URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "idpinitiated": { "description": "Configuration for IdP-Initiated SAML Single Sign-On. When enabled, allows users to initiate login directly from their SAML identity provider without first visiting Auth0. The IdP must include the connection parameter in the post-back URL (Assertion Consumer Service URL).", "type": "object", "properties": { "client_authorizequery": { "type": "string", "minLength": 1, "maxLength": 2048, "description": "The query string sent to the default application" }, "client_id": { "type": "string", "minLength": 1, "maxLength": 256, "description": "The client ID to use for IdP-initiated login requests." }, "client_protocol": { "description": "The response protocol used to communicate with the default application.", "type": "string", "enum": [ "oidc", "samlp", "wsfed" ] }, "enabled": { "type": "boolean", "description": "When true, enables IdP-initiated login support for this SAML connection. Allows users to log in directly from the identity provider without first visiting Auth0." } }, "unevaluatedProperties": { "not": {} } }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "protocolBinding": { "description": "SAML protocol binding mechanism for sending authentication requests to the identity provider.", "type": "string", "enum": [ "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST", "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" ] }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "signatureAlgorithm": { "description": "Algorithm used to sign SAML authentication requests and logout requests using the connection's signing key. Common values: 'rsa-sha256' (RSA signature with SHA-256 digest) or 'rsa-sha1'. Defaults to 'rsa-sha256'.", "type": "string", "enum": [ "rsa-sha1", "rsa-sha256" ] }, "signInEndpoint": { "description": "Identity provider's SAML SingleSignOnService endpoint URL where Auth0 sends SAML authentication requests. This is the primary login URL for the SAML connection. Required unless using metadataUrl or metadataXml.", "type": "string", "examples": [ "https://idp.example.com/saml/sso" ], "minLength": 8, "maxLength": 2048, "format": "uri" }, "signingCert": { "description": "Base64-encoded X.509 certificate from the identity provider used to validate signatures in SAML responses and assertions. The certificate is decoded and used for cryptographic signature verification.", "type": "string", "examples": [ "MIIDDTCCAfWgAwIBAgIJALFkBP7GVlWkMA0GCSqGSIb3DQEBCwUAMCUxIzAhBgNV" ], "minLength": 1, "maxLength": 10240 }, "signSAMLRequest": { "type": "boolean", "description": "When true, Auth0 signs SAML authentication requests using the connection's signing key. The signature includes the request's digest and is validated by the identity provider. Defaults to false (unsigned requests)." }, "subject": { "description": "Certificate Subject Distinguished Name (DN) extracted from the identity provider's signing certificate.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "tenant_domain": { "description": "For SAML connections, the tenant domain used to construct the login endpoint URL. Can be a string for single-tenant or an array of strings for multi-tenant validation.", "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255 }, "thumbprints": { "type": "array", "items": { "type": "string", "examples": [ "ef34ab56cd78901234567890123456789012efab" ], "minLength": 40, "maxLength": 40 }, "minItems": 0, "maxItems": 1, "description": "SHA-1 thumbprints (fingerprints) of the identity provider's signing certificates. Automatically computed from signingCert during connection creation. Each thumbprint must be a 40-character hexadecimal string." }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "debug": { "type": "boolean", "description": "When true, enables detailed SAML debugging by issuing 'w' (warning) events in tenant logs containing SAML request/response details. WARNING: Potentially exposes sensitive user information (PII, credentials) and should only be enabled temporarily for debugging purposes." }, "deflate": { "type": "boolean", "description": "When true, enables DEFLATE compression for SAML requests sent via HTTP-Redirect binding." }, "destinationUrl": { "type": "string", "examples": [ "https://idp.example.com/saml/sso" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "The URL where Auth0 will send SAML authentication requests (the Identity Provider's SSO URL). Must be a valid HTTPS URL." }, "disableFieldsMapFix": { "type": "boolean", "description": "When true, disables the automatic correction of the fieldsMap configuration to ensure proper mapping of SAML attributes to user profile fields. Defaults to false (fieldsMap fix enabled)." }, "disableSignout": { "type": "boolean", "description": "When true, disables sending SAML logout requests (SingleLogoutService) to the identity provider during user sign-out. The user will be logged out of Auth0 but will remain logged into the identity provider. Defaults to false (federated logout enabled)." }, "discovery_url": { "type": "string", "examples": [ "https://provider.example.com/.well-known/openid-configuration" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the identity provider's OIDC Discovery endpoint (/.well-known/openid-configuration). When provided and oidc_metadata is empty, Auth0 automatically retrieves the provider's configuration including endpoints and supported features. Used with Cross App Access.", "x-release-lifecycle": "EA" }, "fieldsMap": { "description": "Maps SAML assertion attributes from the identity provider to Auth0 user profile attributes. Format: { 'auth0_field': 'saml_attribute' } or { 'auth0_field': ['saml_attr1', 'saml_attr2'] } for fallback options. Merged with default mappings for email, name, given_name, family_name, and groups.", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "fieldsMapJsonRaw": { "type": "string", "minLength": 0, "maxLength": 8192, "description": "Raw JSON string representation of the fieldsMap configuration. Used internally for storage and retrieval of the fieldsMap object." }, "global_token_revocation_jwt_iss": { "type": "string", "minLength": 1, "maxLength": 1024, "description": "Expected 'iss' (Issuer) claim value for JWT tokens in Global Token Revocation requests from the identity provider. When configured, Auth0 validates the JWT issuer matches this value before processing token revocation. Must be used together with global_token_revocation_jwt_sub." }, "global_token_revocation_jwt_sub": { "type": "string", "minLength": 1, "maxLength": 1024, "description": "Expected 'sub' (Subject) claim value for JWT tokens in Global Token Revocation requests from the identity provider. When configured, Auth0 validates the JWT subject matches this value before processing token revocation. Must be used together with global_token_revocation_jwt_iss." }, "metadataUrl": { "type": "string", "examples": [ "https://idp.example.com/saml/metadata" ], "minLength": 8, "maxLength": 2048, "format": "uri", "description": "HTTPS URL to the identity provider's SAML metadata document. When provided, Auth0 automatically fetches and parses the metadata to extract signInEndpoint, signOutEndpoint, signingCert, signSAMLRequest, and protocolBinding. Use metadataUrl OR metadataXml, not both." }, "oidc_metadata": { "description": "OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata. Used with Cross App Access.", "x-release-lifecycle": "EA", "type": "object", "properties": { "acr_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "urn:mace:incommon:iap:silver" ], "maxLength": 100 }, "minItems": 0, "maxItems": 30, "description": "A list of the Authentication Context Class References that this OP supports" }, "authorization_endpoint": { "description": "URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/authorize" ], "minLength": 8, "maxLength": 2083, "format": "uri" }, "claim_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "normal" ], "maxLength": 25 }, "minItems": 0, "maxItems": 10, "description": "JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims." }, "claims_locales_supported": { "type": "array", "items": { "type": "string", "examples": [ "en-US" ], "maxLength": 50 }, "minItems": 0, "maxItems": 100, "description": "Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values." }, "claims_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false." }, "claims_supported": { "type": "array", "items": { "type": "string", "examples": [ "sub" ], "maxLength": 100 }, "minItems": 0, "maxItems": 150, "description": "JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list." }, "code_challenge_methods_supported": { "type": "array", "items": { "type": "string", "examples": [ "S256" ], "maxLength": 20 }, "minItems": 0, "maxItems": 10, "description": "JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636." }, "display_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "page" ], "maxLength": 10 }, "minItems": 0, "maxItems": 6, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used." }, "dpop_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "ES256" ], "maxLength": 14 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing." }, "end_session_endpoint": { "type": "string", "examples": [ "https://provider.example.com/oauth/logout" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme." }, "grant_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "authorization_code" ], "maxLength": 100 }, "minItems": 0, "maxItems": 20, "description": "A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"]." }, "id_token_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RSA-OAEP" ], "maxLength": 14 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT" }, "id_token_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT]." }, "id_token_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10, "description": "JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata)." }, "minItems": 1, "maxItems": 26, "description": "A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518" }, "issuer": { "description": "The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.", "type": "string", "examples": [ "https://accounts.example.com" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "jwks_uri": { "description": "URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.", "type": "string", "examples": [ "https://provider.example.com/.well-known/jwks.json" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "op_policy_uri": { "type": "string", "examples": [ "https://provider.example.com/policy" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given." }, "op_tos_uri": { "type": "string", "examples": [ "https://provider.example.com/terms" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given." }, "registration_endpoint": { "type": "string", "examples": [ "https://provider.example.com/oauth/register" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration" }, "request_object_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RSA-OAEP" ], "maxLength": 28 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference." }, "request_object_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference." }, "request_object_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256." }, "request_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false." }, "request_uri_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false." }, "require_request_uri_registration": { "type": "boolean", "description": "Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false." }, "response_modes_supported": { "type": "array", "items": { "type": "string", "examples": [ "query" ], "maxLength": 20 }, "minItems": 0, "maxItems": 16, "description": "A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]" }, "response_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "code" ], "maxLength": 40 }, "minItems": 1, "maxItems": 40, "description": "A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values" }, "scopes_supported": { "type": "array", "items": { "type": "string", "examples": [ "openid" ], "maxLength": 100 }, "minItems": 0, "maxItems": 7000, "description": "A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED" }, "service_documentation": { "type": "string", "examples": [ "https://provider.example.com/docs" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation." }, "subject_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "public" ], "minLength": 0, "maxLength": 100 }, "minItems": 0, "maxItems": 20, "description": "A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public" }, "token_endpoint": { "description": "URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/token" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "token_endpoint_auth_methods_supported": { "type": "array", "items": { "type": "string", "examples": [ "client_secret_basic" ], "maxLength": 60 }, "minItems": 0, "maxItems": 14, "description": "JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749]." }, "token_endpoint_auth_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 24, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used." }, "ui_locales_supported": { "type": "array", "items": { "type": "string", "examples": [ "en-US" ], "maxLength": 50 }, "minItems": 0, "maxItems": 150, "description": "Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values." }, "userinfo_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]." }, "userinfo_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]." }, "userinfo_endpoint": { "description": "Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.", "type": "string", "examples": [ "https://provider.example.com/oauth/userinfo" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "userinfo_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included." } }, "required": [ "authorization_endpoint", "id_token_signing_alg_values_supported", "issuer", "jwks_uri" ], "unevaluatedProperties": { "not": {} } }, "recipientUrl": { "type": "string", "examples": [ "https://idp.example.com/saml/acs" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "The URL where Auth0 will send SAML authentication requests (the Identity Provider's SSO URL). Must be a valid HTTPS URL." }, "requestTemplate": { "type": "string", "minLength": 1, "maxLength": 10240, "description": "Custom XML template for SAML authentication requests. Supports variable substitution using @@variableName@@ syntax. When not provided, uses default SAML AuthnRequest template. See https://auth0.com/docs/authenticate/protocols/saml/saml-sso-integrations/configure-auth0-saml-service-provider#customize-the-request-template" }, "signOutEndpoint": { "type": "string", "examples": [ "https://idp.example.com/saml/slo" ], "minLength": 8, "maxLength": 2048, "format": "uri", "description": "Identity provider's SAML SingleLogoutService endpoint URL where Auth0 sends logout requests for federated sign-out. When not provided, defaults to signInEndpoint. Only used if disableSignout is false." }, "user_id_attribute": { "type": "string", "minLength": 1, "maxLength": 2396, "description": "Custom SAML assertion attribute to use as the unique user identifier. When provided, this attribute is prepended to the default user_id mapping list with highest priority. Accepts a string (single SAML attribute name)." } }, "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "samlp", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'pingfederate' connection", "type": "object", "properties": { "assertion_decryption_settings": { "description": "Settings for SAML assertion decryption.", "type": "object", "properties": { "algorithm_exceptions": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 100 }, "maxItems": 10, "description": "A list of insecure algorithms to allow for SAML assertion decryption." }, "algorithm_profile": { "description": "The algorithm profile to use for decrypting SAML assertions.", "type": "string", "enum": [ "v2026-1" ] } }, "required": [ "algorithm_profile" ], "unevaluatedProperties": { "not": {} } }, "cert": { "type": "string", "minLength": 1, "maxLength": 10240, "description": "X.509 signing certificate from the identity provider in .der format. Used to validate signatures in SAML Responses and Assertions. This is an alternative to signingCert and is kept for backward compatibility. Prefer using signingCert instead.", "deprecated": true }, "cert_rollover_notification": { "type": "string", "format": "date-time", "description": "Timestamp of the last certificate expiring soon notification." }, "digestAlgorithm": { "description": "Algorithm used for computing digest values when signing SAML requests and logout requests. Defaults to 'sha256'.", "type": "string", "enum": [ "sha1", "sha256" ] }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 50001, "description": "Domain aliases for the connection" }, "entityId": { "description": "The entity identifier (Issuer) for the SAML Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'. This value is included in SAML AuthnRequest messages sent to the identity provider.", "type": "string", "examples": [ "urn:auth0:my-tenant:my-connection" ], "minLength": 1, "maxLength": 128 }, "expires": { "type": "string", "format": "date-time", "description": "ISO 8601 formatted datetime indicating when the identity provider's signing certificate expires." }, "icon_url": { "description": "URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "idpinitiated": { "description": "Configuration for IdP-Initiated SAML Single Sign-On. When enabled, allows users to initiate login directly from their SAML identity provider without first visiting Auth0. The IdP must include the connection parameter in the post-back URL (Assertion Consumer Service URL).", "type": "object", "properties": { "client_authorizequery": { "type": "string", "minLength": 1, "maxLength": 2048, "description": "The query string sent to the default application" }, "client_id": { "type": "string", "minLength": 1, "maxLength": 256, "description": "The client ID to use for IdP-initiated login requests." }, "client_protocol": { "description": "The response protocol used to communicate with the default application.", "type": "string", "enum": [ "oidc", "samlp", "wsfed" ] }, "enabled": { "type": "boolean", "description": "When true, enables IdP-initiated login support for this SAML connection. Allows users to log in directly from the identity provider without first visiting Auth0." } }, "unevaluatedProperties": { "not": {} } }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "protocolBinding": { "description": "SAML protocol binding mechanism for sending authentication requests to the identity provider.", "type": "string", "enum": [ "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST", "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" ] }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "signatureAlgorithm": { "description": "Algorithm used to sign SAML authentication requests and logout requests using the connection's signing key. Common values: 'rsa-sha256' (RSA signature with SHA-256 digest) or 'rsa-sha1'. Defaults to 'rsa-sha256'.", "type": "string", "enum": [ "rsa-sha1", "rsa-sha256" ] }, "signInEndpoint": { "description": "Identity provider's SAML SingleSignOnService endpoint URL where Auth0 sends SAML authentication requests. This is the primary login URL for the SAML connection. Required unless using metadataUrl or metadataXml.", "type": "string", "examples": [ "https://idp.example.com/saml/sso" ], "minLength": 8, "maxLength": 2048, "format": "uri" }, "signingCert": { "description": "Base64-encoded X.509 certificate from the identity provider used to validate signatures in SAML responses and assertions. The certificate is decoded and used for cryptographic signature verification.", "type": "string", "examples": [ "MIIDDTCCAfWgAwIBAgIJALFkBP7GVlWkMA0GCSqGSIb3DQEBCwUAMCUxIzAhBgNV" ], "minLength": 1, "maxLength": 10240 }, "signSAMLRequest": { "type": "boolean", "description": "When true, Auth0 signs SAML authentication requests using the connection's signing key. The signature includes the request's digest and is validated by the identity provider. Defaults to false (unsigned requests)." }, "subject": { "description": "Certificate Subject Distinguished Name (DN) extracted from the identity provider's signing certificate.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "tenant_domain": { "description": "For SAML connections, the tenant domain used to construct the login endpoint URL. Can be a string for single-tenant or an array of strings for multi-tenant validation.", "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255 }, "thumbprints": { "type": "array", "items": { "type": "string", "examples": [ "ef34ab56cd78901234567890123456789012efab" ], "minLength": 40, "maxLength": 40 }, "minItems": 0, "maxItems": 1, "description": "SHA-1 thumbprints (fingerprints) of the identity provider's signing certificates. Automatically computed from signingCert during connection creation. Each thumbprint must be a 40-character hexadecimal string." }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "pingFederateBaseUrl": { "type": "string", "examples": [ "https://pingfederate.example.com" ], "minLength": 8, "maxLength": 256, "format": "uri", "description": "URL provided by PingFederate which returns information used for creating the connection" } }, "required": [ "pingFederateBaseUrl" ], "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "pingfederate", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'adfs' connection", "type": "object", "properties": { "adfs_server": { "type": "string", "examples": [ "adfs.example.com" ], "minLength": 0, "maxLength": 2048, "description": "ADFS federation metadata host or XML URL used to discover WS-Fed endpoints and certificates. Errors if adfs_server and fedMetadataXml are both absent." }, "cert_rollover_notification": { "type": "string", "format": "date-time", "description": "Timestamp of the last certificate expiring soon notification." }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 1000, "description": "Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication." }, "entityId": { "description": "The entity identifier (Issuer) for the ADFS Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'.", "type": "string", "examples": [ "urn:auth0:my-tenant:my-connection" ], "minLength": 1, "maxLength": 128 }, "fedMetadataXml": { "type": "string", "minLength": 1, "maxLength": 102400, "description": "Inline XML alternative to 'adfs_server'. Cannot be set together with 'adfs_server'." }, "icon_url": { "description": "URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "prev_thumbprints": { "type": "array", "items": { "type": "string", "examples": [ "AB12CD34EF56789012345678901234567890ABCD" ], "minLength": 0, "maxLength": 64, "description": "Certificate thumbprints for ADFS and Azure AD connections." }, "minItems": 0, "maxItems": 20, "description": "Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string." }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "should_trust_email_verified_connection": { "description": "Choose how Auth0 sets the email_verified field in the user profile.", "type": "string", "enum": [ "never_set_emails_as_verified", "always_set_emails_as_verified" ] }, "signInEndpoint": { "description": "Passive Requestor (WS-Fed) sign-in endpoint discovered from metadata or provided explicitly.", "type": "string", "examples": [ "https://idp.example.com/saml/sso" ], "minLength": 8, "maxLength": 2048, "format": "uri" }, "tenant_domain": { "description": "Tenant domain", "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255 }, "thumbprints": { "type": "array", "items": { "type": "string", "examples": [ "AB12CD34EF56789012345678901234567890ABCD" ], "minLength": 0, "maxLength": 64, "description": "Certificate thumbprints for ADFS and Azure AD connections." }, "minItems": 0, "maxItems": 20, "description": "Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string." }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "user_id_attribute": { "type": "string", "minLength": 1, "maxLength": 128, "description": "Custom ADFS claim to use as the unique user identifier. When provided, this attribute is prepended to the default user_id mapping list with highest priority. Accepts a string (single ADFS claim name)." } }, "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "adfs", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'ad' connection", "type": "object", "properties": { "agentIP": { "description": "IP address of the AD connector agent used to validate that authentication requests originate from the corporate network for Kerberos authentication (managed by the AD Connector agent).", "type": "string", "examples": [ "192.168.1.10" ], "minLength": 2, "maxLength": 39 }, "agentMode": { "type": "boolean", "description": "When enabled, allows direct username/password authentication through the AD connector agent instead of WS-Federation protocol (managed by the AD Connector agent)." }, "agentVersion": { "type": "string", "examples": [ "1.4.2" ], "minLength": 5, "maxLength": 12, "description": "Version identifier of the installed AD connector agent software (managed by the AD Connector agent)." }, "brute_force_protection": { "type": "boolean", "description": "Enables Auth0's brute force protection to prevent credential stuffing attacks. When enabled, blocks suspicious login attempts from specific IP addresses after repeated failures." }, "certAuth": { "type": "boolean", "description": "Enables client SSL certificate authentication for the AD connector, requiring HTTPS on the sign-in endpoint" }, "certs": { "type": "array", "items": { "type": "string", "examples": [ "MIIDDTCCAfWgAwIBAgIJALFkBP7GVlWkMA0GCSqGSIb3DQEBCwUAMCUxIzAhBgNVBAMTGmV4YW1wbGUuYXV0aDAuY29tIENlcnQgQ0EwHhcNMjUwMTAxMDAwMDAwWhcNMjYwMTAxMDAwMDAwWjAUMRIwEAYDVQQDEwlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC7o4qne60TB3wolFrzabc1234567890ABCDEFG" ], "minLength": 256, "maxLength": 3072 }, "minItems": 0, "maxItems": 2, "description": "Array of X.509 certificates in PEM format used for validating SAML signatures from the AD identity provider (managed by the AD Connector agent)." }, "disable_cache": { "type": "boolean", "description": "When enabled, disables caching of AD connector authentication results to ensure real-time validation against the directory" }, "disable_self_service_change_password": { "type": "boolean", "description": "When enabled, hides the 'Forgot Password' link on login pages to prevent users from initiating self-service password resets" }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 1000, "description": "List of domain names that can be used with identifier-first authentication flow to route users to this AD connection; each domain must be a valid DNS name up to 256 characters" }, "icon_url": { "description": "https url of the icon to be shown", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "ips": { "type": "array", "items": { "type": "string", "examples": [ "192.168.1.10" ], "minLength": 2, "maxLength": 39 }, "minItems": 0, "maxItems": 256, "description": "Array of IP address ranges in CIDR notation used to determine if authentication requests originate from the corporate network for Kerberos or certificate authentication." }, "kerberos": { "type": "boolean", "description": "Enables Windows Integrated Authentication (Kerberos) for seamless SSO when users authenticate from within the corporate network IP ranges" }, "kerberos_only": { "type": "boolean", "description": "When true, restricts the connection to Kerberos-only authentication, disallowing username/password fallback." }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "signInEndpoint": { "type": "string", "examples": [ "https://ad-connector.example.com" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "The sign-in endpoint type for the AD-LDAP connector agent (managed by the AD Connector agent)." }, "tenant_domain": { "type": "string", "examples": [ "corp.example.com" ], "minLength": 1, "maxLength": 512, "format": "hostname", "description": "Primary AD domain hint used for HRD and discovery." }, "thumbprints": { "type": "array", "items": { "type": "string", "examples": [ "8233ec9c12a44625d4a64ee413651fd928b5168f" ], "minLength": 40, "maxLength": 40 }, "minItems": 0, "maxItems": 2, "description": "Array of certificate SHA-1 thumbprints for validating signatures. Managed by Auth0 when using the AD Connector agent." }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} } }, "unevaluatedProperties": { "not": {} } }, "strategy": { "type": "string", "const": "ad", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'google-apps' connection", "type": "object", "properties": { "admin_access_token_expiresin": { "type": "string", "format": "date-time", "description": "Expiration timestamp for the `admin_access_token` in ISO 8601 format. Auth0 uses this value to determine when to refresh the token." }, "allow_setting_login_scopes": { "type": "boolean", "description": "When true, allows customization of OAuth scopes requested during user login. Custom scopes are appended to the mandatory email and profile scopes. When false or omitted, only the default email and profile scopes are used. This property is automatically enabled when Token Vault or Connected Accounts features are activated." }, "api_enable_groups": { "type": "boolean", "description": "Enables integration with the Google Workspace Admin SDK Directory API for groups. When true, Auth0 can synchronize groups & group memberships and supports inbound directory provisioning for groups. Defaults to false." }, "api_enable_users": { "type": "boolean", "description": "Enables integration with the Google Workspace Admin SDK Directory API. When true, Auth0 can retrieve extended user attributes (admin status, suspension status, group memberships) and supports inbound directory provisioning (SCIM). Defaults to true." }, "client_id": { "type": "string", "examples": [ "123456789-abc123def456.apps.googleusercontent.com" ], "minLength": 1, "maxLength": 128, "description": "Your Google OAuth 2.0 client ID. You can find this in your [Google Cloud Console](https://console.cloud.google.com/apis/credentials) under the OAuth 2.0 Client IDs section." }, "domain": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 1024, "description": "Primary Google Workspace domain name that users must belong to." }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 1000, "description": "Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication." }, "email": { "type": "boolean", "description": "Whether the OAuth flow requests the `email` scope." }, "ext_agreed_terms": { "type": "boolean", "description": "Fetches the `agreedToTerms` flag from the Google Directory profile." }, "ext_groups": { "type": "boolean", "description": "Enables enrichment with Google group memberships (required for `ext_groups_extended`)." }, "ext_groups_extended": { "type": "boolean", "description": "Controls whether enriched group entries include `id`, `email`, `name` (true) or only the group name (false); can only be set when `ext_groups` is true." }, "ext_is_admin": { "type": "boolean", "description": "Fetches the Google Directory admin flag for the signing-in user." }, "ext_is_suspended": { "type": "boolean", "description": "Fetches the Google Directory suspended flag for the signing-in user." }, "federated_connections_access_tokens": { "description": "Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.", "type": "object", "properties": { "active": { "type": "boolean", "description": "Enables refresh tokens and access tokens collection for federated connections" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "handle_login_from_social": { "type": "boolean", "description": "When enabled, users who sign in with their Google account through a social login will be automatically routed to this Google Workspace connection if their email domain matches the configured tenant_domain or domain_aliases. This ensures enterprise users authenticate through their organization's Google Workspace identity provider rather than through a generic Google social login, enabling access to directory-based attributes and enforcing organizational security policies. Defaults to true for new connections." }, "icon_url": { "description": "URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "map_user_id_to_id": { "type": "boolean", "description": "Determines how Auth0 generates the user_id for Google Workspace users. When false (default), the user's email address is used. When true, Google's stable numeric user ID is used instead, which persists even if the user's email changes. This setting can only be configured when creating the connection and cannot be changed afterward." }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "profile": { "type": "boolean", "description": "Whether the OAuth flow requests the `profile` scope." }, "scope": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 255 }, "minItems": 1, "maxItems": 64, "description": "Additional OAuth scopes requested beyond the default `email profile` scopes; ignored unless `allow_setting_login_scopes` is true." }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "tenant_domain": { "description": "The Google Workspace primary domain used to identify the organization during authentication.", "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255 }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} } }, "required": [ "client_id" ], "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "google-apps", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'waad' connection", "type": "object", "properties": { "api_enable_users": { "type": "boolean", "description": "Enable users API" }, "app_domain": { "type": "string", "examples": [ "contoso.onmicrosoft.com" ], "minLength": 0, "maxLength": 255, "description": "The Azure AD application domain (e.g., 'contoso.onmicrosoft.com'). Used primarily with WS-Federation protocol and Azure AD v1 endpoints." }, "app_id": { "type": "string", "examples": [ "api://contoso-azure-app" ], "minLength": 0, "maxLength": 500, "description": "The Application ID URI (App ID URI) for the Azure AD application. Required when using Azure AD v1 with the Resource Owner Password flow. Used to identify the resource being requested in OAuth token requests." }, "basic_profile": { "type": "boolean", "description": "Includes basic user profile information from Azure AD (name, email, given_name, family_name). Always enabled and required - represents the minimum profile data retrieved during authentication." }, "cert_rollover_notification": { "type": "string", "format": "date-time", "description": "Timestamp of the last certificate expiring soon notification." }, "client_id": { "type": "string", "examples": [ "12345678-1234-1234-1234-123456789012" ], "minLength": 0, "maxLength": 100, "description": "OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider." }, "domain": { "type": "string", "examples": [ "contoso.onmicrosoft.com" ], "minLength": 0, "maxLength": 512, "description": "The primary Azure AD tenant domain (e.g., 'contoso.onmicrosoft.com' or 'contoso.com')." }, "domain_aliases": { "type": "array", "items": { "type": "string", "minLength": 0, "maxLength": 255 }, "minItems": 0, "maxItems": 1000, "description": "Alternative domain names associated with this Azure AD tenant. Allows users from multiple verified domains to authenticate through this connection. Can be an array of domain strings." }, "ext_groups": { "type": "boolean", "description": "When enabled (true), retrieves and stores Azure AD security group memberships for the user. Requires Microsoft Graph API permissions (Directory.Read.All). Allows configuring max_groups_to_retrieve." }, "ext_nested_groups": { "type": "boolean", "description": "When true, stores all groups the user is member of, including transitive group memberships (groups within groups). When false (default), only direct group memberships are included." }, "ext_profile": { "type": "boolean", "description": "When enabled (true), retrieves extended profile attributes from Azure AD via Microsoft Graph API (job title, department, office location, etc.). Requires Graph API permissions. Only available with Azure AD v1 or when explicitly enabled for v2." }, "federated_connections_access_tokens": { "description": "Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.", "type": "object", "properties": { "active": { "type": "boolean", "description": "Enables refresh tokens and access tokens collection for federated connections" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "granted": { "type": "boolean", "description": "Indicates whether admin consent has been granted for the required Azure AD permissions. Read-only status field managed by Auth0 during the OAuth authorization flow." }, "icon_url": { "description": "URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "identity_api": { "description": "The Azure AD endpoint version for authentication. 'microsoft-identity-platform-v2.0' (recommended, default) supports modern OAuth 2.0 features. 'azure-active-directory-v1.0' is the legacy endpoint with protocol limitations. Selection affects available features.", "type": "string", "enum": [ "microsoft-identity-platform-v2.0", "azure-active-directory-v1.0" ] }, "max_groups_to_retrieve": { "type": "string", "examples": [ "100" ], "minLength": 0, "maxLength": 10, "description": "Maximum number of Azure AD groups to retrieve per user during authentication. Helps prevent performance issues for users in many groups. Only applies when ext_groups is enabled. Leave empty to use platform default." }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "scope": { "type": "array", "items": { "type": "string", "minLength": 0, "maxLength": 100 }, "minItems": 0, "maxItems": 100, "description": "OAuth 2.0 scopes to request from Azure AD during authentication. Each scope represents a permission (e.g., 'User.Read', 'Group.Read.All'). Only applies with Microsoft Identity Platform v2.0. See Microsoft Graph permissions reference for available scopes." }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "should_trust_email_verified_connection": { "description": "Choose how Auth0 sets the email_verified field in the user profile.", "type": "string", "enum": [ "never_set_emails_as_verified", "always_set_emails_as_verified" ] }, "tenant_domain": { "anyOf": [ { "type": "string", "examples": [ "contoso.onmicrosoft.com" ], "minLength": 0, "maxLength": 512, "format": "hostname", "description": "Azure AD tenant domain as a hostname (e.g. contoso.onmicrosoft.com)." }, { "type": "string", "format": "uuid", "description": "Azure AD tenant domain as a UUID tenant ID." } ], "description": "The Azure AD tenant domain or tenant ID (UUID). Auto-populated from the 'domain' field. Can be either a hostname (e.g., 'contoso.onmicrosoft.com') or a UUID tenant ID." }, "tenantId": { "type": "string", "examples": [ "12345678-1234-1234-1234-123456789012" ], "minLength": 36, "maxLength": 36, "format": "uuid", "description": "The Azure AD tenant ID as a UUID. The unique identifier for your Azure AD organization. Must be a valid 36-character UUID." }, "thumbprints": { "type": "array", "items": { "type": "string", "examples": [ "AB12CD34EF56789012345678901234567890ABCD" ], "minLength": 0, "maxLength": 64, "description": "Certificate thumbprints for ADFS and Azure AD connections." }, "minItems": 0, "maxItems": 20, "description": "Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string." }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "use_wsfed": { "type": "boolean", "description": "Indicates WS-Federation protocol usage. When true, uses WS-Federation; when false, uses OpenID Connect." }, "useCommonEndpoint": { "type": "boolean", "description": "When enabled (true), uses the Azure AD common endpoint for multi-tenant authentication. Allows users from any Azure AD organization to sign in. Requires userid_attribute set to 'sub' (not 'oid'). Cannot be used with SCIM provisioning. Defaults to false." }, "userid_attribute": { "description": "The Azure AD claim to use as the unique user identifier. 'oid' (Object ID) is recommended for single-tenant connections and required for SCIM. 'sub' (Subject) is required for multi-tenant/common endpoint. Only applies with OpenID Connect protocol.", "type": "string", "enum": [ "oid", "sub" ] }, "waad_protocol": { "description": "The authentication protocol for Azure AD v1 endpoints. 'openid-connect' (default, recommended) uses modern OAuth 2.0/OIDC. 'ws-federation' is a legacy SAML-based protocol for older integrations. Only available with Azure AD v1 API.", "type": "string", "enum": [ "ws-federation", "openid-connect" ] } }, "required": [ "client_id" ], "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "waad", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" } ] }, "context": { "description": "Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.", "type": "object", "properties": { "client": { "type": "object", "properties": { "id": { "description": "The client identifier.", "type": "string", "examples": [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] }, "name": { "type": "string", "description": "The client name." }, "metadata": { "description": "Client metadata.", "type": "object", "properties": {}, "unevaluatedProperties": {} } }, "required": [ "id", "name", "metadata" ], "unevaluatedProperties": { "not": {} }, "description": "The OAuth Client requesting or presenting an access token.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "connection": { "type": "object", "properties": { "id": { "description": "The ID of the connection.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "name": { "description": "The name of the connection.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "strategy": { "type": "string", "description": "The auth strategy implemented by the connection." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "description": "The Auth0 Connection used for the authentication transaction that generated the event.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "request": { "type": "object", "properties": { "geo": { "description": "Geographic information about the request origin.", "type": "object", "properties": { "continent_code": { "type": "string", "description": "Continent code." }, "country_code": { "type": "string", "description": "Country code." }, "country_name": { "type": "string", "description": "Country name." }, "latitude": { "type": "number", "description": "Latitude coordinate." }, "longitude": { "type": "number", "description": "Longitude coordinate." }, "subdivision_code": { "type": "string", "description": "Subdivision (state/province) code." }, "subdivision_name": { "type": "string", "description": "Subdivision (state/province) name." }, "city_name": { "type": "string", "description": "City name." }, "time_zone": { "type": "string", "description": "Time zone." } }, "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "hostname": { "type": "string", "description": "The hostname the request is for." }, "custom_domain": { "type": "string", "description": "The custom domain used in the request (if any)." }, "ip": { "type": "string", "description": "The originating IP address of the request." }, "method": { "type": "string", "description": "The HTTP method used for the request." }, "user_agent": { "type": "string", "description": "The value of the `User-Agent` header." } }, "required": [ "geo", "hostname", "ip", "method", "user_agent" ], "unevaluatedProperties": { "not": {} }, "description": "An HTTP request.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "tenant": { "type": "object", "properties": { "id": { "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]", "description": "User-provided tenant identifier." } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a tenant in event context" }, "transaction": { "type": "object", "properties": { "acr_values": { "type": "array", "items": { "type": "string" }, "description": "acr_values in the request." }, "locale": { "type": "string", "description": "The locale used for this transaction." }, "login_hint": { "type": "string", "description": "Hint about the login identifier the user might use in this transaction." }, "prompt": { "type": "array", "items": { "type": "string" }, "description": "Instructions indicating whether the user may be prompted for re-authentication and consent." }, "protocol": { "description": "The protocol used for this transaction.", "type": "string", "enum": [ "oidc-basic-profile", "oidc-implicit-profile", "oauth2-device-code", "oauth2-resource-owner", "oauth2-resource-owner-jwt-bearer", "oauth2-password", "oauth2-webauthn", "oauth2-access-token", "oauth2-refresh-token", "oauth2-token-exchange", "oidc-hybrid-profile", "samlp", "wsfed", "wstrust-usernamemixed" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "redirect_uri": { "type": "string", "description": "The URL to which the client will be redirected when the transaction completes." }, "requested_scopes": { "type": "array", "items": { "type": "string" }, "description": "The scopes requested." }, "response_mode": { "description": "This transaction's method for returning parameters from the Authorization Endpoint.", "type": "string", "enum": [ "query", "fragment", "form_post", "web_message" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "response_type": { "type": "array", "items": { "type": "string", "enum": [ "code", "token", "id_token" ], "description": "OAuth/OIDC response types.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "description": "The kind of credential issued by this transaction." }, "state": { "type": "string", "description": "The OAuth state parameter for this transaction." }, "ui_locales": { "type": "array", "items": { "type": "string" }, "description": "The ui_locales requested for this transaction." } }, "required": [ "acr_values", "locale", "requested_scopes", "ui_locales" ], "unevaluatedProperties": { "not": {} }, "description": "An auth transaction.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "tenant" ], "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "object" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "platform-streaming-foundations" }, "a0tenant": { "description": "The auth0 tenant ID to which the event is associated.", "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]" }, "a0stream": { "description": "The auth0 event stream ID of the stream the event was delivered on.\nPresent when the event is delivered via an event stream; omitted when\nevents are retrieved via the Events API (GET /api/v2/events).", "type": "string", "examples": [ "est_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "est_[a-zA-Z0-9]{22}" } }, "required": [ "specversion", "type", "source", "id", "time", "data", "a0tenant" ], "unevaluatedProperties": { "not": {} }, "description": "Represents an event that occurs when a connection is created.", "x-release-lifecycle": "EA", "x-auth0-owner": "iam-login", "x-auth0-event-category": "connection", "example": { "specversion": "1.0", "type": "connection.created", "source": "urn:auth0:example.auth0app.com", "id": "evt_vjFVP5pVdfvsfRKatshkVV", "time": "2025-02-01T12:34:56Z", "data": { "object": { "authentication": { "active": false }, "display_name": "My Enterprise Connection", "enabled_clients": [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ], "id": "con_kFOHQUeaCSC1Kjqz", "is_domain_connection": false, "metadata": {}, "name": "Username-Password-Authentication", "realms": [ "example.com" ], "connected_accounts": { "active": false, "cross_app_access": false }, "options": { "authorization_endpoint": "https://provider.example.com/oauth/authorize", "client_id": "abc123def456ghi789", "connection_settings": { "pkce": "auto" }, "domain_aliases": [ "example.com" ], "dpop_signing_alg": "ES256", "federated_connections_access_tokens": { "active": false }, "icon_url": "https://example.com/logo.png", "id_token_session_expiry_supported": false, "id_token_signed_response_algs": [ "ES256" ], "issuer": "https://accounts.example.com", "jwks_uri": "https://provider.example.com/.well-known/jwks.json", "non_persistent_attrs": [ "ethnicity" ], "oidc_metadata": { "acr_values_supported": [ "urn:mace:incommon:iap:silver" ], "authorization_endpoint": "https://provider.example.com/oauth/authorize", "claim_types_supported": [ "normal" ], "claims_locales_supported": [ "en-US" ], "claims_parameter_supported": false, "claims_supported": [ "sub" ], "code_challenge_methods_supported": [ "S256" ], "display_values_supported": [ "page" ], "dpop_signing_alg_values_supported": [ "ES256" ], "end_session_endpoint": "https://provider.example.com/oauth/logout", "grant_types_supported": [ "authorization_code" ], "id_token_encryption_alg_values_supported": [ "RSA-OAEP" ], "id_token_encryption_enc_values_supported": [ "A128CBC-HS256" ], "id_token_signing_alg_values_supported": [ "RS256" ], "issuer": "https://accounts.example.com", "jwks_uri": "https://provider.example.com/.well-known/jwks.json", "op_policy_uri": "https://provider.example.com/policy", "op_tos_uri": "https://provider.example.com/terms", "registration_endpoint": "https://provider.example.com/oauth/register", "request_object_encryption_alg_values_supported": [ "RSA-OAEP" ], "request_object_encryption_enc_values_supported": [ "A128CBC-HS256" ], "request_object_signing_alg_values_supported": [ "RS256" ], "request_parameter_supported": false, "request_uri_parameter_supported": false, "require_request_uri_registration": false, "response_modes_supported": [ "query" ], "response_types_supported": [ "code" ], "scopes_supported": [ "openid" ], "service_documentation": "https://provider.example.com/docs", "subject_types_supported": [ "public" ], "token_endpoint": "https://provider.example.com/oauth/token", "token_endpoint_auth_methods_supported": [ "client_secret_basic" ], "token_endpoint_auth_signing_alg_values_supported": [ "RS256" ], "ui_locales_supported": [ "en-US" ], "userinfo_encryption_alg_values_supported": [ "RS256" ], "userinfo_encryption_enc_values_supported": [ "A128CBC-HS256" ], "userinfo_endpoint": "https://provider.example.com/oauth/userinfo", "userinfo_signing_alg_values_supported": [ "RS256" ] }, "schema_version": "openid-1.0.0", "scope": "openid profile email", "send_back_channel_nonce": false, "set_user_root_attributes": "on_each_login", "tenant_domain": "example.com", "token_endpoint": "https://provider.example.com/oauth/token", "token_endpoint_auth_method": "client_secret_post", "token_endpoint_auth_signing_alg": "ES256", "token_endpoint_jwtca_aud_format": "issuer", "upstream_params": {}, "useOauthSpecScope": false, "userinfo_endpoint": "https://provider.example.com/oauth/userinfo", "attribute_map": { "attributes": {}, "userinfo_scope": "openid profile email", "mapping_mode": "bind_all" }, "discovery_url": "https://provider.example.com/.well-known/openid-configuration", "type": "back_channel" }, "show_as_button": false, "strategy": "oidc" }, "previous_object": { "authentication": { "active": false }, "display_name": "My Enterprise Connection", "enabled_clients": [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ], "id": "con_kFOHQUeaCSC1Kjqz", "is_domain_connection": false, "metadata": {}, "name": "Username-Password-Authentication", "realms": [ "example.com" ], "connected_accounts": { "active": false, "cross_app_access": false }, "options": { "authorization_endpoint": "https://provider.example.com/oauth/authorize", "client_id": "abc123def456ghi789", "connection_settings": { "pkce": "auto" }, "domain_aliases": [ "example.com" ], "dpop_signing_alg": "ES256", "federated_connections_access_tokens": { "active": false }, "icon_url": "https://example.com/logo.png", "id_token_session_expiry_supported": false, "id_token_signed_response_algs": [ "ES256" ], "issuer": "https://accounts.example.com", "jwks_uri": "https://provider.example.com/.well-known/jwks.json", "non_persistent_attrs": [ "ethnicity" ], "oidc_metadata": { "acr_values_supported": [ "urn:mace:incommon:iap:silver" ], "authorization_endpoint": "https://provider.example.com/oauth/authorize", "claim_types_supported": [ "normal" ], "claims_locales_supported": [ "en-US" ], "claims_parameter_supported": false, "claims_supported": [ "sub" ], "code_challenge_methods_supported": [ "S256" ], "display_values_supported": [ "page" ], "dpop_signing_alg_values_supported": [ "ES256" ], "end_session_endpoint": "https://provider.example.com/oauth/logout", "grant_types_supported": [ "authorization_code" ], "id_token_encryption_alg_values_supported": [ "RSA-OAEP" ], "id_token_encryption_enc_values_supported": [ "A128CBC-HS256" ], "id_token_signing_alg_values_supported": [ "RS256" ], "issuer": "https://accounts.example.com", "jwks_uri": "https://provider.example.com/.well-known/jwks.json", "op_policy_uri": "https://provider.example.com/policy", "op_tos_uri": "https://provider.example.com/terms", "registration_endpoint": "https://provider.example.com/oauth/register", "request_object_encryption_alg_values_supported": [ "RSA-OAEP" ], "request_object_encryption_enc_values_supported": [ "A128CBC-HS256" ], "request_object_signing_alg_values_supported": [ "RS256" ], "request_parameter_supported": false, "request_uri_parameter_supported": false, "require_request_uri_registration": false, "response_modes_supported": [ "query" ], "response_types_supported": [ "code" ], "scopes_supported": [ "openid" ], "service_documentation": "https://provider.example.com/docs", "subject_types_supported": [ "public" ], "token_endpoint": "https://provider.example.com/oauth/token", "token_endpoint_auth_methods_supported": [ "client_secret_basic" ], "token_endpoint_auth_signing_alg_values_supported": [ "RS256" ], "ui_locales_supported": [ "en-US" ], "userinfo_encryption_alg_values_supported": [ "RS256" ], "userinfo_encryption_enc_values_supported": [ "A128CBC-HS256" ], "userinfo_endpoint": "https://provider.example.com/oauth/userinfo", "userinfo_signing_alg_values_supported": [ "RS256" ] }, "schema_version": "openid-1.0.0", "scope": "openid profile email", "send_back_channel_nonce": false, "set_user_root_attributes": "on_each_login", "tenant_domain": "example.com", "token_endpoint": "https://provider.example.com/oauth/token", "token_endpoint_auth_method": "client_secret_post", "token_endpoint_auth_signing_alg": "ES256", "token_endpoint_jwtca_aud_format": "issuer", "upstream_params": {}, "useOauthSpecScope": false, "userinfo_endpoint": "https://provider.example.com/oauth/userinfo", "attribute_map": { "attributes": {}, "userinfo_scope": "openid profile email", "mapping_mode": "bind_all" }, "discovery_url": "https://provider.example.com/.well-known/openid-configuration", "type": "back_channel" }, "show_as_button": false, "strategy": "oidc" }, "context": { "client": { "id": "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc", "name": "sample", "metadata": {} }, "connection": { "id": "con_kFOHQUeaCSC1Kjqz", "name": "Username-Password-Authentication", "strategy": "sample" }, "request": { "geo": { "continent_code": "sample", "country_code": "sample", "country_name": "sample", "latitude": 3.14, "longitude": 3.14, "subdivision_code": "sample", "subdivision_name": "sample", "city_name": "sample", "time_zone": "sample" }, "hostname": "sample", "custom_domain": "sample", "ip": "sample", "method": "sample", "user_agent": "sample" }, "tenant": { "id": "my-tenant" }, "transaction": { "acr_values": [ "sample" ], "locale": "sample", "login_hint": "sample", "prompt": [ "sample" ], "protocol": "oidc-basic-profile", "redirect_uri": "sample", "requested_scopes": [ "sample" ], "response_mode": "query", "response_type": [ "code" ], "state": "sample", "ui_locales": [ "sample" ] } } }, "a0tenant": "my-tenant", "a0stream": "est_vjFVP5pVdfvsfRKatshkVV" } }, "connection.deleted": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "connection.deleted", "type": "object", "properties": { "specversion": { "description": "The version of the CloudEvents specification which the event uses.", "type": "string", "enum": [ "1.0" ], "x-auth0-owner": "platform-streaming-foundations" }, "type": { "type": "string", "const": "connection.deleted", "description": "The type of the event which has happened." }, "source": { "type": "string", "examples": [ "urn:auth0:example.auth0app.com" ], "description": "The source of the event. This will take the form 'urn:auth0:.'." }, "id": { "description": "A unique identifier for the event.", "type": "string", "examples": [ "evt_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "evt_[a-zA-Z0-9]{22}" }, "time": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "An ISO-8601 timestamp indicating when the event physically occurred." }, "data": { "description": "The event payload.", "type": "object", "properties": { "object": { "description": "The event content.", "oneOf": [ { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" }, "cross_app_access": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "options": { "description": "Options for the 'oidc' connection", "type": "object", "properties": { "authorization_endpoint": { "description": "URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/authorize" ], "minLength": 8, "maxLength": 2083, "format": "uri" }, "client_id": { "type": "string", "examples": [ "abc123def456ghi789" ], "minLength": 0, "maxLength": 255, "description": "OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider." }, "connection_settings": { "description": "OAuth 2.0 PKCE (Proof Key for Code Exchange) settings. PKCE enhances security for public clients by preventing authorization code interception attacks. 'auto' (recommended) uses the strongest method supported by the IdP.", "type": "object", "properties": { "pkce": { "description": "PKCE configuration.", "type": "string", "enum": [ "auto", "S256", "plain", "disabled" ] } }, "unevaluatedProperties": { "not": {} } }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 1000, "description": "Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication." }, "dpop_signing_alg": { "description": "Algorithm used for DPoP proof JWT signing. Applicable when strategy=oidc or okta.", "type": "string", "enum": [ "ES256", "ES384", "ES512", "Ed25519" ] }, "federated_connections_access_tokens": { "description": "Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.", "type": "object", "properties": { "active": { "type": "boolean", "description": "Enables refresh tokens and access tokens collection for federated connections" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "icon_url": { "description": "https url of the icon to be shown", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "id_token_session_expiry_supported": { "type": "boolean", "description": "Indicates whether the identity provider supports session expiry via the id_token. If true, the system will use the session_expiry claim in the id_token to determine session expiry." }, "id_token_signed_response_algs": { "type": "array", "items": { "type": "string", "enum": [ "ES256", "ES384", "PS256", "PS384", "RS256", "RS384", "RS512" ], "description": "Algorithm allowed to verify the ID tokens." }, "description": "List of algorithms allowed to verify the ID tokens. Applicable when strategy=oidc or okta." }, "issuer": { "description": "The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.", "type": "string", "examples": [ "https://accounts.example.com" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "jwks_uri": { "description": "URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.", "type": "string", "examples": [ "https://provider.example.com/.well-known/jwks.json" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "oidc_metadata": { "description": "OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata", "type": "object", "properties": { "acr_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "urn:mace:incommon:iap:silver" ], "maxLength": 100 }, "minItems": 0, "maxItems": 30, "description": "A list of the Authentication Context Class References that this OP supports" }, "authorization_endpoint": { "description": "URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/authorize" ], "minLength": 8, "maxLength": 2083, "format": "uri" }, "claim_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "normal" ], "maxLength": 25 }, "minItems": 0, "maxItems": 10, "description": "JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims." }, "claims_locales_supported": { "type": "array", "items": { "type": "string", "examples": [ "en-US" ], "maxLength": 50 }, "minItems": 0, "maxItems": 100, "description": "Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values." }, "claims_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false." }, "claims_supported": { "type": "array", "items": { "type": "string", "examples": [ "sub" ], "maxLength": 100 }, "minItems": 0, "maxItems": 150, "description": "JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list." }, "code_challenge_methods_supported": { "type": "array", "items": { "type": "string", "examples": [ "S256" ], "maxLength": 20 }, "minItems": 0, "maxItems": 10, "description": "JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636." }, "display_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "page" ], "maxLength": 10 }, "minItems": 0, "maxItems": 6, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used." }, "dpop_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "ES256" ], "maxLength": 14 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing." }, "end_session_endpoint": { "type": "string", "examples": [ "https://provider.example.com/oauth/logout" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme." }, "grant_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "authorization_code" ], "maxLength": 100 }, "minItems": 0, "maxItems": 20, "description": "A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"]." }, "id_token_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RSA-OAEP" ], "maxLength": 14 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT" }, "id_token_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT]." }, "id_token_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10, "description": "JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata)." }, "minItems": 1, "maxItems": 26, "description": "A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518" }, "issuer": { "description": "The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.", "type": "string", "examples": [ "https://accounts.example.com" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "jwks_uri": { "description": "URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.", "type": "string", "examples": [ "https://provider.example.com/.well-known/jwks.json" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "op_policy_uri": { "type": "string", "examples": [ "https://provider.example.com/policy" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given." }, "op_tos_uri": { "type": "string", "examples": [ "https://provider.example.com/terms" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given." }, "registration_endpoint": { "type": "string", "examples": [ "https://provider.example.com/oauth/register" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration" }, "request_object_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RSA-OAEP" ], "maxLength": 28 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference." }, "request_object_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference." }, "request_object_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256." }, "request_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false." }, "request_uri_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false." }, "require_request_uri_registration": { "type": "boolean", "description": "Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false." }, "response_modes_supported": { "type": "array", "items": { "type": "string", "examples": [ "query" ], "maxLength": 20 }, "minItems": 0, "maxItems": 16, "description": "A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]" }, "response_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "code" ], "maxLength": 40 }, "minItems": 1, "maxItems": 40, "description": "A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values" }, "scopes_supported": { "type": "array", "items": { "type": "string", "examples": [ "openid" ], "maxLength": 100 }, "minItems": 0, "maxItems": 7000, "description": "A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED" }, "service_documentation": { "type": "string", "examples": [ "https://provider.example.com/docs" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation." }, "subject_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "public" ], "minLength": 0, "maxLength": 100 }, "minItems": 0, "maxItems": 20, "description": "A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public" }, "token_endpoint": { "description": "URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/token" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "token_endpoint_auth_methods_supported": { "type": "array", "items": { "type": "string", "examples": [ "client_secret_basic" ], "maxLength": 60 }, "minItems": 0, "maxItems": 14, "description": "JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749]." }, "token_endpoint_auth_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 24, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used." }, "ui_locales_supported": { "type": "array", "items": { "type": "string", "examples": [ "en-US" ], "maxLength": 50 }, "minItems": 0, "maxItems": 150, "description": "Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values." }, "userinfo_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]." }, "userinfo_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]." }, "userinfo_endpoint": { "description": "Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.", "type": "string", "examples": [ "https://provider.example.com/oauth/userinfo" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "userinfo_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included." } }, "required": [ "authorization_endpoint", "id_token_signing_alg_values_supported", "issuer", "jwks_uri" ], "unevaluatedProperties": { "not": {} } }, "schema_version": { "description": "The internal schema version of the connection options.", "type": "string", "enum": [ "openid-1.0.0", "oidc-v4" ] }, "scope": { "type": "string", "examples": [ "openid profile email" ], "minLength": 6, "maxLength": 255, "description": "Space-separated list of OAuth 2.0 scopes requested during authorization. Must include 'openid' (required by OIDC spec). Common values: 'openid profile email'. Additional scopes depend on the identity provider." }, "send_back_channel_nonce": { "type": "boolean", "description": "When true and type is 'back_channel', includes a cryptographic nonce in authorization requests to prevent replay attacks. The identity provider must include this nonce in the ID token for validation." }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "tenant_domain": { "description": "Tenant domain", "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255 }, "token_endpoint": { "description": "URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/token" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "token_endpoint_auth_method": { "description": "Authentication method used at the identity provider's token endpoint. 'client_secret_post' sends credentials in the request body; 'private_key_jwt' uses a signed JWT assertion for enhanced security. Applicable when strategy=oidc or okta.", "type": "string", "enum": [ "client_secret_post", "private_key_jwt" ] }, "token_endpoint_auth_signing_alg": { "description": "Algorithm used to sign client_assertions. Applicable when strategy=oidc or okta.", "type": "string", "enum": [ "ES256", "ES384", "PS256", "PS384", "RS256", "RS384", "RS512" ] }, "token_endpoint_jwtca_aud_format": { "description": "Specifies the format of the aud (audience) claim included in the JWT used for client authentication at the token endpoint. Accepted values are: 'issuer' (the aud claim is set to the OIDC issuer URL) or 'token_endpoint' (the aud claim is set to the token endpoint URL).", "type": "string", "enum": [ "issuer", "token_endpoint" ] }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "useOauthSpecScope": { "type": "boolean", "description": "When true, uses space-delimited scopes (per OAuth 2.0 spec) instead of comma-delimited when calling the identity provider's authorization endpoint. Only relevant when using the connection_scope parameter. See https://auth0.com/docs/authenticate/identity-providers/adding-scopes-for-an-external-idp#pass-scopes-to-authorize-endpoint" }, "userinfo_endpoint": { "description": "Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.", "type": "string", "examples": [ "https://provider.example.com/oauth/userinfo" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "attribute_map": { "description": "Configuration for mapping claims from the identity provider to Auth0 user profile attributes. Allows customizing which IdP claims populate user fields and how they are transformed.", "type": "object", "properties": { "attributes": { "description": "Object containing mapping details for incoming claims", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "userinfo_scope": { "type": "string", "examples": [ "openid profile email" ], "minLength": 0, "maxLength": 255, "description": "Scopes to send to the IdP's Userinfo endpoint" }, "mapping_mode": { "description": "Method used to map incoming claims when strategy=oidc.", "type": "string", "enum": [ "bind_all", "use_map" ] } }, "unevaluatedProperties": { "not": {} } }, "discovery_url": { "type": "string", "examples": [ "https://provider.example.com/.well-known/openid-configuration" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the identity provider's OIDC Discovery endpoint (/.well-known/openid-configuration). When provided and oidc_metadata is empty, Auth0 automatically retrieves the provider's configuration including endpoints and supported features." }, "type": { "description": "OIDC communication channel type. 'back_channel' (confidential client) exchanges tokens server-side for stronger security; 'front_channel' handles responses in the browser.", "type": "string", "enum": [ "back_channel", "front_channel" ] } }, "required": [ "client_id" ], "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "oidc", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'okta' connection", "type": "object", "properties": { "authorization_endpoint": { "description": "URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/authorize" ], "minLength": 8, "maxLength": 2083, "format": "uri" }, "client_id": { "type": "string", "examples": [ "abc123def456ghi789" ], "minLength": 0, "maxLength": 255, "description": "OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider." }, "connection_settings": { "description": "OAuth 2.0 PKCE (Proof Key for Code Exchange) settings. PKCE enhances security for public clients by preventing authorization code interception attacks. 'auto' (recommended) uses the strongest method supported by the IdP.", "type": "object", "properties": { "pkce": { "description": "PKCE configuration.", "type": "string", "enum": [ "auto", "S256", "plain", "disabled" ] } }, "unevaluatedProperties": { "not": {} } }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 1000, "description": "Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication." }, "dpop_signing_alg": { "description": "Algorithm used for DPoP proof JWT signing. Applicable when strategy=oidc or okta.", "type": "string", "enum": [ "ES256", "ES384", "ES512", "Ed25519" ] }, "federated_connections_access_tokens": { "description": "Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.", "type": "object", "properties": { "active": { "type": "boolean", "description": "Enables refresh tokens and access tokens collection for federated connections" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "icon_url": { "description": "https url of the icon to be shown", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "id_token_session_expiry_supported": { "type": "boolean", "description": "Indicates whether the identity provider supports session expiry via the id_token. If true, the system will use the session_expiry claim in the id_token to determine session expiry." }, "id_token_signed_response_algs": { "type": "array", "items": { "type": "string", "enum": [ "ES256", "ES384", "PS256", "PS384", "RS256", "RS384", "RS512" ], "description": "Algorithm allowed to verify the ID tokens." }, "description": "List of algorithms allowed to verify the ID tokens. Applicable when strategy=oidc or okta." }, "issuer": { "description": "The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.", "type": "string", "examples": [ "https://accounts.example.com" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "jwks_uri": { "description": "URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.", "type": "string", "examples": [ "https://provider.example.com/.well-known/jwks.json" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "oidc_metadata": { "description": "OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata", "type": "object", "properties": { "acr_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "urn:mace:incommon:iap:silver" ], "maxLength": 100 }, "minItems": 0, "maxItems": 30, "description": "A list of the Authentication Context Class References that this OP supports" }, "authorization_endpoint": { "description": "URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/authorize" ], "minLength": 8, "maxLength": 2083, "format": "uri" }, "claim_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "normal" ], "maxLength": 25 }, "minItems": 0, "maxItems": 10, "description": "JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims." }, "claims_locales_supported": { "type": "array", "items": { "type": "string", "examples": [ "en-US" ], "maxLength": 50 }, "minItems": 0, "maxItems": 100, "description": "Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values." }, "claims_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false." }, "claims_supported": { "type": "array", "items": { "type": "string", "examples": [ "sub" ], "maxLength": 100 }, "minItems": 0, "maxItems": 150, "description": "JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list." }, "code_challenge_methods_supported": { "type": "array", "items": { "type": "string", "examples": [ "S256" ], "maxLength": 20 }, "minItems": 0, "maxItems": 10, "description": "JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636." }, "display_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "page" ], "maxLength": 10 }, "minItems": 0, "maxItems": 6, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used." }, "dpop_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "ES256" ], "maxLength": 14 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing." }, "end_session_endpoint": { "type": "string", "examples": [ "https://provider.example.com/oauth/logout" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme." }, "grant_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "authorization_code" ], "maxLength": 100 }, "minItems": 0, "maxItems": 20, "description": "A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"]." }, "id_token_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RSA-OAEP" ], "maxLength": 14 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT" }, "id_token_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT]." }, "id_token_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10, "description": "JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata)." }, "minItems": 1, "maxItems": 26, "description": "A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518" }, "issuer": { "description": "The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.", "type": "string", "examples": [ "https://accounts.example.com" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "jwks_uri": { "description": "URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.", "type": "string", "examples": [ "https://provider.example.com/.well-known/jwks.json" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "op_policy_uri": { "type": "string", "examples": [ "https://provider.example.com/policy" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given." }, "op_tos_uri": { "type": "string", "examples": [ "https://provider.example.com/terms" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given." }, "registration_endpoint": { "type": "string", "examples": [ "https://provider.example.com/oauth/register" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration" }, "request_object_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RSA-OAEP" ], "maxLength": 28 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference." }, "request_object_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference." }, "request_object_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256." }, "request_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false." }, "request_uri_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false." }, "require_request_uri_registration": { "type": "boolean", "description": "Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false." }, "response_modes_supported": { "type": "array", "items": { "type": "string", "examples": [ "query" ], "maxLength": 20 }, "minItems": 0, "maxItems": 16, "description": "A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]" }, "response_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "code" ], "maxLength": 40 }, "minItems": 1, "maxItems": 40, "description": "A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values" }, "scopes_supported": { "type": "array", "items": { "type": "string", "examples": [ "openid" ], "maxLength": 100 }, "minItems": 0, "maxItems": 7000, "description": "A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED" }, "service_documentation": { "type": "string", "examples": [ "https://provider.example.com/docs" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation." }, "subject_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "public" ], "minLength": 0, "maxLength": 100 }, "minItems": 0, "maxItems": 20, "description": "A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public" }, "token_endpoint": { "description": "URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/token" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "token_endpoint_auth_methods_supported": { "type": "array", "items": { "type": "string", "examples": [ "client_secret_basic" ], "maxLength": 60 }, "minItems": 0, "maxItems": 14, "description": "JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749]." }, "token_endpoint_auth_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 24, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used." }, "ui_locales_supported": { "type": "array", "items": { "type": "string", "examples": [ "en-US" ], "maxLength": 50 }, "minItems": 0, "maxItems": 150, "description": "Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values." }, "userinfo_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]." }, "userinfo_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]." }, "userinfo_endpoint": { "description": "Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.", "type": "string", "examples": [ "https://provider.example.com/oauth/userinfo" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "userinfo_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included." } }, "required": [ "authorization_endpoint", "id_token_signing_alg_values_supported", "issuer", "jwks_uri" ], "unevaluatedProperties": { "not": {} } }, "schema_version": { "description": "The internal schema version of the connection options.", "type": "string", "enum": [ "openid-1.0.0", "oidc-v4" ] }, "scope": { "type": "string", "examples": [ "openid profile email" ], "minLength": 6, "maxLength": 255, "description": "Space-separated list of OAuth 2.0 scopes requested during authorization. Must include 'openid' (required by OIDC spec). Common values: 'openid profile email'. Additional scopes depend on the identity provider." }, "send_back_channel_nonce": { "type": "boolean", "description": "When true and type is 'back_channel', includes a cryptographic nonce in authorization requests to prevent replay attacks. The identity provider must include this nonce in the ID token for validation." }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "tenant_domain": { "description": "Tenant domain", "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255 }, "token_endpoint": { "description": "URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/token" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "token_endpoint_auth_method": { "description": "Authentication method used at the identity provider's token endpoint. 'client_secret_post' sends credentials in the request body; 'private_key_jwt' uses a signed JWT assertion for enhanced security. Applicable when strategy=oidc or okta.", "type": "string", "enum": [ "client_secret_post", "private_key_jwt" ] }, "token_endpoint_auth_signing_alg": { "description": "Algorithm used to sign client_assertions. Applicable when strategy=oidc or okta.", "type": "string", "enum": [ "ES256", "ES384", "PS256", "PS384", "RS256", "RS384", "RS512" ] }, "token_endpoint_jwtca_aud_format": { "description": "Specifies the format of the aud (audience) claim included in the JWT used for client authentication at the token endpoint. Accepted values are: 'issuer' (the aud claim is set to the OIDC issuer URL) or 'token_endpoint' (the aud claim is set to the token endpoint URL).", "type": "string", "enum": [ "issuer", "token_endpoint" ] }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "useOauthSpecScope": { "type": "boolean", "description": "When true, uses space-delimited scopes (per OAuth 2.0 spec) instead of comma-delimited when calling the identity provider's authorization endpoint. Only relevant when using the connection_scope parameter. See https://auth0.com/docs/authenticate/identity-providers/adding-scopes-for-an-external-idp#pass-scopes-to-authorize-endpoint" }, "userinfo_endpoint": { "description": "Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.", "type": "string", "examples": [ "https://provider.example.com/oauth/userinfo" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "attribute_map": { "description": "Mapping of claims received from the identity provider (IdP)", "type": "object", "properties": { "attributes": { "description": "Object containing mapping details for incoming claims", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "userinfo_scope": { "type": "string", "examples": [ "openid profile email" ], "minLength": 0, "maxLength": 255, "description": "Scopes to send to the IdP's Userinfo endpoint" }, "mapping_mode": { "description": "Method used to map incoming claims when strategy=okta.", "type": "string", "enum": [ "basic_profile", "use_map" ] } }, "unevaluatedProperties": { "not": {} } }, "domain": { "type": "string", "examples": [ "dev-123456.okta.com" ], "minLength": 4, "maxLength": 255, "description": "Domain of the Okta organization (e.g., dev-123456.okta.com). Should be just the domain of the okta server with no scheme or trailing backslash. Discovery runs only when connection.options.oidc_metadata is empty and a domain is provided" }, "type": { "description": "Connection type", "type": "string", "enum": [ "back_channel" ] } }, "required": [ "client_id" ], "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "okta", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'samlp' connection", "type": "object", "properties": { "assertion_decryption_settings": { "description": "Settings for SAML assertion decryption.", "type": "object", "properties": { "algorithm_exceptions": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 100 }, "maxItems": 10, "description": "A list of insecure algorithms to allow for SAML assertion decryption." }, "algorithm_profile": { "description": "The algorithm profile to use for decrypting SAML assertions.", "type": "string", "enum": [ "v2026-1" ] } }, "required": [ "algorithm_profile" ], "unevaluatedProperties": { "not": {} } }, "cert": { "type": "string", "minLength": 1, "maxLength": 10240, "description": "X.509 signing certificate from the identity provider in .der format. Used to validate signatures in SAML Responses and Assertions. This is an alternative to signingCert and is kept for backward compatibility. Prefer using signingCert instead.", "deprecated": true }, "cert_rollover_notification": { "type": "string", "format": "date-time", "description": "Timestamp of the last certificate expiring soon notification." }, "digestAlgorithm": { "description": "Algorithm used for computing digest values when signing SAML requests and logout requests. Defaults to 'sha256'.", "type": "string", "enum": [ "sha1", "sha256" ] }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 50001, "description": "Domain aliases for the connection" }, "entityId": { "description": "The entity identifier (Issuer) for the SAML Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'. This value is included in SAML AuthnRequest messages sent to the identity provider.", "type": "string", "examples": [ "urn:auth0:my-tenant:my-connection" ], "minLength": 1, "maxLength": 128 }, "expires": { "type": "string", "format": "date-time", "description": "ISO 8601 formatted datetime indicating when the identity provider's signing certificate expires." }, "icon_url": { "description": "URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "idpinitiated": { "description": "Configuration for IdP-Initiated SAML Single Sign-On. When enabled, allows users to initiate login directly from their SAML identity provider without first visiting Auth0. The IdP must include the connection parameter in the post-back URL (Assertion Consumer Service URL).", "type": "object", "properties": { "client_authorizequery": { "type": "string", "minLength": 1, "maxLength": 2048, "description": "The query string sent to the default application" }, "client_id": { "type": "string", "minLength": 1, "maxLength": 256, "description": "The client ID to use for IdP-initiated login requests." }, "client_protocol": { "description": "The response protocol used to communicate with the default application.", "type": "string", "enum": [ "oidc", "samlp", "wsfed" ] }, "enabled": { "type": "boolean", "description": "When true, enables IdP-initiated login support for this SAML connection. Allows users to log in directly from the identity provider without first visiting Auth0." } }, "unevaluatedProperties": { "not": {} } }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "protocolBinding": { "description": "SAML protocol binding mechanism for sending authentication requests to the identity provider.", "type": "string", "enum": [ "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST", "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" ] }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "signatureAlgorithm": { "description": "Algorithm used to sign SAML authentication requests and logout requests using the connection's signing key. Common values: 'rsa-sha256' (RSA signature with SHA-256 digest) or 'rsa-sha1'. Defaults to 'rsa-sha256'.", "type": "string", "enum": [ "rsa-sha1", "rsa-sha256" ] }, "signInEndpoint": { "description": "Identity provider's SAML SingleSignOnService endpoint URL where Auth0 sends SAML authentication requests. This is the primary login URL for the SAML connection. Required unless using metadataUrl or metadataXml.", "type": "string", "examples": [ "https://idp.example.com/saml/sso" ], "minLength": 8, "maxLength": 2048, "format": "uri" }, "signingCert": { "description": "Base64-encoded X.509 certificate from the identity provider used to validate signatures in SAML responses and assertions. The certificate is decoded and used for cryptographic signature verification.", "type": "string", "examples": [ "MIIDDTCCAfWgAwIBAgIJALFkBP7GVlWkMA0GCSqGSIb3DQEBCwUAMCUxIzAhBgNV" ], "minLength": 1, "maxLength": 10240 }, "signSAMLRequest": { "type": "boolean", "description": "When true, Auth0 signs SAML authentication requests using the connection's signing key. The signature includes the request's digest and is validated by the identity provider. Defaults to false (unsigned requests)." }, "subject": { "description": "Certificate Subject Distinguished Name (DN) extracted from the identity provider's signing certificate.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "tenant_domain": { "description": "For SAML connections, the tenant domain used to construct the login endpoint URL. Can be a string for single-tenant or an array of strings for multi-tenant validation.", "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255 }, "thumbprints": { "type": "array", "items": { "type": "string", "examples": [ "ef34ab56cd78901234567890123456789012efab" ], "minLength": 40, "maxLength": 40 }, "minItems": 0, "maxItems": 1, "description": "SHA-1 thumbprints (fingerprints) of the identity provider's signing certificates. Automatically computed from signingCert during connection creation. Each thumbprint must be a 40-character hexadecimal string." }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "debug": { "type": "boolean", "description": "When true, enables detailed SAML debugging by issuing 'w' (warning) events in tenant logs containing SAML request/response details. WARNING: Potentially exposes sensitive user information (PII, credentials) and should only be enabled temporarily for debugging purposes." }, "deflate": { "type": "boolean", "description": "When true, enables DEFLATE compression for SAML requests sent via HTTP-Redirect binding." }, "destinationUrl": { "type": "string", "examples": [ "https://idp.example.com/saml/sso" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "The URL where Auth0 will send SAML authentication requests (the Identity Provider's SSO URL). Must be a valid HTTPS URL." }, "disableFieldsMapFix": { "type": "boolean", "description": "When true, disables the automatic correction of the fieldsMap configuration to ensure proper mapping of SAML attributes to user profile fields. Defaults to false (fieldsMap fix enabled)." }, "disableSignout": { "type": "boolean", "description": "When true, disables sending SAML logout requests (SingleLogoutService) to the identity provider during user sign-out. The user will be logged out of Auth0 but will remain logged into the identity provider. Defaults to false (federated logout enabled)." }, "discovery_url": { "type": "string", "examples": [ "https://provider.example.com/.well-known/openid-configuration" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the identity provider's OIDC Discovery endpoint (/.well-known/openid-configuration). When provided and oidc_metadata is empty, Auth0 automatically retrieves the provider's configuration including endpoints and supported features. Used with Cross App Access.", "x-release-lifecycle": "EA" }, "fieldsMap": { "description": "Maps SAML assertion attributes from the identity provider to Auth0 user profile attributes. Format: { 'auth0_field': 'saml_attribute' } or { 'auth0_field': ['saml_attr1', 'saml_attr2'] } for fallback options. Merged with default mappings for email, name, given_name, family_name, and groups.", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "fieldsMapJsonRaw": { "type": "string", "minLength": 0, "maxLength": 8192, "description": "Raw JSON string representation of the fieldsMap configuration. Used internally for storage and retrieval of the fieldsMap object." }, "global_token_revocation_jwt_iss": { "type": "string", "minLength": 1, "maxLength": 1024, "description": "Expected 'iss' (Issuer) claim value for JWT tokens in Global Token Revocation requests from the identity provider. When configured, Auth0 validates the JWT issuer matches this value before processing token revocation. Must be used together with global_token_revocation_jwt_sub." }, "global_token_revocation_jwt_sub": { "type": "string", "minLength": 1, "maxLength": 1024, "description": "Expected 'sub' (Subject) claim value for JWT tokens in Global Token Revocation requests from the identity provider. When configured, Auth0 validates the JWT subject matches this value before processing token revocation. Must be used together with global_token_revocation_jwt_iss." }, "metadataUrl": { "type": "string", "examples": [ "https://idp.example.com/saml/metadata" ], "minLength": 8, "maxLength": 2048, "format": "uri", "description": "HTTPS URL to the identity provider's SAML metadata document. When provided, Auth0 automatically fetches and parses the metadata to extract signInEndpoint, signOutEndpoint, signingCert, signSAMLRequest, and protocolBinding. Use metadataUrl OR metadataXml, not both." }, "oidc_metadata": { "description": "OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata. Used with Cross App Access.", "x-release-lifecycle": "EA", "type": "object", "properties": { "acr_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "urn:mace:incommon:iap:silver" ], "maxLength": 100 }, "minItems": 0, "maxItems": 30, "description": "A list of the Authentication Context Class References that this OP supports" }, "authorization_endpoint": { "description": "URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/authorize" ], "minLength": 8, "maxLength": 2083, "format": "uri" }, "claim_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "normal" ], "maxLength": 25 }, "minItems": 0, "maxItems": 10, "description": "JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims." }, "claims_locales_supported": { "type": "array", "items": { "type": "string", "examples": [ "en-US" ], "maxLength": 50 }, "minItems": 0, "maxItems": 100, "description": "Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values." }, "claims_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false." }, "claims_supported": { "type": "array", "items": { "type": "string", "examples": [ "sub" ], "maxLength": 100 }, "minItems": 0, "maxItems": 150, "description": "JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list." }, "code_challenge_methods_supported": { "type": "array", "items": { "type": "string", "examples": [ "S256" ], "maxLength": 20 }, "minItems": 0, "maxItems": 10, "description": "JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636." }, "display_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "page" ], "maxLength": 10 }, "minItems": 0, "maxItems": 6, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used." }, "dpop_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "ES256" ], "maxLength": 14 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing." }, "end_session_endpoint": { "type": "string", "examples": [ "https://provider.example.com/oauth/logout" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme." }, "grant_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "authorization_code" ], "maxLength": 100 }, "minItems": 0, "maxItems": 20, "description": "A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"]." }, "id_token_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RSA-OAEP" ], "maxLength": 14 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT" }, "id_token_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT]." }, "id_token_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10, "description": "JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata)." }, "minItems": 1, "maxItems": 26, "description": "A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518" }, "issuer": { "description": "The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.", "type": "string", "examples": [ "https://accounts.example.com" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "jwks_uri": { "description": "URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.", "type": "string", "examples": [ "https://provider.example.com/.well-known/jwks.json" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "op_policy_uri": { "type": "string", "examples": [ "https://provider.example.com/policy" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given." }, "op_tos_uri": { "type": "string", "examples": [ "https://provider.example.com/terms" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given." }, "registration_endpoint": { "type": "string", "examples": [ "https://provider.example.com/oauth/register" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration" }, "request_object_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RSA-OAEP" ], "maxLength": 28 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference." }, "request_object_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference." }, "request_object_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256." }, "request_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false." }, "request_uri_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false." }, "require_request_uri_registration": { "type": "boolean", "description": "Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false." }, "response_modes_supported": { "type": "array", "items": { "type": "string", "examples": [ "query" ], "maxLength": 20 }, "minItems": 0, "maxItems": 16, "description": "A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]" }, "response_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "code" ], "maxLength": 40 }, "minItems": 1, "maxItems": 40, "description": "A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values" }, "scopes_supported": { "type": "array", "items": { "type": "string", "examples": [ "openid" ], "maxLength": 100 }, "minItems": 0, "maxItems": 7000, "description": "A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED" }, "service_documentation": { "type": "string", "examples": [ "https://provider.example.com/docs" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation." }, "subject_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "public" ], "minLength": 0, "maxLength": 100 }, "minItems": 0, "maxItems": 20, "description": "A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public" }, "token_endpoint": { "description": "URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/token" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "token_endpoint_auth_methods_supported": { "type": "array", "items": { "type": "string", "examples": [ "client_secret_basic" ], "maxLength": 60 }, "minItems": 0, "maxItems": 14, "description": "JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749]." }, "token_endpoint_auth_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 24, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used." }, "ui_locales_supported": { "type": "array", "items": { "type": "string", "examples": [ "en-US" ], "maxLength": 50 }, "minItems": 0, "maxItems": 150, "description": "Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values." }, "userinfo_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]." }, "userinfo_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]." }, "userinfo_endpoint": { "description": "Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.", "type": "string", "examples": [ "https://provider.example.com/oauth/userinfo" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "userinfo_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included." } }, "required": [ "authorization_endpoint", "id_token_signing_alg_values_supported", "issuer", "jwks_uri" ], "unevaluatedProperties": { "not": {} } }, "recipientUrl": { "type": "string", "examples": [ "https://idp.example.com/saml/acs" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "The URL where Auth0 will send SAML authentication requests (the Identity Provider's SSO URL). Must be a valid HTTPS URL." }, "requestTemplate": { "type": "string", "minLength": 1, "maxLength": 10240, "description": "Custom XML template for SAML authentication requests. Supports variable substitution using @@variableName@@ syntax. When not provided, uses default SAML AuthnRequest template. See https://auth0.com/docs/authenticate/protocols/saml/saml-sso-integrations/configure-auth0-saml-service-provider#customize-the-request-template" }, "signOutEndpoint": { "type": "string", "examples": [ "https://idp.example.com/saml/slo" ], "minLength": 8, "maxLength": 2048, "format": "uri", "description": "Identity provider's SAML SingleLogoutService endpoint URL where Auth0 sends logout requests for federated sign-out. When not provided, defaults to signInEndpoint. Only used if disableSignout is false." }, "user_id_attribute": { "type": "string", "minLength": 1, "maxLength": 2396, "description": "Custom SAML assertion attribute to use as the unique user identifier. When provided, this attribute is prepended to the default user_id mapping list with highest priority. Accepts a string (single SAML attribute name)." } }, "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "samlp", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'pingfederate' connection", "type": "object", "properties": { "assertion_decryption_settings": { "description": "Settings for SAML assertion decryption.", "type": "object", "properties": { "algorithm_exceptions": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 100 }, "maxItems": 10, "description": "A list of insecure algorithms to allow for SAML assertion decryption." }, "algorithm_profile": { "description": "The algorithm profile to use for decrypting SAML assertions.", "type": "string", "enum": [ "v2026-1" ] } }, "required": [ "algorithm_profile" ], "unevaluatedProperties": { "not": {} } }, "cert": { "type": "string", "minLength": 1, "maxLength": 10240, "description": "X.509 signing certificate from the identity provider in .der format. Used to validate signatures in SAML Responses and Assertions. This is an alternative to signingCert and is kept for backward compatibility. Prefer using signingCert instead.", "deprecated": true }, "cert_rollover_notification": { "type": "string", "format": "date-time", "description": "Timestamp of the last certificate expiring soon notification." }, "digestAlgorithm": { "description": "Algorithm used for computing digest values when signing SAML requests and logout requests. Defaults to 'sha256'.", "type": "string", "enum": [ "sha1", "sha256" ] }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 50001, "description": "Domain aliases for the connection" }, "entityId": { "description": "The entity identifier (Issuer) for the SAML Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'. This value is included in SAML AuthnRequest messages sent to the identity provider.", "type": "string", "examples": [ "urn:auth0:my-tenant:my-connection" ], "minLength": 1, "maxLength": 128 }, "expires": { "type": "string", "format": "date-time", "description": "ISO 8601 formatted datetime indicating when the identity provider's signing certificate expires." }, "icon_url": { "description": "URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "idpinitiated": { "description": "Configuration for IdP-Initiated SAML Single Sign-On. When enabled, allows users to initiate login directly from their SAML identity provider without first visiting Auth0. The IdP must include the connection parameter in the post-back URL (Assertion Consumer Service URL).", "type": "object", "properties": { "client_authorizequery": { "type": "string", "minLength": 1, "maxLength": 2048, "description": "The query string sent to the default application" }, "client_id": { "type": "string", "minLength": 1, "maxLength": 256, "description": "The client ID to use for IdP-initiated login requests." }, "client_protocol": { "description": "The response protocol used to communicate with the default application.", "type": "string", "enum": [ "oidc", "samlp", "wsfed" ] }, "enabled": { "type": "boolean", "description": "When true, enables IdP-initiated login support for this SAML connection. Allows users to log in directly from the identity provider without first visiting Auth0." } }, "unevaluatedProperties": { "not": {} } }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "protocolBinding": { "description": "SAML protocol binding mechanism for sending authentication requests to the identity provider.", "type": "string", "enum": [ "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST", "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" ] }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "signatureAlgorithm": { "description": "Algorithm used to sign SAML authentication requests and logout requests using the connection's signing key. Common values: 'rsa-sha256' (RSA signature with SHA-256 digest) or 'rsa-sha1'. Defaults to 'rsa-sha256'.", "type": "string", "enum": [ "rsa-sha1", "rsa-sha256" ] }, "signInEndpoint": { "description": "Identity provider's SAML SingleSignOnService endpoint URL where Auth0 sends SAML authentication requests. This is the primary login URL for the SAML connection. Required unless using metadataUrl or metadataXml.", "type": "string", "examples": [ "https://idp.example.com/saml/sso" ], "minLength": 8, "maxLength": 2048, "format": "uri" }, "signingCert": { "description": "Base64-encoded X.509 certificate from the identity provider used to validate signatures in SAML responses and assertions. The certificate is decoded and used for cryptographic signature verification.", "type": "string", "examples": [ "MIIDDTCCAfWgAwIBAgIJALFkBP7GVlWkMA0GCSqGSIb3DQEBCwUAMCUxIzAhBgNV" ], "minLength": 1, "maxLength": 10240 }, "signSAMLRequest": { "type": "boolean", "description": "When true, Auth0 signs SAML authentication requests using the connection's signing key. The signature includes the request's digest and is validated by the identity provider. Defaults to false (unsigned requests)." }, "subject": { "description": "Certificate Subject Distinguished Name (DN) extracted from the identity provider's signing certificate.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "tenant_domain": { "description": "For SAML connections, the tenant domain used to construct the login endpoint URL. Can be a string for single-tenant or an array of strings for multi-tenant validation.", "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255 }, "thumbprints": { "type": "array", "items": { "type": "string", "examples": [ "ef34ab56cd78901234567890123456789012efab" ], "minLength": 40, "maxLength": 40 }, "minItems": 0, "maxItems": 1, "description": "SHA-1 thumbprints (fingerprints) of the identity provider's signing certificates. Automatically computed from signingCert during connection creation. Each thumbprint must be a 40-character hexadecimal string." }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "pingFederateBaseUrl": { "type": "string", "examples": [ "https://pingfederate.example.com" ], "minLength": 8, "maxLength": 256, "format": "uri", "description": "URL provided by PingFederate which returns information used for creating the connection" } }, "required": [ "pingFederateBaseUrl" ], "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "pingfederate", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'adfs' connection", "type": "object", "properties": { "adfs_server": { "type": "string", "examples": [ "adfs.example.com" ], "minLength": 0, "maxLength": 2048, "description": "ADFS federation metadata host or XML URL used to discover WS-Fed endpoints and certificates. Errors if adfs_server and fedMetadataXml are both absent." }, "cert_rollover_notification": { "type": "string", "format": "date-time", "description": "Timestamp of the last certificate expiring soon notification." }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 1000, "description": "Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication." }, "entityId": { "description": "The entity identifier (Issuer) for the ADFS Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'.", "type": "string", "examples": [ "urn:auth0:my-tenant:my-connection" ], "minLength": 1, "maxLength": 128 }, "fedMetadataXml": { "type": "string", "minLength": 1, "maxLength": 102400, "description": "Inline XML alternative to 'adfs_server'. Cannot be set together with 'adfs_server'." }, "icon_url": { "description": "URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "prev_thumbprints": { "type": "array", "items": { "type": "string", "examples": [ "AB12CD34EF56789012345678901234567890ABCD" ], "minLength": 0, "maxLength": 64, "description": "Certificate thumbprints for ADFS and Azure AD connections." }, "minItems": 0, "maxItems": 20, "description": "Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string." }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "should_trust_email_verified_connection": { "description": "Choose how Auth0 sets the email_verified field in the user profile.", "type": "string", "enum": [ "never_set_emails_as_verified", "always_set_emails_as_verified" ] }, "signInEndpoint": { "description": "Passive Requestor (WS-Fed) sign-in endpoint discovered from metadata or provided explicitly.", "type": "string", "examples": [ "https://idp.example.com/saml/sso" ], "minLength": 8, "maxLength": 2048, "format": "uri" }, "tenant_domain": { "description": "Tenant domain", "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255 }, "thumbprints": { "type": "array", "items": { "type": "string", "examples": [ "AB12CD34EF56789012345678901234567890ABCD" ], "minLength": 0, "maxLength": 64, "description": "Certificate thumbprints for ADFS and Azure AD connections." }, "minItems": 0, "maxItems": 20, "description": "Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string." }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "user_id_attribute": { "type": "string", "minLength": 1, "maxLength": 128, "description": "Custom ADFS claim to use as the unique user identifier. When provided, this attribute is prepended to the default user_id mapping list with highest priority. Accepts a string (single ADFS claim name)." } }, "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "adfs", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'ad' connection", "type": "object", "properties": { "agentIP": { "description": "IP address of the AD connector agent used to validate that authentication requests originate from the corporate network for Kerberos authentication (managed by the AD Connector agent).", "type": "string", "examples": [ "192.168.1.10" ], "minLength": 2, "maxLength": 39 }, "agentMode": { "type": "boolean", "description": "When enabled, allows direct username/password authentication through the AD connector agent instead of WS-Federation protocol (managed by the AD Connector agent)." }, "agentVersion": { "type": "string", "examples": [ "1.4.2" ], "minLength": 5, "maxLength": 12, "description": "Version identifier of the installed AD connector agent software (managed by the AD Connector agent)." }, "brute_force_protection": { "type": "boolean", "description": "Enables Auth0's brute force protection to prevent credential stuffing attacks. When enabled, blocks suspicious login attempts from specific IP addresses after repeated failures." }, "certAuth": { "type": "boolean", "description": "Enables client SSL certificate authentication for the AD connector, requiring HTTPS on the sign-in endpoint" }, "certs": { "type": "array", "items": { "type": "string", "examples": [ "MIIDDTCCAfWgAwIBAgIJALFkBP7GVlWkMA0GCSqGSIb3DQEBCwUAMCUxIzAhBgNVBAMTGmV4YW1wbGUuYXV0aDAuY29tIENlcnQgQ0EwHhcNMjUwMTAxMDAwMDAwWhcNMjYwMTAxMDAwMDAwWjAUMRIwEAYDVQQDEwlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC7o4qne60TB3wolFrzabc1234567890ABCDEFG" ], "minLength": 256, "maxLength": 3072 }, "minItems": 0, "maxItems": 2, "description": "Array of X.509 certificates in PEM format used for validating SAML signatures from the AD identity provider (managed by the AD Connector agent)." }, "disable_cache": { "type": "boolean", "description": "When enabled, disables caching of AD connector authentication results to ensure real-time validation against the directory" }, "disable_self_service_change_password": { "type": "boolean", "description": "When enabled, hides the 'Forgot Password' link on login pages to prevent users from initiating self-service password resets" }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 1000, "description": "List of domain names that can be used with identifier-first authentication flow to route users to this AD connection; each domain must be a valid DNS name up to 256 characters" }, "icon_url": { "description": "https url of the icon to be shown", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "ips": { "type": "array", "items": { "type": "string", "examples": [ "192.168.1.10" ], "minLength": 2, "maxLength": 39 }, "minItems": 0, "maxItems": 256, "description": "Array of IP address ranges in CIDR notation used to determine if authentication requests originate from the corporate network for Kerberos or certificate authentication." }, "kerberos": { "type": "boolean", "description": "Enables Windows Integrated Authentication (Kerberos) for seamless SSO when users authenticate from within the corporate network IP ranges" }, "kerberos_only": { "type": "boolean", "description": "When true, restricts the connection to Kerberos-only authentication, disallowing username/password fallback." }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "signInEndpoint": { "type": "string", "examples": [ "https://ad-connector.example.com" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "The sign-in endpoint type for the AD-LDAP connector agent (managed by the AD Connector agent)." }, "tenant_domain": { "type": "string", "examples": [ "corp.example.com" ], "minLength": 1, "maxLength": 512, "format": "hostname", "description": "Primary AD domain hint used for HRD and discovery." }, "thumbprints": { "type": "array", "items": { "type": "string", "examples": [ "8233ec9c12a44625d4a64ee413651fd928b5168f" ], "minLength": 40, "maxLength": 40 }, "minItems": 0, "maxItems": 2, "description": "Array of certificate SHA-1 thumbprints for validating signatures. Managed by Auth0 when using the AD Connector agent." }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} } }, "unevaluatedProperties": { "not": {} } }, "strategy": { "type": "string", "const": "ad", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'google-apps' connection", "type": "object", "properties": { "admin_access_token_expiresin": { "type": "string", "format": "date-time", "description": "Expiration timestamp for the `admin_access_token` in ISO 8601 format. Auth0 uses this value to determine when to refresh the token." }, "allow_setting_login_scopes": { "type": "boolean", "description": "When true, allows customization of OAuth scopes requested during user login. Custom scopes are appended to the mandatory email and profile scopes. When false or omitted, only the default email and profile scopes are used. This property is automatically enabled when Token Vault or Connected Accounts features are activated." }, "api_enable_groups": { "type": "boolean", "description": "Enables integration with the Google Workspace Admin SDK Directory API for groups. When true, Auth0 can synchronize groups & group memberships and supports inbound directory provisioning for groups. Defaults to false." }, "api_enable_users": { "type": "boolean", "description": "Enables integration with the Google Workspace Admin SDK Directory API. When true, Auth0 can retrieve extended user attributes (admin status, suspension status, group memberships) and supports inbound directory provisioning (SCIM). Defaults to true." }, "client_id": { "type": "string", "examples": [ "123456789-abc123def456.apps.googleusercontent.com" ], "minLength": 1, "maxLength": 128, "description": "Your Google OAuth 2.0 client ID. You can find this in your [Google Cloud Console](https://console.cloud.google.com/apis/credentials) under the OAuth 2.0 Client IDs section." }, "domain": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 1024, "description": "Primary Google Workspace domain name that users must belong to." }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 1000, "description": "Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication." }, "email": { "type": "boolean", "description": "Whether the OAuth flow requests the `email` scope." }, "ext_agreed_terms": { "type": "boolean", "description": "Fetches the `agreedToTerms` flag from the Google Directory profile." }, "ext_groups": { "type": "boolean", "description": "Enables enrichment with Google group memberships (required for `ext_groups_extended`)." }, "ext_groups_extended": { "type": "boolean", "description": "Controls whether enriched group entries include `id`, `email`, `name` (true) or only the group name (false); can only be set when `ext_groups` is true." }, "ext_is_admin": { "type": "boolean", "description": "Fetches the Google Directory admin flag for the signing-in user." }, "ext_is_suspended": { "type": "boolean", "description": "Fetches the Google Directory suspended flag for the signing-in user." }, "federated_connections_access_tokens": { "description": "Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.", "type": "object", "properties": { "active": { "type": "boolean", "description": "Enables refresh tokens and access tokens collection for federated connections" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "handle_login_from_social": { "type": "boolean", "description": "When enabled, users who sign in with their Google account through a social login will be automatically routed to this Google Workspace connection if their email domain matches the configured tenant_domain or domain_aliases. This ensures enterprise users authenticate through their organization's Google Workspace identity provider rather than through a generic Google social login, enabling access to directory-based attributes and enforcing organizational security policies. Defaults to true for new connections." }, "icon_url": { "description": "URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "map_user_id_to_id": { "type": "boolean", "description": "Determines how Auth0 generates the user_id for Google Workspace users. When false (default), the user's email address is used. When true, Google's stable numeric user ID is used instead, which persists even if the user's email changes. This setting can only be configured when creating the connection and cannot be changed afterward." }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "profile": { "type": "boolean", "description": "Whether the OAuth flow requests the `profile` scope." }, "scope": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 255 }, "minItems": 1, "maxItems": 64, "description": "Additional OAuth scopes requested beyond the default `email profile` scopes; ignored unless `allow_setting_login_scopes` is true." }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "tenant_domain": { "description": "The Google Workspace primary domain used to identify the organization during authentication.", "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255 }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} } }, "required": [ "client_id" ], "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "google-apps", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'waad' connection", "type": "object", "properties": { "api_enable_users": { "type": "boolean", "description": "Enable users API" }, "app_domain": { "type": "string", "examples": [ "contoso.onmicrosoft.com" ], "minLength": 0, "maxLength": 255, "description": "The Azure AD application domain (e.g., 'contoso.onmicrosoft.com'). Used primarily with WS-Federation protocol and Azure AD v1 endpoints." }, "app_id": { "type": "string", "examples": [ "api://contoso-azure-app" ], "minLength": 0, "maxLength": 500, "description": "The Application ID URI (App ID URI) for the Azure AD application. Required when using Azure AD v1 with the Resource Owner Password flow. Used to identify the resource being requested in OAuth token requests." }, "basic_profile": { "type": "boolean", "description": "Includes basic user profile information from Azure AD (name, email, given_name, family_name). Always enabled and required - represents the minimum profile data retrieved during authentication." }, "cert_rollover_notification": { "type": "string", "format": "date-time", "description": "Timestamp of the last certificate expiring soon notification." }, "client_id": { "type": "string", "examples": [ "12345678-1234-1234-1234-123456789012" ], "minLength": 0, "maxLength": 100, "description": "OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider." }, "domain": { "type": "string", "examples": [ "contoso.onmicrosoft.com" ], "minLength": 0, "maxLength": 512, "description": "The primary Azure AD tenant domain (e.g., 'contoso.onmicrosoft.com' or 'contoso.com')." }, "domain_aliases": { "type": "array", "items": { "type": "string", "minLength": 0, "maxLength": 255 }, "minItems": 0, "maxItems": 1000, "description": "Alternative domain names associated with this Azure AD tenant. Allows users from multiple verified domains to authenticate through this connection. Can be an array of domain strings." }, "ext_groups": { "type": "boolean", "description": "When enabled (true), retrieves and stores Azure AD security group memberships for the user. Requires Microsoft Graph API permissions (Directory.Read.All). Allows configuring max_groups_to_retrieve." }, "ext_nested_groups": { "type": "boolean", "description": "When true, stores all groups the user is member of, including transitive group memberships (groups within groups). When false (default), only direct group memberships are included." }, "ext_profile": { "type": "boolean", "description": "When enabled (true), retrieves extended profile attributes from Azure AD via Microsoft Graph API (job title, department, office location, etc.). Requires Graph API permissions. Only available with Azure AD v1 or when explicitly enabled for v2." }, "federated_connections_access_tokens": { "description": "Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.", "type": "object", "properties": { "active": { "type": "boolean", "description": "Enables refresh tokens and access tokens collection for federated connections" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "granted": { "type": "boolean", "description": "Indicates whether admin consent has been granted for the required Azure AD permissions. Read-only status field managed by Auth0 during the OAuth authorization flow." }, "icon_url": { "description": "URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "identity_api": { "description": "The Azure AD endpoint version for authentication. 'microsoft-identity-platform-v2.0' (recommended, default) supports modern OAuth 2.0 features. 'azure-active-directory-v1.0' is the legacy endpoint with protocol limitations. Selection affects available features.", "type": "string", "enum": [ "microsoft-identity-platform-v2.0", "azure-active-directory-v1.0" ] }, "max_groups_to_retrieve": { "type": "string", "examples": [ "100" ], "minLength": 0, "maxLength": 10, "description": "Maximum number of Azure AD groups to retrieve per user during authentication. Helps prevent performance issues for users in many groups. Only applies when ext_groups is enabled. Leave empty to use platform default." }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "scope": { "type": "array", "items": { "type": "string", "minLength": 0, "maxLength": 100 }, "minItems": 0, "maxItems": 100, "description": "OAuth 2.0 scopes to request from Azure AD during authentication. Each scope represents a permission (e.g., 'User.Read', 'Group.Read.All'). Only applies with Microsoft Identity Platform v2.0. See Microsoft Graph permissions reference for available scopes." }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "should_trust_email_verified_connection": { "description": "Choose how Auth0 sets the email_verified field in the user profile.", "type": "string", "enum": [ "never_set_emails_as_verified", "always_set_emails_as_verified" ] }, "tenant_domain": { "anyOf": [ { "type": "string", "examples": [ "contoso.onmicrosoft.com" ], "minLength": 0, "maxLength": 512, "format": "hostname", "description": "Azure AD tenant domain as a hostname (e.g. contoso.onmicrosoft.com)." }, { "type": "string", "format": "uuid", "description": "Azure AD tenant domain as a UUID tenant ID." } ], "description": "The Azure AD tenant domain or tenant ID (UUID). Auto-populated from the 'domain' field. Can be either a hostname (e.g., 'contoso.onmicrosoft.com') or a UUID tenant ID." }, "tenantId": { "type": "string", "examples": [ "12345678-1234-1234-1234-123456789012" ], "minLength": 36, "maxLength": 36, "format": "uuid", "description": "The Azure AD tenant ID as a UUID. The unique identifier for your Azure AD organization. Must be a valid 36-character UUID." }, "thumbprints": { "type": "array", "items": { "type": "string", "examples": [ "AB12CD34EF56789012345678901234567890ABCD" ], "minLength": 0, "maxLength": 64, "description": "Certificate thumbprints for ADFS and Azure AD connections." }, "minItems": 0, "maxItems": 20, "description": "Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string." }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "use_wsfed": { "type": "boolean", "description": "Indicates WS-Federation protocol usage. When true, uses WS-Federation; when false, uses OpenID Connect." }, "useCommonEndpoint": { "type": "boolean", "description": "When enabled (true), uses the Azure AD common endpoint for multi-tenant authentication. Allows users from any Azure AD organization to sign in. Requires userid_attribute set to 'sub' (not 'oid'). Cannot be used with SCIM provisioning. Defaults to false." }, "userid_attribute": { "description": "The Azure AD claim to use as the unique user identifier. 'oid' (Object ID) is recommended for single-tenant connections and required for SCIM. 'sub' (Subject) is required for multi-tenant/common endpoint. Only applies with OpenID Connect protocol.", "type": "string", "enum": [ "oid", "sub" ] }, "waad_protocol": { "description": "The authentication protocol for Azure AD v1 endpoints. 'openid-connect' (default, recommended) uses modern OAuth 2.0/OIDC. 'ws-federation' is a legacy SAML-based protocol for older integrations. Only available with Azure AD v1 API.", "type": "string", "enum": [ "ws-federation", "openid-connect" ] } }, "required": [ "client_id" ], "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "waad", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" } ] }, "previous_object": { "description": "The event content as it was prior to the change described by this event, when applicable.", "oneOf": [ { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" }, "cross_app_access": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "options": { "description": "Options for the 'oidc' connection", "type": "object", "properties": { "authorization_endpoint": { "description": "URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/authorize" ], "minLength": 8, "maxLength": 2083, "format": "uri" }, "client_id": { "type": "string", "examples": [ "abc123def456ghi789" ], "minLength": 0, "maxLength": 255, "description": "OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider." }, "connection_settings": { "description": "OAuth 2.0 PKCE (Proof Key for Code Exchange) settings. PKCE enhances security for public clients by preventing authorization code interception attacks. 'auto' (recommended) uses the strongest method supported by the IdP.", "type": "object", "properties": { "pkce": { "description": "PKCE configuration.", "type": "string", "enum": [ "auto", "S256", "plain", "disabled" ] } }, "unevaluatedProperties": { "not": {} } }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 1000, "description": "Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication." }, "dpop_signing_alg": { "description": "Algorithm used for DPoP proof JWT signing. Applicable when strategy=oidc or okta.", "type": "string", "enum": [ "ES256", "ES384", "ES512", "Ed25519" ] }, "federated_connections_access_tokens": { "description": "Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.", "type": "object", "properties": { "active": { "type": "boolean", "description": "Enables refresh tokens and access tokens collection for federated connections" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "icon_url": { "description": "https url of the icon to be shown", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "id_token_session_expiry_supported": { "type": "boolean", "description": "Indicates whether the identity provider supports session expiry via the id_token. If true, the system will use the session_expiry claim in the id_token to determine session expiry." }, "id_token_signed_response_algs": { "type": "array", "items": { "type": "string", "enum": [ "ES256", "ES384", "PS256", "PS384", "RS256", "RS384", "RS512" ], "description": "Algorithm allowed to verify the ID tokens." }, "description": "List of algorithms allowed to verify the ID tokens. Applicable when strategy=oidc or okta." }, "issuer": { "description": "The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.", "type": "string", "examples": [ "https://accounts.example.com" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "jwks_uri": { "description": "URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.", "type": "string", "examples": [ "https://provider.example.com/.well-known/jwks.json" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "oidc_metadata": { "description": "OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata", "type": "object", "properties": { "acr_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "urn:mace:incommon:iap:silver" ], "maxLength": 100 }, "minItems": 0, "maxItems": 30, "description": "A list of the Authentication Context Class References that this OP supports" }, "authorization_endpoint": { "description": "URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/authorize" ], "minLength": 8, "maxLength": 2083, "format": "uri" }, "claim_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "normal" ], "maxLength": 25 }, "minItems": 0, "maxItems": 10, "description": "JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims." }, "claims_locales_supported": { "type": "array", "items": { "type": "string", "examples": [ "en-US" ], "maxLength": 50 }, "minItems": 0, "maxItems": 100, "description": "Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values." }, "claims_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false." }, "claims_supported": { "type": "array", "items": { "type": "string", "examples": [ "sub" ], "maxLength": 100 }, "minItems": 0, "maxItems": 150, "description": "JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list." }, "code_challenge_methods_supported": { "type": "array", "items": { "type": "string", "examples": [ "S256" ], "maxLength": 20 }, "minItems": 0, "maxItems": 10, "description": "JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636." }, "display_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "page" ], "maxLength": 10 }, "minItems": 0, "maxItems": 6, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used." }, "dpop_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "ES256" ], "maxLength": 14 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing." }, "end_session_endpoint": { "type": "string", "examples": [ "https://provider.example.com/oauth/logout" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme." }, "grant_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "authorization_code" ], "maxLength": 100 }, "minItems": 0, "maxItems": 20, "description": "A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"]." }, "id_token_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RSA-OAEP" ], "maxLength": 14 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT" }, "id_token_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT]." }, "id_token_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10, "description": "JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata)." }, "minItems": 1, "maxItems": 26, "description": "A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518" }, "issuer": { "description": "The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.", "type": "string", "examples": [ "https://accounts.example.com" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "jwks_uri": { "description": "URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.", "type": "string", "examples": [ "https://provider.example.com/.well-known/jwks.json" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "op_policy_uri": { "type": "string", "examples": [ "https://provider.example.com/policy" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given." }, "op_tos_uri": { "type": "string", "examples": [ "https://provider.example.com/terms" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given." }, "registration_endpoint": { "type": "string", "examples": [ "https://provider.example.com/oauth/register" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration" }, "request_object_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RSA-OAEP" ], "maxLength": 28 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference." }, "request_object_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference." }, "request_object_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256." }, "request_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false." }, "request_uri_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false." }, "require_request_uri_registration": { "type": "boolean", "description": "Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false." }, "response_modes_supported": { "type": "array", "items": { "type": "string", "examples": [ "query" ], "maxLength": 20 }, "minItems": 0, "maxItems": 16, "description": "A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]" }, "response_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "code" ], "maxLength": 40 }, "minItems": 1, "maxItems": 40, "description": "A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values" }, "scopes_supported": { "type": "array", "items": { "type": "string", "examples": [ "openid" ], "maxLength": 100 }, "minItems": 0, "maxItems": 7000, "description": "A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED" }, "service_documentation": { "type": "string", "examples": [ "https://provider.example.com/docs" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation." }, "subject_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "public" ], "minLength": 0, "maxLength": 100 }, "minItems": 0, "maxItems": 20, "description": "A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public" }, "token_endpoint": { "description": "URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/token" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "token_endpoint_auth_methods_supported": { "type": "array", "items": { "type": "string", "examples": [ "client_secret_basic" ], "maxLength": 60 }, "minItems": 0, "maxItems": 14, "description": "JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749]." }, "token_endpoint_auth_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 24, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used." }, "ui_locales_supported": { "type": "array", "items": { "type": "string", "examples": [ "en-US" ], "maxLength": 50 }, "minItems": 0, "maxItems": 150, "description": "Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values." }, "userinfo_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]." }, "userinfo_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]." }, "userinfo_endpoint": { "description": "Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.", "type": "string", "examples": [ "https://provider.example.com/oauth/userinfo" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "userinfo_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included." } }, "required": [ "authorization_endpoint", "id_token_signing_alg_values_supported", "issuer", "jwks_uri" ], "unevaluatedProperties": { "not": {} } }, "schema_version": { "description": "The internal schema version of the connection options.", "type": "string", "enum": [ "openid-1.0.0", "oidc-v4" ] }, "scope": { "type": "string", "examples": [ "openid profile email" ], "minLength": 6, "maxLength": 255, "description": "Space-separated list of OAuth 2.0 scopes requested during authorization. Must include 'openid' (required by OIDC spec). Common values: 'openid profile email'. Additional scopes depend on the identity provider." }, "send_back_channel_nonce": { "type": "boolean", "description": "When true and type is 'back_channel', includes a cryptographic nonce in authorization requests to prevent replay attacks. The identity provider must include this nonce in the ID token for validation." }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "tenant_domain": { "description": "Tenant domain", "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255 }, "token_endpoint": { "description": "URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/token" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "token_endpoint_auth_method": { "description": "Authentication method used at the identity provider's token endpoint. 'client_secret_post' sends credentials in the request body; 'private_key_jwt' uses a signed JWT assertion for enhanced security. Applicable when strategy=oidc or okta.", "type": "string", "enum": [ "client_secret_post", "private_key_jwt" ] }, "token_endpoint_auth_signing_alg": { "description": "Algorithm used to sign client_assertions. Applicable when strategy=oidc or okta.", "type": "string", "enum": [ "ES256", "ES384", "PS256", "PS384", "RS256", "RS384", "RS512" ] }, "token_endpoint_jwtca_aud_format": { "description": "Specifies the format of the aud (audience) claim included in the JWT used for client authentication at the token endpoint. Accepted values are: 'issuer' (the aud claim is set to the OIDC issuer URL) or 'token_endpoint' (the aud claim is set to the token endpoint URL).", "type": "string", "enum": [ "issuer", "token_endpoint" ] }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "useOauthSpecScope": { "type": "boolean", "description": "When true, uses space-delimited scopes (per OAuth 2.0 spec) instead of comma-delimited when calling the identity provider's authorization endpoint. Only relevant when using the connection_scope parameter. See https://auth0.com/docs/authenticate/identity-providers/adding-scopes-for-an-external-idp#pass-scopes-to-authorize-endpoint" }, "userinfo_endpoint": { "description": "Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.", "type": "string", "examples": [ "https://provider.example.com/oauth/userinfo" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "attribute_map": { "description": "Configuration for mapping claims from the identity provider to Auth0 user profile attributes. Allows customizing which IdP claims populate user fields and how they are transformed.", "type": "object", "properties": { "attributes": { "description": "Object containing mapping details for incoming claims", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "userinfo_scope": { "type": "string", "examples": [ "openid profile email" ], "minLength": 0, "maxLength": 255, "description": "Scopes to send to the IdP's Userinfo endpoint" }, "mapping_mode": { "description": "Method used to map incoming claims when strategy=oidc.", "type": "string", "enum": [ "bind_all", "use_map" ] } }, "unevaluatedProperties": { "not": {} } }, "discovery_url": { "type": "string", "examples": [ "https://provider.example.com/.well-known/openid-configuration" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the identity provider's OIDC Discovery endpoint (/.well-known/openid-configuration). When provided and oidc_metadata is empty, Auth0 automatically retrieves the provider's configuration including endpoints and supported features." }, "type": { "description": "OIDC communication channel type. 'back_channel' (confidential client) exchanges tokens server-side for stronger security; 'front_channel' handles responses in the browser.", "type": "string", "enum": [ "back_channel", "front_channel" ] } }, "required": [ "client_id" ], "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "oidc", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'okta' connection", "type": "object", "properties": { "authorization_endpoint": { "description": "URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/authorize" ], "minLength": 8, "maxLength": 2083, "format": "uri" }, "client_id": { "type": "string", "examples": [ "abc123def456ghi789" ], "minLength": 0, "maxLength": 255, "description": "OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider." }, "connection_settings": { "description": "OAuth 2.0 PKCE (Proof Key for Code Exchange) settings. PKCE enhances security for public clients by preventing authorization code interception attacks. 'auto' (recommended) uses the strongest method supported by the IdP.", "type": "object", "properties": { "pkce": { "description": "PKCE configuration.", "type": "string", "enum": [ "auto", "S256", "plain", "disabled" ] } }, "unevaluatedProperties": { "not": {} } }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 1000, "description": "Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication." }, "dpop_signing_alg": { "description": "Algorithm used for DPoP proof JWT signing. Applicable when strategy=oidc or okta.", "type": "string", "enum": [ "ES256", "ES384", "ES512", "Ed25519" ] }, "federated_connections_access_tokens": { "description": "Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.", "type": "object", "properties": { "active": { "type": "boolean", "description": "Enables refresh tokens and access tokens collection for federated connections" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "icon_url": { "description": "https url of the icon to be shown", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "id_token_session_expiry_supported": { "type": "boolean", "description": "Indicates whether the identity provider supports session expiry via the id_token. If true, the system will use the session_expiry claim in the id_token to determine session expiry." }, "id_token_signed_response_algs": { "type": "array", "items": { "type": "string", "enum": [ "ES256", "ES384", "PS256", "PS384", "RS256", "RS384", "RS512" ], "description": "Algorithm allowed to verify the ID tokens." }, "description": "List of algorithms allowed to verify the ID tokens. Applicable when strategy=oidc or okta." }, "issuer": { "description": "The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.", "type": "string", "examples": [ "https://accounts.example.com" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "jwks_uri": { "description": "URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.", "type": "string", "examples": [ "https://provider.example.com/.well-known/jwks.json" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "oidc_metadata": { "description": "OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata", "type": "object", "properties": { "acr_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "urn:mace:incommon:iap:silver" ], "maxLength": 100 }, "minItems": 0, "maxItems": 30, "description": "A list of the Authentication Context Class References that this OP supports" }, "authorization_endpoint": { "description": "URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/authorize" ], "minLength": 8, "maxLength": 2083, "format": "uri" }, "claim_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "normal" ], "maxLength": 25 }, "minItems": 0, "maxItems": 10, "description": "JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims." }, "claims_locales_supported": { "type": "array", "items": { "type": "string", "examples": [ "en-US" ], "maxLength": 50 }, "minItems": 0, "maxItems": 100, "description": "Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values." }, "claims_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false." }, "claims_supported": { "type": "array", "items": { "type": "string", "examples": [ "sub" ], "maxLength": 100 }, "minItems": 0, "maxItems": 150, "description": "JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list." }, "code_challenge_methods_supported": { "type": "array", "items": { "type": "string", "examples": [ "S256" ], "maxLength": 20 }, "minItems": 0, "maxItems": 10, "description": "JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636." }, "display_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "page" ], "maxLength": 10 }, "minItems": 0, "maxItems": 6, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used." }, "dpop_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "ES256" ], "maxLength": 14 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing." }, "end_session_endpoint": { "type": "string", "examples": [ "https://provider.example.com/oauth/logout" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme." }, "grant_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "authorization_code" ], "maxLength": 100 }, "minItems": 0, "maxItems": 20, "description": "A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"]." }, "id_token_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RSA-OAEP" ], "maxLength": 14 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT" }, "id_token_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT]." }, "id_token_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10, "description": "JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata)." }, "minItems": 1, "maxItems": 26, "description": "A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518" }, "issuer": { "description": "The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.", "type": "string", "examples": [ "https://accounts.example.com" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "jwks_uri": { "description": "URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.", "type": "string", "examples": [ "https://provider.example.com/.well-known/jwks.json" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "op_policy_uri": { "type": "string", "examples": [ "https://provider.example.com/policy" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given." }, "op_tos_uri": { "type": "string", "examples": [ "https://provider.example.com/terms" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given." }, "registration_endpoint": { "type": "string", "examples": [ "https://provider.example.com/oauth/register" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration" }, "request_object_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RSA-OAEP" ], "maxLength": 28 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference." }, "request_object_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference." }, "request_object_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256." }, "request_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false." }, "request_uri_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false." }, "require_request_uri_registration": { "type": "boolean", "description": "Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false." }, "response_modes_supported": { "type": "array", "items": { "type": "string", "examples": [ "query" ], "maxLength": 20 }, "minItems": 0, "maxItems": 16, "description": "A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]" }, "response_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "code" ], "maxLength": 40 }, "minItems": 1, "maxItems": 40, "description": "A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values" }, "scopes_supported": { "type": "array", "items": { "type": "string", "examples": [ "openid" ], "maxLength": 100 }, "minItems": 0, "maxItems": 7000, "description": "A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED" }, "service_documentation": { "type": "string", "examples": [ "https://provider.example.com/docs" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation." }, "subject_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "public" ], "minLength": 0, "maxLength": 100 }, "minItems": 0, "maxItems": 20, "description": "A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public" }, "token_endpoint": { "description": "URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/token" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "token_endpoint_auth_methods_supported": { "type": "array", "items": { "type": "string", "examples": [ "client_secret_basic" ], "maxLength": 60 }, "minItems": 0, "maxItems": 14, "description": "JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749]." }, "token_endpoint_auth_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 24, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used." }, "ui_locales_supported": { "type": "array", "items": { "type": "string", "examples": [ "en-US" ], "maxLength": 50 }, "minItems": 0, "maxItems": 150, "description": "Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values." }, "userinfo_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]." }, "userinfo_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]." }, "userinfo_endpoint": { "description": "Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.", "type": "string", "examples": [ "https://provider.example.com/oauth/userinfo" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "userinfo_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included." } }, "required": [ "authorization_endpoint", "id_token_signing_alg_values_supported", "issuer", "jwks_uri" ], "unevaluatedProperties": { "not": {} } }, "schema_version": { "description": "The internal schema version of the connection options.", "type": "string", "enum": [ "openid-1.0.0", "oidc-v4" ] }, "scope": { "type": "string", "examples": [ "openid profile email" ], "minLength": 6, "maxLength": 255, "description": "Space-separated list of OAuth 2.0 scopes requested during authorization. Must include 'openid' (required by OIDC spec). Common values: 'openid profile email'. Additional scopes depend on the identity provider." }, "send_back_channel_nonce": { "type": "boolean", "description": "When true and type is 'back_channel', includes a cryptographic nonce in authorization requests to prevent replay attacks. The identity provider must include this nonce in the ID token for validation." }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "tenant_domain": { "description": "Tenant domain", "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255 }, "token_endpoint": { "description": "URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/token" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "token_endpoint_auth_method": { "description": "Authentication method used at the identity provider's token endpoint. 'client_secret_post' sends credentials in the request body; 'private_key_jwt' uses a signed JWT assertion for enhanced security. Applicable when strategy=oidc or okta.", "type": "string", "enum": [ "client_secret_post", "private_key_jwt" ] }, "token_endpoint_auth_signing_alg": { "description": "Algorithm used to sign client_assertions. Applicable when strategy=oidc or okta.", "type": "string", "enum": [ "ES256", "ES384", "PS256", "PS384", "RS256", "RS384", "RS512" ] }, "token_endpoint_jwtca_aud_format": { "description": "Specifies the format of the aud (audience) claim included in the JWT used for client authentication at the token endpoint. Accepted values are: 'issuer' (the aud claim is set to the OIDC issuer URL) or 'token_endpoint' (the aud claim is set to the token endpoint URL).", "type": "string", "enum": [ "issuer", "token_endpoint" ] }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "useOauthSpecScope": { "type": "boolean", "description": "When true, uses space-delimited scopes (per OAuth 2.0 spec) instead of comma-delimited when calling the identity provider's authorization endpoint. Only relevant when using the connection_scope parameter. See https://auth0.com/docs/authenticate/identity-providers/adding-scopes-for-an-external-idp#pass-scopes-to-authorize-endpoint" }, "userinfo_endpoint": { "description": "Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.", "type": "string", "examples": [ "https://provider.example.com/oauth/userinfo" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "attribute_map": { "description": "Mapping of claims received from the identity provider (IdP)", "type": "object", "properties": { "attributes": { "description": "Object containing mapping details for incoming claims", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "userinfo_scope": { "type": "string", "examples": [ "openid profile email" ], "minLength": 0, "maxLength": 255, "description": "Scopes to send to the IdP's Userinfo endpoint" }, "mapping_mode": { "description": "Method used to map incoming claims when strategy=okta.", "type": "string", "enum": [ "basic_profile", "use_map" ] } }, "unevaluatedProperties": { "not": {} } }, "domain": { "type": "string", "examples": [ "dev-123456.okta.com" ], "minLength": 4, "maxLength": 255, "description": "Domain of the Okta organization (e.g., dev-123456.okta.com). Should be just the domain of the okta server with no scheme or trailing backslash. Discovery runs only when connection.options.oidc_metadata is empty and a domain is provided" }, "type": { "description": "Connection type", "type": "string", "enum": [ "back_channel" ] } }, "required": [ "client_id" ], "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "okta", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'samlp' connection", "type": "object", "properties": { "assertion_decryption_settings": { "description": "Settings for SAML assertion decryption.", "type": "object", "properties": { "algorithm_exceptions": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 100 }, "maxItems": 10, "description": "A list of insecure algorithms to allow for SAML assertion decryption." }, "algorithm_profile": { "description": "The algorithm profile to use for decrypting SAML assertions.", "type": "string", "enum": [ "v2026-1" ] } }, "required": [ "algorithm_profile" ], "unevaluatedProperties": { "not": {} } }, "cert": { "type": "string", "minLength": 1, "maxLength": 10240, "description": "X.509 signing certificate from the identity provider in .der format. Used to validate signatures in SAML Responses and Assertions. This is an alternative to signingCert and is kept for backward compatibility. Prefer using signingCert instead.", "deprecated": true }, "cert_rollover_notification": { "type": "string", "format": "date-time", "description": "Timestamp of the last certificate expiring soon notification." }, "digestAlgorithm": { "description": "Algorithm used for computing digest values when signing SAML requests and logout requests. Defaults to 'sha256'.", "type": "string", "enum": [ "sha1", "sha256" ] }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 50001, "description": "Domain aliases for the connection" }, "entityId": { "description": "The entity identifier (Issuer) for the SAML Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'. This value is included in SAML AuthnRequest messages sent to the identity provider.", "type": "string", "examples": [ "urn:auth0:my-tenant:my-connection" ], "minLength": 1, "maxLength": 128 }, "expires": { "type": "string", "format": "date-time", "description": "ISO 8601 formatted datetime indicating when the identity provider's signing certificate expires." }, "icon_url": { "description": "URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "idpinitiated": { "description": "Configuration for IdP-Initiated SAML Single Sign-On. When enabled, allows users to initiate login directly from their SAML identity provider without first visiting Auth0. The IdP must include the connection parameter in the post-back URL (Assertion Consumer Service URL).", "type": "object", "properties": { "client_authorizequery": { "type": "string", "minLength": 1, "maxLength": 2048, "description": "The query string sent to the default application" }, "client_id": { "type": "string", "minLength": 1, "maxLength": 256, "description": "The client ID to use for IdP-initiated login requests." }, "client_protocol": { "description": "The response protocol used to communicate with the default application.", "type": "string", "enum": [ "oidc", "samlp", "wsfed" ] }, "enabled": { "type": "boolean", "description": "When true, enables IdP-initiated login support for this SAML connection. Allows users to log in directly from the identity provider without first visiting Auth0." } }, "unevaluatedProperties": { "not": {} } }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "protocolBinding": { "description": "SAML protocol binding mechanism for sending authentication requests to the identity provider.", "type": "string", "enum": [ "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST", "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" ] }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "signatureAlgorithm": { "description": "Algorithm used to sign SAML authentication requests and logout requests using the connection's signing key. Common values: 'rsa-sha256' (RSA signature with SHA-256 digest) or 'rsa-sha1'. Defaults to 'rsa-sha256'.", "type": "string", "enum": [ "rsa-sha1", "rsa-sha256" ] }, "signInEndpoint": { "description": "Identity provider's SAML SingleSignOnService endpoint URL where Auth0 sends SAML authentication requests. This is the primary login URL for the SAML connection. Required unless using metadataUrl or metadataXml.", "type": "string", "examples": [ "https://idp.example.com/saml/sso" ], "minLength": 8, "maxLength": 2048, "format": "uri" }, "signingCert": { "description": "Base64-encoded X.509 certificate from the identity provider used to validate signatures in SAML responses and assertions. The certificate is decoded and used for cryptographic signature verification.", "type": "string", "examples": [ "MIIDDTCCAfWgAwIBAgIJALFkBP7GVlWkMA0GCSqGSIb3DQEBCwUAMCUxIzAhBgNV" ], "minLength": 1, "maxLength": 10240 }, "signSAMLRequest": { "type": "boolean", "description": "When true, Auth0 signs SAML authentication requests using the connection's signing key. The signature includes the request's digest and is validated by the identity provider. Defaults to false (unsigned requests)." }, "subject": { "description": "Certificate Subject Distinguished Name (DN) extracted from the identity provider's signing certificate.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "tenant_domain": { "description": "For SAML connections, the tenant domain used to construct the login endpoint URL. Can be a string for single-tenant or an array of strings for multi-tenant validation.", "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255 }, "thumbprints": { "type": "array", "items": { "type": "string", "examples": [ "ef34ab56cd78901234567890123456789012efab" ], "minLength": 40, "maxLength": 40 }, "minItems": 0, "maxItems": 1, "description": "SHA-1 thumbprints (fingerprints) of the identity provider's signing certificates. Automatically computed from signingCert during connection creation. Each thumbprint must be a 40-character hexadecimal string." }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "debug": { "type": "boolean", "description": "When true, enables detailed SAML debugging by issuing 'w' (warning) events in tenant logs containing SAML request/response details. WARNING: Potentially exposes sensitive user information (PII, credentials) and should only be enabled temporarily for debugging purposes." }, "deflate": { "type": "boolean", "description": "When true, enables DEFLATE compression for SAML requests sent via HTTP-Redirect binding." }, "destinationUrl": { "type": "string", "examples": [ "https://idp.example.com/saml/sso" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "The URL where Auth0 will send SAML authentication requests (the Identity Provider's SSO URL). Must be a valid HTTPS URL." }, "disableFieldsMapFix": { "type": "boolean", "description": "When true, disables the automatic correction of the fieldsMap configuration to ensure proper mapping of SAML attributes to user profile fields. Defaults to false (fieldsMap fix enabled)." }, "disableSignout": { "type": "boolean", "description": "When true, disables sending SAML logout requests (SingleLogoutService) to the identity provider during user sign-out. The user will be logged out of Auth0 but will remain logged into the identity provider. Defaults to false (federated logout enabled)." }, "discovery_url": { "type": "string", "examples": [ "https://provider.example.com/.well-known/openid-configuration" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the identity provider's OIDC Discovery endpoint (/.well-known/openid-configuration). When provided and oidc_metadata is empty, Auth0 automatically retrieves the provider's configuration including endpoints and supported features. Used with Cross App Access.", "x-release-lifecycle": "EA" }, "fieldsMap": { "description": "Maps SAML assertion attributes from the identity provider to Auth0 user profile attributes. Format: { 'auth0_field': 'saml_attribute' } or { 'auth0_field': ['saml_attr1', 'saml_attr2'] } for fallback options. Merged with default mappings for email, name, given_name, family_name, and groups.", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "fieldsMapJsonRaw": { "type": "string", "minLength": 0, "maxLength": 8192, "description": "Raw JSON string representation of the fieldsMap configuration. Used internally for storage and retrieval of the fieldsMap object." }, "global_token_revocation_jwt_iss": { "type": "string", "minLength": 1, "maxLength": 1024, "description": "Expected 'iss' (Issuer) claim value for JWT tokens in Global Token Revocation requests from the identity provider. When configured, Auth0 validates the JWT issuer matches this value before processing token revocation. Must be used together with global_token_revocation_jwt_sub." }, "global_token_revocation_jwt_sub": { "type": "string", "minLength": 1, "maxLength": 1024, "description": "Expected 'sub' (Subject) claim value for JWT tokens in Global Token Revocation requests from the identity provider. When configured, Auth0 validates the JWT subject matches this value before processing token revocation. Must be used together with global_token_revocation_jwt_iss." }, "metadataUrl": { "type": "string", "examples": [ "https://idp.example.com/saml/metadata" ], "minLength": 8, "maxLength": 2048, "format": "uri", "description": "HTTPS URL to the identity provider's SAML metadata document. When provided, Auth0 automatically fetches and parses the metadata to extract signInEndpoint, signOutEndpoint, signingCert, signSAMLRequest, and protocolBinding. Use metadataUrl OR metadataXml, not both." }, "oidc_metadata": { "description": "OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata. Used with Cross App Access.", "x-release-lifecycle": "EA", "type": "object", "properties": { "acr_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "urn:mace:incommon:iap:silver" ], "maxLength": 100 }, "minItems": 0, "maxItems": 30, "description": "A list of the Authentication Context Class References that this OP supports" }, "authorization_endpoint": { "description": "URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/authorize" ], "minLength": 8, "maxLength": 2083, "format": "uri" }, "claim_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "normal" ], "maxLength": 25 }, "minItems": 0, "maxItems": 10, "description": "JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims." }, "claims_locales_supported": { "type": "array", "items": { "type": "string", "examples": [ "en-US" ], "maxLength": 50 }, "minItems": 0, "maxItems": 100, "description": "Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values." }, "claims_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false." }, "claims_supported": { "type": "array", "items": { "type": "string", "examples": [ "sub" ], "maxLength": 100 }, "minItems": 0, "maxItems": 150, "description": "JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list." }, "code_challenge_methods_supported": { "type": "array", "items": { "type": "string", "examples": [ "S256" ], "maxLength": 20 }, "minItems": 0, "maxItems": 10, "description": "JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636." }, "display_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "page" ], "maxLength": 10 }, "minItems": 0, "maxItems": 6, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used." }, "dpop_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "ES256" ], "maxLength": 14 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing." }, "end_session_endpoint": { "type": "string", "examples": [ "https://provider.example.com/oauth/logout" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme." }, "grant_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "authorization_code" ], "maxLength": 100 }, "minItems": 0, "maxItems": 20, "description": "A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"]." }, "id_token_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RSA-OAEP" ], "maxLength": 14 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT" }, "id_token_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT]." }, "id_token_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10, "description": "JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata)." }, "minItems": 1, "maxItems": 26, "description": "A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518" }, "issuer": { "description": "The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.", "type": "string", "examples": [ "https://accounts.example.com" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "jwks_uri": { "description": "URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.", "type": "string", "examples": [ "https://provider.example.com/.well-known/jwks.json" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "op_policy_uri": { "type": "string", "examples": [ "https://provider.example.com/policy" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given." }, "op_tos_uri": { "type": "string", "examples": [ "https://provider.example.com/terms" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given." }, "registration_endpoint": { "type": "string", "examples": [ "https://provider.example.com/oauth/register" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration" }, "request_object_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RSA-OAEP" ], "maxLength": 28 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference." }, "request_object_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference." }, "request_object_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256." }, "request_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false." }, "request_uri_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false." }, "require_request_uri_registration": { "type": "boolean", "description": "Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false." }, "response_modes_supported": { "type": "array", "items": { "type": "string", "examples": [ "query" ], "maxLength": 20 }, "minItems": 0, "maxItems": 16, "description": "A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]" }, "response_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "code" ], "maxLength": 40 }, "minItems": 1, "maxItems": 40, "description": "A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values" }, "scopes_supported": { "type": "array", "items": { "type": "string", "examples": [ "openid" ], "maxLength": 100 }, "minItems": 0, "maxItems": 7000, "description": "A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED" }, "service_documentation": { "type": "string", "examples": [ "https://provider.example.com/docs" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation." }, "subject_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "public" ], "minLength": 0, "maxLength": 100 }, "minItems": 0, "maxItems": 20, "description": "A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public" }, "token_endpoint": { "description": "URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/token" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "token_endpoint_auth_methods_supported": { "type": "array", "items": { "type": "string", "examples": [ "client_secret_basic" ], "maxLength": 60 }, "minItems": 0, "maxItems": 14, "description": "JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749]." }, "token_endpoint_auth_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 24, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used." }, "ui_locales_supported": { "type": "array", "items": { "type": "string", "examples": [ "en-US" ], "maxLength": 50 }, "minItems": 0, "maxItems": 150, "description": "Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values." }, "userinfo_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]." }, "userinfo_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]." }, "userinfo_endpoint": { "description": "Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.", "type": "string", "examples": [ "https://provider.example.com/oauth/userinfo" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "userinfo_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included." } }, "required": [ "authorization_endpoint", "id_token_signing_alg_values_supported", "issuer", "jwks_uri" ], "unevaluatedProperties": { "not": {} } }, "recipientUrl": { "type": "string", "examples": [ "https://idp.example.com/saml/acs" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "The URL where Auth0 will send SAML authentication requests (the Identity Provider's SSO URL). Must be a valid HTTPS URL." }, "requestTemplate": { "type": "string", "minLength": 1, "maxLength": 10240, "description": "Custom XML template for SAML authentication requests. Supports variable substitution using @@variableName@@ syntax. When not provided, uses default SAML AuthnRequest template. See https://auth0.com/docs/authenticate/protocols/saml/saml-sso-integrations/configure-auth0-saml-service-provider#customize-the-request-template" }, "signOutEndpoint": { "type": "string", "examples": [ "https://idp.example.com/saml/slo" ], "minLength": 8, "maxLength": 2048, "format": "uri", "description": "Identity provider's SAML SingleLogoutService endpoint URL where Auth0 sends logout requests for federated sign-out. When not provided, defaults to signInEndpoint. Only used if disableSignout is false." }, "user_id_attribute": { "type": "string", "minLength": 1, "maxLength": 2396, "description": "Custom SAML assertion attribute to use as the unique user identifier. When provided, this attribute is prepended to the default user_id mapping list with highest priority. Accepts a string (single SAML attribute name)." } }, "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "samlp", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'pingfederate' connection", "type": "object", "properties": { "assertion_decryption_settings": { "description": "Settings for SAML assertion decryption.", "type": "object", "properties": { "algorithm_exceptions": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 100 }, "maxItems": 10, "description": "A list of insecure algorithms to allow for SAML assertion decryption." }, "algorithm_profile": { "description": "The algorithm profile to use for decrypting SAML assertions.", "type": "string", "enum": [ "v2026-1" ] } }, "required": [ "algorithm_profile" ], "unevaluatedProperties": { "not": {} } }, "cert": { "type": "string", "minLength": 1, "maxLength": 10240, "description": "X.509 signing certificate from the identity provider in .der format. Used to validate signatures in SAML Responses and Assertions. This is an alternative to signingCert and is kept for backward compatibility. Prefer using signingCert instead.", "deprecated": true }, "cert_rollover_notification": { "type": "string", "format": "date-time", "description": "Timestamp of the last certificate expiring soon notification." }, "digestAlgorithm": { "description": "Algorithm used for computing digest values when signing SAML requests and logout requests. Defaults to 'sha256'.", "type": "string", "enum": [ "sha1", "sha256" ] }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 50001, "description": "Domain aliases for the connection" }, "entityId": { "description": "The entity identifier (Issuer) for the SAML Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'. This value is included in SAML AuthnRequest messages sent to the identity provider.", "type": "string", "examples": [ "urn:auth0:my-tenant:my-connection" ], "minLength": 1, "maxLength": 128 }, "expires": { "type": "string", "format": "date-time", "description": "ISO 8601 formatted datetime indicating when the identity provider's signing certificate expires." }, "icon_url": { "description": "URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "idpinitiated": { "description": "Configuration for IdP-Initiated SAML Single Sign-On. When enabled, allows users to initiate login directly from their SAML identity provider without first visiting Auth0. The IdP must include the connection parameter in the post-back URL (Assertion Consumer Service URL).", "type": "object", "properties": { "client_authorizequery": { "type": "string", "minLength": 1, "maxLength": 2048, "description": "The query string sent to the default application" }, "client_id": { "type": "string", "minLength": 1, "maxLength": 256, "description": "The client ID to use for IdP-initiated login requests." }, "client_protocol": { "description": "The response protocol used to communicate with the default application.", "type": "string", "enum": [ "oidc", "samlp", "wsfed" ] }, "enabled": { "type": "boolean", "description": "When true, enables IdP-initiated login support for this SAML connection. Allows users to log in directly from the identity provider without first visiting Auth0." } }, "unevaluatedProperties": { "not": {} } }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "protocolBinding": { "description": "SAML protocol binding mechanism for sending authentication requests to the identity provider.", "type": "string", "enum": [ "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST", "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" ] }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "signatureAlgorithm": { "description": "Algorithm used to sign SAML authentication requests and logout requests using the connection's signing key. Common values: 'rsa-sha256' (RSA signature with SHA-256 digest) or 'rsa-sha1'. Defaults to 'rsa-sha256'.", "type": "string", "enum": [ "rsa-sha1", "rsa-sha256" ] }, "signInEndpoint": { "description": "Identity provider's SAML SingleSignOnService endpoint URL where Auth0 sends SAML authentication requests. This is the primary login URL for the SAML connection. Required unless using metadataUrl or metadataXml.", "type": "string", "examples": [ "https://idp.example.com/saml/sso" ], "minLength": 8, "maxLength": 2048, "format": "uri" }, "signingCert": { "description": "Base64-encoded X.509 certificate from the identity provider used to validate signatures in SAML responses and assertions. The certificate is decoded and used for cryptographic signature verification.", "type": "string", "examples": [ "MIIDDTCCAfWgAwIBAgIJALFkBP7GVlWkMA0GCSqGSIb3DQEBCwUAMCUxIzAhBgNV" ], "minLength": 1, "maxLength": 10240 }, "signSAMLRequest": { "type": "boolean", "description": "When true, Auth0 signs SAML authentication requests using the connection's signing key. The signature includes the request's digest and is validated by the identity provider. Defaults to false (unsigned requests)." }, "subject": { "description": "Certificate Subject Distinguished Name (DN) extracted from the identity provider's signing certificate.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "tenant_domain": { "description": "For SAML connections, the tenant domain used to construct the login endpoint URL. Can be a string for single-tenant or an array of strings for multi-tenant validation.", "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255 }, "thumbprints": { "type": "array", "items": { "type": "string", "examples": [ "ef34ab56cd78901234567890123456789012efab" ], "minLength": 40, "maxLength": 40 }, "minItems": 0, "maxItems": 1, "description": "SHA-1 thumbprints (fingerprints) of the identity provider's signing certificates. Automatically computed from signingCert during connection creation. Each thumbprint must be a 40-character hexadecimal string." }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "pingFederateBaseUrl": { "type": "string", "examples": [ "https://pingfederate.example.com" ], "minLength": 8, "maxLength": 256, "format": "uri", "description": "URL provided by PingFederate which returns information used for creating the connection" } }, "required": [ "pingFederateBaseUrl" ], "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "pingfederate", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'adfs' connection", "type": "object", "properties": { "adfs_server": { "type": "string", "examples": [ "adfs.example.com" ], "minLength": 0, "maxLength": 2048, "description": "ADFS federation metadata host or XML URL used to discover WS-Fed endpoints and certificates. Errors if adfs_server and fedMetadataXml are both absent." }, "cert_rollover_notification": { "type": "string", "format": "date-time", "description": "Timestamp of the last certificate expiring soon notification." }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 1000, "description": "Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication." }, "entityId": { "description": "The entity identifier (Issuer) for the ADFS Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'.", "type": "string", "examples": [ "urn:auth0:my-tenant:my-connection" ], "minLength": 1, "maxLength": 128 }, "fedMetadataXml": { "type": "string", "minLength": 1, "maxLength": 102400, "description": "Inline XML alternative to 'adfs_server'. Cannot be set together with 'adfs_server'." }, "icon_url": { "description": "URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "prev_thumbprints": { "type": "array", "items": { "type": "string", "examples": [ "AB12CD34EF56789012345678901234567890ABCD" ], "minLength": 0, "maxLength": 64, "description": "Certificate thumbprints for ADFS and Azure AD connections." }, "minItems": 0, "maxItems": 20, "description": "Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string." }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "should_trust_email_verified_connection": { "description": "Choose how Auth0 sets the email_verified field in the user profile.", "type": "string", "enum": [ "never_set_emails_as_verified", "always_set_emails_as_verified" ] }, "signInEndpoint": { "description": "Passive Requestor (WS-Fed) sign-in endpoint discovered from metadata or provided explicitly.", "type": "string", "examples": [ "https://idp.example.com/saml/sso" ], "minLength": 8, "maxLength": 2048, "format": "uri" }, "tenant_domain": { "description": "Tenant domain", "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255 }, "thumbprints": { "type": "array", "items": { "type": "string", "examples": [ "AB12CD34EF56789012345678901234567890ABCD" ], "minLength": 0, "maxLength": 64, "description": "Certificate thumbprints for ADFS and Azure AD connections." }, "minItems": 0, "maxItems": 20, "description": "Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string." }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "user_id_attribute": { "type": "string", "minLength": 1, "maxLength": 128, "description": "Custom ADFS claim to use as the unique user identifier. When provided, this attribute is prepended to the default user_id mapping list with highest priority. Accepts a string (single ADFS claim name)." } }, "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "adfs", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'ad' connection", "type": "object", "properties": { "agentIP": { "description": "IP address of the AD connector agent used to validate that authentication requests originate from the corporate network for Kerberos authentication (managed by the AD Connector agent).", "type": "string", "examples": [ "192.168.1.10" ], "minLength": 2, "maxLength": 39 }, "agentMode": { "type": "boolean", "description": "When enabled, allows direct username/password authentication through the AD connector agent instead of WS-Federation protocol (managed by the AD Connector agent)." }, "agentVersion": { "type": "string", "examples": [ "1.4.2" ], "minLength": 5, "maxLength": 12, "description": "Version identifier of the installed AD connector agent software (managed by the AD Connector agent)." }, "brute_force_protection": { "type": "boolean", "description": "Enables Auth0's brute force protection to prevent credential stuffing attacks. When enabled, blocks suspicious login attempts from specific IP addresses after repeated failures." }, "certAuth": { "type": "boolean", "description": "Enables client SSL certificate authentication for the AD connector, requiring HTTPS on the sign-in endpoint" }, "certs": { "type": "array", "items": { "type": "string", "examples": [ "MIIDDTCCAfWgAwIBAgIJALFkBP7GVlWkMA0GCSqGSIb3DQEBCwUAMCUxIzAhBgNVBAMTGmV4YW1wbGUuYXV0aDAuY29tIENlcnQgQ0EwHhcNMjUwMTAxMDAwMDAwWhcNMjYwMTAxMDAwMDAwWjAUMRIwEAYDVQQDEwlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC7o4qne60TB3wolFrzabc1234567890ABCDEFG" ], "minLength": 256, "maxLength": 3072 }, "minItems": 0, "maxItems": 2, "description": "Array of X.509 certificates in PEM format used for validating SAML signatures from the AD identity provider (managed by the AD Connector agent)." }, "disable_cache": { "type": "boolean", "description": "When enabled, disables caching of AD connector authentication results to ensure real-time validation against the directory" }, "disable_self_service_change_password": { "type": "boolean", "description": "When enabled, hides the 'Forgot Password' link on login pages to prevent users from initiating self-service password resets" }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 1000, "description": "List of domain names that can be used with identifier-first authentication flow to route users to this AD connection; each domain must be a valid DNS name up to 256 characters" }, "icon_url": { "description": "https url of the icon to be shown", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "ips": { "type": "array", "items": { "type": "string", "examples": [ "192.168.1.10" ], "minLength": 2, "maxLength": 39 }, "minItems": 0, "maxItems": 256, "description": "Array of IP address ranges in CIDR notation used to determine if authentication requests originate from the corporate network for Kerberos or certificate authentication." }, "kerberos": { "type": "boolean", "description": "Enables Windows Integrated Authentication (Kerberos) for seamless SSO when users authenticate from within the corporate network IP ranges" }, "kerberos_only": { "type": "boolean", "description": "When true, restricts the connection to Kerberos-only authentication, disallowing username/password fallback." }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "signInEndpoint": { "type": "string", "examples": [ "https://ad-connector.example.com" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "The sign-in endpoint type for the AD-LDAP connector agent (managed by the AD Connector agent)." }, "tenant_domain": { "type": "string", "examples": [ "corp.example.com" ], "minLength": 1, "maxLength": 512, "format": "hostname", "description": "Primary AD domain hint used for HRD and discovery." }, "thumbprints": { "type": "array", "items": { "type": "string", "examples": [ "8233ec9c12a44625d4a64ee413651fd928b5168f" ], "minLength": 40, "maxLength": 40 }, "minItems": 0, "maxItems": 2, "description": "Array of certificate SHA-1 thumbprints for validating signatures. Managed by Auth0 when using the AD Connector agent." }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} } }, "unevaluatedProperties": { "not": {} } }, "strategy": { "type": "string", "const": "ad", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'google-apps' connection", "type": "object", "properties": { "admin_access_token_expiresin": { "type": "string", "format": "date-time", "description": "Expiration timestamp for the `admin_access_token` in ISO 8601 format. Auth0 uses this value to determine when to refresh the token." }, "allow_setting_login_scopes": { "type": "boolean", "description": "When true, allows customization of OAuth scopes requested during user login. Custom scopes are appended to the mandatory email and profile scopes. When false or omitted, only the default email and profile scopes are used. This property is automatically enabled when Token Vault or Connected Accounts features are activated." }, "api_enable_groups": { "type": "boolean", "description": "Enables integration with the Google Workspace Admin SDK Directory API for groups. When true, Auth0 can synchronize groups & group memberships and supports inbound directory provisioning for groups. Defaults to false." }, "api_enable_users": { "type": "boolean", "description": "Enables integration with the Google Workspace Admin SDK Directory API. When true, Auth0 can retrieve extended user attributes (admin status, suspension status, group memberships) and supports inbound directory provisioning (SCIM). Defaults to true." }, "client_id": { "type": "string", "examples": [ "123456789-abc123def456.apps.googleusercontent.com" ], "minLength": 1, "maxLength": 128, "description": "Your Google OAuth 2.0 client ID. You can find this in your [Google Cloud Console](https://console.cloud.google.com/apis/credentials) under the OAuth 2.0 Client IDs section." }, "domain": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 1024, "description": "Primary Google Workspace domain name that users must belong to." }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 1000, "description": "Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication." }, "email": { "type": "boolean", "description": "Whether the OAuth flow requests the `email` scope." }, "ext_agreed_terms": { "type": "boolean", "description": "Fetches the `agreedToTerms` flag from the Google Directory profile." }, "ext_groups": { "type": "boolean", "description": "Enables enrichment with Google group memberships (required for `ext_groups_extended`)." }, "ext_groups_extended": { "type": "boolean", "description": "Controls whether enriched group entries include `id`, `email`, `name` (true) or only the group name (false); can only be set when `ext_groups` is true." }, "ext_is_admin": { "type": "boolean", "description": "Fetches the Google Directory admin flag for the signing-in user." }, "ext_is_suspended": { "type": "boolean", "description": "Fetches the Google Directory suspended flag for the signing-in user." }, "federated_connections_access_tokens": { "description": "Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.", "type": "object", "properties": { "active": { "type": "boolean", "description": "Enables refresh tokens and access tokens collection for federated connections" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "handle_login_from_social": { "type": "boolean", "description": "When enabled, users who sign in with their Google account through a social login will be automatically routed to this Google Workspace connection if their email domain matches the configured tenant_domain or domain_aliases. This ensures enterprise users authenticate through their organization's Google Workspace identity provider rather than through a generic Google social login, enabling access to directory-based attributes and enforcing organizational security policies. Defaults to true for new connections." }, "icon_url": { "description": "URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "map_user_id_to_id": { "type": "boolean", "description": "Determines how Auth0 generates the user_id for Google Workspace users. When false (default), the user's email address is used. When true, Google's stable numeric user ID is used instead, which persists even if the user's email changes. This setting can only be configured when creating the connection and cannot be changed afterward." }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "profile": { "type": "boolean", "description": "Whether the OAuth flow requests the `profile` scope." }, "scope": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 255 }, "minItems": 1, "maxItems": 64, "description": "Additional OAuth scopes requested beyond the default `email profile` scopes; ignored unless `allow_setting_login_scopes` is true." }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "tenant_domain": { "description": "The Google Workspace primary domain used to identify the organization during authentication.", "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255 }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} } }, "required": [ "client_id" ], "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "google-apps", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'waad' connection", "type": "object", "properties": { "api_enable_users": { "type": "boolean", "description": "Enable users API" }, "app_domain": { "type": "string", "examples": [ "contoso.onmicrosoft.com" ], "minLength": 0, "maxLength": 255, "description": "The Azure AD application domain (e.g., 'contoso.onmicrosoft.com'). Used primarily with WS-Federation protocol and Azure AD v1 endpoints." }, "app_id": { "type": "string", "examples": [ "api://contoso-azure-app" ], "minLength": 0, "maxLength": 500, "description": "The Application ID URI (App ID URI) for the Azure AD application. Required when using Azure AD v1 with the Resource Owner Password flow. Used to identify the resource being requested in OAuth token requests." }, "basic_profile": { "type": "boolean", "description": "Includes basic user profile information from Azure AD (name, email, given_name, family_name). Always enabled and required - represents the minimum profile data retrieved during authentication." }, "cert_rollover_notification": { "type": "string", "format": "date-time", "description": "Timestamp of the last certificate expiring soon notification." }, "client_id": { "type": "string", "examples": [ "12345678-1234-1234-1234-123456789012" ], "minLength": 0, "maxLength": 100, "description": "OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider." }, "domain": { "type": "string", "examples": [ "contoso.onmicrosoft.com" ], "minLength": 0, "maxLength": 512, "description": "The primary Azure AD tenant domain (e.g., 'contoso.onmicrosoft.com' or 'contoso.com')." }, "domain_aliases": { "type": "array", "items": { "type": "string", "minLength": 0, "maxLength": 255 }, "minItems": 0, "maxItems": 1000, "description": "Alternative domain names associated with this Azure AD tenant. Allows users from multiple verified domains to authenticate through this connection. Can be an array of domain strings." }, "ext_groups": { "type": "boolean", "description": "When enabled (true), retrieves and stores Azure AD security group memberships for the user. Requires Microsoft Graph API permissions (Directory.Read.All). Allows configuring max_groups_to_retrieve." }, "ext_nested_groups": { "type": "boolean", "description": "When true, stores all groups the user is member of, including transitive group memberships (groups within groups). When false (default), only direct group memberships are included." }, "ext_profile": { "type": "boolean", "description": "When enabled (true), retrieves extended profile attributes from Azure AD via Microsoft Graph API (job title, department, office location, etc.). Requires Graph API permissions. Only available with Azure AD v1 or when explicitly enabled for v2." }, "federated_connections_access_tokens": { "description": "Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.", "type": "object", "properties": { "active": { "type": "boolean", "description": "Enables refresh tokens and access tokens collection for federated connections" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "granted": { "type": "boolean", "description": "Indicates whether admin consent has been granted for the required Azure AD permissions. Read-only status field managed by Auth0 during the OAuth authorization flow." }, "icon_url": { "description": "URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "identity_api": { "description": "The Azure AD endpoint version for authentication. 'microsoft-identity-platform-v2.0' (recommended, default) supports modern OAuth 2.0 features. 'azure-active-directory-v1.0' is the legacy endpoint with protocol limitations. Selection affects available features.", "type": "string", "enum": [ "microsoft-identity-platform-v2.0", "azure-active-directory-v1.0" ] }, "max_groups_to_retrieve": { "type": "string", "examples": [ "100" ], "minLength": 0, "maxLength": 10, "description": "Maximum number of Azure AD groups to retrieve per user during authentication. Helps prevent performance issues for users in many groups. Only applies when ext_groups is enabled. Leave empty to use platform default." }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "scope": { "type": "array", "items": { "type": "string", "minLength": 0, "maxLength": 100 }, "minItems": 0, "maxItems": 100, "description": "OAuth 2.0 scopes to request from Azure AD during authentication. Each scope represents a permission (e.g., 'User.Read', 'Group.Read.All'). Only applies with Microsoft Identity Platform v2.0. See Microsoft Graph permissions reference for available scopes." }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "should_trust_email_verified_connection": { "description": "Choose how Auth0 sets the email_verified field in the user profile.", "type": "string", "enum": [ "never_set_emails_as_verified", "always_set_emails_as_verified" ] }, "tenant_domain": { "anyOf": [ { "type": "string", "examples": [ "contoso.onmicrosoft.com" ], "minLength": 0, "maxLength": 512, "format": "hostname", "description": "Azure AD tenant domain as a hostname (e.g. contoso.onmicrosoft.com)." }, { "type": "string", "format": "uuid", "description": "Azure AD tenant domain as a UUID tenant ID." } ], "description": "The Azure AD tenant domain or tenant ID (UUID). Auto-populated from the 'domain' field. Can be either a hostname (e.g., 'contoso.onmicrosoft.com') or a UUID tenant ID." }, "tenantId": { "type": "string", "examples": [ "12345678-1234-1234-1234-123456789012" ], "minLength": 36, "maxLength": 36, "format": "uuid", "description": "The Azure AD tenant ID as a UUID. The unique identifier for your Azure AD organization. Must be a valid 36-character UUID." }, "thumbprints": { "type": "array", "items": { "type": "string", "examples": [ "AB12CD34EF56789012345678901234567890ABCD" ], "minLength": 0, "maxLength": 64, "description": "Certificate thumbprints for ADFS and Azure AD connections." }, "minItems": 0, "maxItems": 20, "description": "Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string." }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "use_wsfed": { "type": "boolean", "description": "Indicates WS-Federation protocol usage. When true, uses WS-Federation; when false, uses OpenID Connect." }, "useCommonEndpoint": { "type": "boolean", "description": "When enabled (true), uses the Azure AD common endpoint for multi-tenant authentication. Allows users from any Azure AD organization to sign in. Requires userid_attribute set to 'sub' (not 'oid'). Cannot be used with SCIM provisioning. Defaults to false." }, "userid_attribute": { "description": "The Azure AD claim to use as the unique user identifier. 'oid' (Object ID) is recommended for single-tenant connections and required for SCIM. 'sub' (Subject) is required for multi-tenant/common endpoint. Only applies with OpenID Connect protocol.", "type": "string", "enum": [ "oid", "sub" ] }, "waad_protocol": { "description": "The authentication protocol for Azure AD v1 endpoints. 'openid-connect' (default, recommended) uses modern OAuth 2.0/OIDC. 'ws-federation' is a legacy SAML-based protocol for older integrations. Only available with Azure AD v1 API.", "type": "string", "enum": [ "ws-federation", "openid-connect" ] } }, "required": [ "client_id" ], "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "waad", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" } ] }, "context": { "description": "Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.", "type": "object", "properties": { "client": { "type": "object", "properties": { "id": { "description": "The client identifier.", "type": "string", "examples": [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] }, "name": { "type": "string", "description": "The client name." }, "metadata": { "description": "Client metadata.", "type": "object", "properties": {}, "unevaluatedProperties": {} } }, "required": [ "id", "name", "metadata" ], "unevaluatedProperties": { "not": {} }, "description": "The OAuth Client requesting or presenting an access token.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "connection": { "type": "object", "properties": { "id": { "description": "The ID of the connection.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "name": { "description": "The name of the connection.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "strategy": { "type": "string", "description": "The auth strategy implemented by the connection." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "description": "The Auth0 Connection used for the authentication transaction that generated the event.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "request": { "type": "object", "properties": { "geo": { "description": "Geographic information about the request origin.", "type": "object", "properties": { "continent_code": { "type": "string", "description": "Continent code." }, "country_code": { "type": "string", "description": "Country code." }, "country_name": { "type": "string", "description": "Country name." }, "latitude": { "type": "number", "description": "Latitude coordinate." }, "longitude": { "type": "number", "description": "Longitude coordinate." }, "subdivision_code": { "type": "string", "description": "Subdivision (state/province) code." }, "subdivision_name": { "type": "string", "description": "Subdivision (state/province) name." }, "city_name": { "type": "string", "description": "City name." }, "time_zone": { "type": "string", "description": "Time zone." } }, "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "hostname": { "type": "string", "description": "The hostname the request is for." }, "custom_domain": { "type": "string", "description": "The custom domain used in the request (if any)." }, "ip": { "type": "string", "description": "The originating IP address of the request." }, "method": { "type": "string", "description": "The HTTP method used for the request." }, "user_agent": { "type": "string", "description": "The value of the `User-Agent` header." } }, "required": [ "geo", "hostname", "ip", "method", "user_agent" ], "unevaluatedProperties": { "not": {} }, "description": "An HTTP request.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "tenant": { "type": "object", "properties": { "id": { "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]", "description": "User-provided tenant identifier." } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a tenant in event context" }, "transaction": { "type": "object", "properties": { "acr_values": { "type": "array", "items": { "type": "string" }, "description": "acr_values in the request." }, "locale": { "type": "string", "description": "The locale used for this transaction." }, "login_hint": { "type": "string", "description": "Hint about the login identifier the user might use in this transaction." }, "prompt": { "type": "array", "items": { "type": "string" }, "description": "Instructions indicating whether the user may be prompted for re-authentication and consent." }, "protocol": { "description": "The protocol used for this transaction.", "type": "string", "enum": [ "oidc-basic-profile", "oidc-implicit-profile", "oauth2-device-code", "oauth2-resource-owner", "oauth2-resource-owner-jwt-bearer", "oauth2-password", "oauth2-webauthn", "oauth2-access-token", "oauth2-refresh-token", "oauth2-token-exchange", "oidc-hybrid-profile", "samlp", "wsfed", "wstrust-usernamemixed" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "redirect_uri": { "type": "string", "description": "The URL to which the client will be redirected when the transaction completes." }, "requested_scopes": { "type": "array", "items": { "type": "string" }, "description": "The scopes requested." }, "response_mode": { "description": "This transaction's method for returning parameters from the Authorization Endpoint.", "type": "string", "enum": [ "query", "fragment", "form_post", "web_message" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "response_type": { "type": "array", "items": { "type": "string", "enum": [ "code", "token", "id_token" ], "description": "OAuth/OIDC response types.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "description": "The kind of credential issued by this transaction." }, "state": { "type": "string", "description": "The OAuth state parameter for this transaction." }, "ui_locales": { "type": "array", "items": { "type": "string" }, "description": "The ui_locales requested for this transaction." } }, "required": [ "acr_values", "locale", "requested_scopes", "ui_locales" ], "unevaluatedProperties": { "not": {} }, "description": "An auth transaction.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "tenant" ], "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "object" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "platform-streaming-foundations" }, "a0tenant": { "description": "The auth0 tenant ID to which the event is associated.", "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]" }, "a0stream": { "description": "The auth0 event stream ID of the stream the event was delivered on.\nPresent when the event is delivered via an event stream; omitted when\nevents are retrieved via the Events API (GET /api/v2/events).", "type": "string", "examples": [ "est_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "est_[a-zA-Z0-9]{22}" } }, "required": [ "specversion", "type", "source", "id", "time", "data", "a0tenant" ], "unevaluatedProperties": { "not": {} }, "description": "Represents an event that occurs when a connection is deleted.", "x-release-lifecycle": "EA", "x-auth0-owner": "iam-login", "x-auth0-event-category": "connection", "example": { "specversion": "1.0", "type": "connection.deleted", "source": "urn:auth0:example.auth0app.com", "id": "evt_vjFVP5pVdfvsfRKatshkVV", "time": "2025-02-01T12:34:56Z", "data": { "object": { "authentication": { "active": false }, "display_name": "My Enterprise Connection", "enabled_clients": [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ], "id": "con_kFOHQUeaCSC1Kjqz", "is_domain_connection": false, "metadata": {}, "name": "Username-Password-Authentication", "realms": [ "example.com" ], "connected_accounts": { "active": false, "cross_app_access": false }, "options": { "authorization_endpoint": "https://provider.example.com/oauth/authorize", "client_id": "abc123def456ghi789", "connection_settings": { "pkce": "auto" }, "domain_aliases": [ "example.com" ], "dpop_signing_alg": "ES256", "federated_connections_access_tokens": { "active": false }, "icon_url": "https://example.com/logo.png", "id_token_session_expiry_supported": false, "id_token_signed_response_algs": [ "ES256" ], "issuer": "https://accounts.example.com", "jwks_uri": "https://provider.example.com/.well-known/jwks.json", "non_persistent_attrs": [ "ethnicity" ], "oidc_metadata": { "acr_values_supported": [ "urn:mace:incommon:iap:silver" ], "authorization_endpoint": "https://provider.example.com/oauth/authorize", "claim_types_supported": [ "normal" ], "claims_locales_supported": [ "en-US" ], "claims_parameter_supported": false, "claims_supported": [ "sub" ], "code_challenge_methods_supported": [ "S256" ], "display_values_supported": [ "page" ], "dpop_signing_alg_values_supported": [ "ES256" ], "end_session_endpoint": "https://provider.example.com/oauth/logout", "grant_types_supported": [ "authorization_code" ], "id_token_encryption_alg_values_supported": [ "RSA-OAEP" ], "id_token_encryption_enc_values_supported": [ "A128CBC-HS256" ], "id_token_signing_alg_values_supported": [ "RS256" ], "issuer": "https://accounts.example.com", "jwks_uri": "https://provider.example.com/.well-known/jwks.json", "op_policy_uri": "https://provider.example.com/policy", "op_tos_uri": "https://provider.example.com/terms", "registration_endpoint": "https://provider.example.com/oauth/register", "request_object_encryption_alg_values_supported": [ "RSA-OAEP" ], "request_object_encryption_enc_values_supported": [ "A128CBC-HS256" ], "request_object_signing_alg_values_supported": [ "RS256" ], "request_parameter_supported": false, "request_uri_parameter_supported": false, "require_request_uri_registration": false, "response_modes_supported": [ "query" ], "response_types_supported": [ "code" ], "scopes_supported": [ "openid" ], "service_documentation": "https://provider.example.com/docs", "subject_types_supported": [ "public" ], "token_endpoint": "https://provider.example.com/oauth/token", "token_endpoint_auth_methods_supported": [ "client_secret_basic" ], "token_endpoint_auth_signing_alg_values_supported": [ "RS256" ], "ui_locales_supported": [ "en-US" ], "userinfo_encryption_alg_values_supported": [ "RS256" ], "userinfo_encryption_enc_values_supported": [ "A128CBC-HS256" ], "userinfo_endpoint": "https://provider.example.com/oauth/userinfo", "userinfo_signing_alg_values_supported": [ "RS256" ] }, "schema_version": "openid-1.0.0", "scope": "openid profile email", "send_back_channel_nonce": false, "set_user_root_attributes": "on_each_login", "tenant_domain": "example.com", "token_endpoint": "https://provider.example.com/oauth/token", "token_endpoint_auth_method": "client_secret_post", "token_endpoint_auth_signing_alg": "ES256", "token_endpoint_jwtca_aud_format": "issuer", "upstream_params": {}, "useOauthSpecScope": false, "userinfo_endpoint": "https://provider.example.com/oauth/userinfo", "attribute_map": { "attributes": {}, "userinfo_scope": "openid profile email", "mapping_mode": "bind_all" }, "discovery_url": "https://provider.example.com/.well-known/openid-configuration", "type": "back_channel" }, "show_as_button": false, "strategy": "oidc" }, "previous_object": { "authentication": { "active": false }, "display_name": "My Enterprise Connection", "enabled_clients": [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ], "id": "con_kFOHQUeaCSC1Kjqz", "is_domain_connection": false, "metadata": {}, "name": "Username-Password-Authentication", "realms": [ "example.com" ], "connected_accounts": { "active": false, "cross_app_access": false }, "options": { "authorization_endpoint": "https://provider.example.com/oauth/authorize", "client_id": "abc123def456ghi789", "connection_settings": { "pkce": "auto" }, "domain_aliases": [ "example.com" ], "dpop_signing_alg": "ES256", "federated_connections_access_tokens": { "active": false }, "icon_url": "https://example.com/logo.png", "id_token_session_expiry_supported": false, "id_token_signed_response_algs": [ "ES256" ], "issuer": "https://accounts.example.com", "jwks_uri": "https://provider.example.com/.well-known/jwks.json", "non_persistent_attrs": [ "ethnicity" ], "oidc_metadata": { "acr_values_supported": [ "urn:mace:incommon:iap:silver" ], "authorization_endpoint": "https://provider.example.com/oauth/authorize", "claim_types_supported": [ "normal" ], "claims_locales_supported": [ "en-US" ], "claims_parameter_supported": false, "claims_supported": [ "sub" ], "code_challenge_methods_supported": [ "S256" ], "display_values_supported": [ "page" ], "dpop_signing_alg_values_supported": [ "ES256" ], "end_session_endpoint": "https://provider.example.com/oauth/logout", "grant_types_supported": [ "authorization_code" ], "id_token_encryption_alg_values_supported": [ "RSA-OAEP" ], "id_token_encryption_enc_values_supported": [ "A128CBC-HS256" ], "id_token_signing_alg_values_supported": [ "RS256" ], "issuer": "https://accounts.example.com", "jwks_uri": "https://provider.example.com/.well-known/jwks.json", "op_policy_uri": "https://provider.example.com/policy", "op_tos_uri": "https://provider.example.com/terms", "registration_endpoint": "https://provider.example.com/oauth/register", "request_object_encryption_alg_values_supported": [ "RSA-OAEP" ], "request_object_encryption_enc_values_supported": [ "A128CBC-HS256" ], "request_object_signing_alg_values_supported": [ "RS256" ], "request_parameter_supported": false, "request_uri_parameter_supported": false, "require_request_uri_registration": false, "response_modes_supported": [ "query" ], "response_types_supported": [ "code" ], "scopes_supported": [ "openid" ], "service_documentation": "https://provider.example.com/docs", "subject_types_supported": [ "public" ], "token_endpoint": "https://provider.example.com/oauth/token", "token_endpoint_auth_methods_supported": [ "client_secret_basic" ], "token_endpoint_auth_signing_alg_values_supported": [ "RS256" ], "ui_locales_supported": [ "en-US" ], "userinfo_encryption_alg_values_supported": [ "RS256" ], "userinfo_encryption_enc_values_supported": [ "A128CBC-HS256" ], "userinfo_endpoint": "https://provider.example.com/oauth/userinfo", "userinfo_signing_alg_values_supported": [ "RS256" ] }, "schema_version": "openid-1.0.0", "scope": "openid profile email", "send_back_channel_nonce": false, "set_user_root_attributes": "on_each_login", "tenant_domain": "example.com", "token_endpoint": "https://provider.example.com/oauth/token", "token_endpoint_auth_method": "client_secret_post", "token_endpoint_auth_signing_alg": "ES256", "token_endpoint_jwtca_aud_format": "issuer", "upstream_params": {}, "useOauthSpecScope": false, "userinfo_endpoint": "https://provider.example.com/oauth/userinfo", "attribute_map": { "attributes": {}, "userinfo_scope": "openid profile email", "mapping_mode": "bind_all" }, "discovery_url": "https://provider.example.com/.well-known/openid-configuration", "type": "back_channel" }, "show_as_button": false, "strategy": "oidc" }, "context": { "client": { "id": "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc", "name": "sample", "metadata": {} }, "connection": { "id": "con_kFOHQUeaCSC1Kjqz", "name": "Username-Password-Authentication", "strategy": "sample" }, "request": { "geo": { "continent_code": "sample", "country_code": "sample", "country_name": "sample", "latitude": 3.14, "longitude": 3.14, "subdivision_code": "sample", "subdivision_name": "sample", "city_name": "sample", "time_zone": "sample" }, "hostname": "sample", "custom_domain": "sample", "ip": "sample", "method": "sample", "user_agent": "sample" }, "tenant": { "id": "my-tenant" }, "transaction": { "acr_values": [ "sample" ], "locale": "sample", "login_hint": "sample", "prompt": [ "sample" ], "protocol": "oidc-basic-profile", "redirect_uri": "sample", "requested_scopes": [ "sample" ], "response_mode": "query", "response_type": [ "code" ], "state": "sample", "ui_locales": [ "sample" ] } } }, "a0tenant": "my-tenant", "a0stream": "est_vjFVP5pVdfvsfRKatshkVV" } }, "connection.updated": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "connection.updated", "type": "object", "properties": { "specversion": { "description": "The version of the CloudEvents specification which the event uses.", "type": "string", "enum": [ "1.0" ], "x-auth0-owner": "platform-streaming-foundations" }, "type": { "type": "string", "const": "connection.updated", "description": "The type of the event which has happened." }, "source": { "type": "string", "examples": [ "urn:auth0:example.auth0app.com" ], "description": "The source of the event. This will take the form 'urn:auth0:.'." }, "id": { "description": "A unique identifier for the event.", "type": "string", "examples": [ "evt_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "evt_[a-zA-Z0-9]{22}" }, "time": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "An ISO-8601 timestamp indicating when the event physically occurred." }, "data": { "description": "The event payload.", "type": "object", "properties": { "object": { "description": "The event content.", "oneOf": [ { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" }, "cross_app_access": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "options": { "description": "Options for the 'oidc' connection", "type": "object", "properties": { "authorization_endpoint": { "description": "URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/authorize" ], "minLength": 8, "maxLength": 2083, "format": "uri" }, "client_id": { "type": "string", "examples": [ "abc123def456ghi789" ], "minLength": 0, "maxLength": 255, "description": "OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider." }, "connection_settings": { "description": "OAuth 2.0 PKCE (Proof Key for Code Exchange) settings. PKCE enhances security for public clients by preventing authorization code interception attacks. 'auto' (recommended) uses the strongest method supported by the IdP.", "type": "object", "properties": { "pkce": { "description": "PKCE configuration.", "type": "string", "enum": [ "auto", "S256", "plain", "disabled" ] } }, "unevaluatedProperties": { "not": {} } }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 1000, "description": "Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication." }, "dpop_signing_alg": { "description": "Algorithm used for DPoP proof JWT signing. Applicable when strategy=oidc or okta.", "type": "string", "enum": [ "ES256", "ES384", "ES512", "Ed25519" ] }, "federated_connections_access_tokens": { "description": "Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.", "type": "object", "properties": { "active": { "type": "boolean", "description": "Enables refresh tokens and access tokens collection for federated connections" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "icon_url": { "description": "https url of the icon to be shown", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "id_token_session_expiry_supported": { "type": "boolean", "description": "Indicates whether the identity provider supports session expiry via the id_token. If true, the system will use the session_expiry claim in the id_token to determine session expiry." }, "id_token_signed_response_algs": { "type": "array", "items": { "type": "string", "enum": [ "ES256", "ES384", "PS256", "PS384", "RS256", "RS384", "RS512" ], "description": "Algorithm allowed to verify the ID tokens." }, "description": "List of algorithms allowed to verify the ID tokens. Applicable when strategy=oidc or okta." }, "issuer": { "description": "The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.", "type": "string", "examples": [ "https://accounts.example.com" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "jwks_uri": { "description": "URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.", "type": "string", "examples": [ "https://provider.example.com/.well-known/jwks.json" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "oidc_metadata": { "description": "OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata", "type": "object", "properties": { "acr_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "urn:mace:incommon:iap:silver" ], "maxLength": 100 }, "minItems": 0, "maxItems": 30, "description": "A list of the Authentication Context Class References that this OP supports" }, "authorization_endpoint": { "description": "URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/authorize" ], "minLength": 8, "maxLength": 2083, "format": "uri" }, "claim_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "normal" ], "maxLength": 25 }, "minItems": 0, "maxItems": 10, "description": "JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims." }, "claims_locales_supported": { "type": "array", "items": { "type": "string", "examples": [ "en-US" ], "maxLength": 50 }, "minItems": 0, "maxItems": 100, "description": "Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values." }, "claims_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false." }, "claims_supported": { "type": "array", "items": { "type": "string", "examples": [ "sub" ], "maxLength": 100 }, "minItems": 0, "maxItems": 150, "description": "JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list." }, "code_challenge_methods_supported": { "type": "array", "items": { "type": "string", "examples": [ "S256" ], "maxLength": 20 }, "minItems": 0, "maxItems": 10, "description": "JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636." }, "display_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "page" ], "maxLength": 10 }, "minItems": 0, "maxItems": 6, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used." }, "dpop_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "ES256" ], "maxLength": 14 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing." }, "end_session_endpoint": { "type": "string", "examples": [ "https://provider.example.com/oauth/logout" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme." }, "grant_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "authorization_code" ], "maxLength": 100 }, "minItems": 0, "maxItems": 20, "description": "A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"]." }, "id_token_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RSA-OAEP" ], "maxLength": 14 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT" }, "id_token_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT]." }, "id_token_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10, "description": "JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata)." }, "minItems": 1, "maxItems": 26, "description": "A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518" }, "issuer": { "description": "The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.", "type": "string", "examples": [ "https://accounts.example.com" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "jwks_uri": { "description": "URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.", "type": "string", "examples": [ "https://provider.example.com/.well-known/jwks.json" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "op_policy_uri": { "type": "string", "examples": [ "https://provider.example.com/policy" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given." }, "op_tos_uri": { "type": "string", "examples": [ "https://provider.example.com/terms" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given." }, "registration_endpoint": { "type": "string", "examples": [ "https://provider.example.com/oauth/register" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration" }, "request_object_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RSA-OAEP" ], "maxLength": 28 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference." }, "request_object_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference." }, "request_object_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256." }, "request_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false." }, "request_uri_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false." }, "require_request_uri_registration": { "type": "boolean", "description": "Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false." }, "response_modes_supported": { "type": "array", "items": { "type": "string", "examples": [ "query" ], "maxLength": 20 }, "minItems": 0, "maxItems": 16, "description": "A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]" }, "response_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "code" ], "maxLength": 40 }, "minItems": 1, "maxItems": 40, "description": "A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values" }, "scopes_supported": { "type": "array", "items": { "type": "string", "examples": [ "openid" ], "maxLength": 100 }, "minItems": 0, "maxItems": 7000, "description": "A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED" }, "service_documentation": { "type": "string", "examples": [ "https://provider.example.com/docs" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation." }, "subject_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "public" ], "minLength": 0, "maxLength": 100 }, "minItems": 0, "maxItems": 20, "description": "A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public" }, "token_endpoint": { "description": "URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/token" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "token_endpoint_auth_methods_supported": { "type": "array", "items": { "type": "string", "examples": [ "client_secret_basic" ], "maxLength": 60 }, "minItems": 0, "maxItems": 14, "description": "JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749]." }, "token_endpoint_auth_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 24, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used." }, "ui_locales_supported": { "type": "array", "items": { "type": "string", "examples": [ "en-US" ], "maxLength": 50 }, "minItems": 0, "maxItems": 150, "description": "Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values." }, "userinfo_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]." }, "userinfo_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]." }, "userinfo_endpoint": { "description": "Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.", "type": "string", "examples": [ "https://provider.example.com/oauth/userinfo" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "userinfo_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included." } }, "required": [ "authorization_endpoint", "id_token_signing_alg_values_supported", "issuer", "jwks_uri" ], "unevaluatedProperties": { "not": {} } }, "schema_version": { "description": "The internal schema version of the connection options.", "type": "string", "enum": [ "openid-1.0.0", "oidc-v4" ] }, "scope": { "type": "string", "examples": [ "openid profile email" ], "minLength": 6, "maxLength": 255, "description": "Space-separated list of OAuth 2.0 scopes requested during authorization. Must include 'openid' (required by OIDC spec). Common values: 'openid profile email'. Additional scopes depend on the identity provider." }, "send_back_channel_nonce": { "type": "boolean", "description": "When true and type is 'back_channel', includes a cryptographic nonce in authorization requests to prevent replay attacks. The identity provider must include this nonce in the ID token for validation." }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "tenant_domain": { "description": "Tenant domain", "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255 }, "token_endpoint": { "description": "URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/token" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "token_endpoint_auth_method": { "description": "Authentication method used at the identity provider's token endpoint. 'client_secret_post' sends credentials in the request body; 'private_key_jwt' uses a signed JWT assertion for enhanced security. Applicable when strategy=oidc or okta.", "type": "string", "enum": [ "client_secret_post", "private_key_jwt" ] }, "token_endpoint_auth_signing_alg": { "description": "Algorithm used to sign client_assertions. Applicable when strategy=oidc or okta.", "type": "string", "enum": [ "ES256", "ES384", "PS256", "PS384", "RS256", "RS384", "RS512" ] }, "token_endpoint_jwtca_aud_format": { "description": "Specifies the format of the aud (audience) claim included in the JWT used for client authentication at the token endpoint. Accepted values are: 'issuer' (the aud claim is set to the OIDC issuer URL) or 'token_endpoint' (the aud claim is set to the token endpoint URL).", "type": "string", "enum": [ "issuer", "token_endpoint" ] }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "useOauthSpecScope": { "type": "boolean", "description": "When true, uses space-delimited scopes (per OAuth 2.0 spec) instead of comma-delimited when calling the identity provider's authorization endpoint. Only relevant when using the connection_scope parameter. See https://auth0.com/docs/authenticate/identity-providers/adding-scopes-for-an-external-idp#pass-scopes-to-authorize-endpoint" }, "userinfo_endpoint": { "description": "Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.", "type": "string", "examples": [ "https://provider.example.com/oauth/userinfo" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "attribute_map": { "description": "Configuration for mapping claims from the identity provider to Auth0 user profile attributes. Allows customizing which IdP claims populate user fields and how they are transformed.", "type": "object", "properties": { "attributes": { "description": "Object containing mapping details for incoming claims", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "userinfo_scope": { "type": "string", "examples": [ "openid profile email" ], "minLength": 0, "maxLength": 255, "description": "Scopes to send to the IdP's Userinfo endpoint" }, "mapping_mode": { "description": "Method used to map incoming claims when strategy=oidc.", "type": "string", "enum": [ "bind_all", "use_map" ] } }, "unevaluatedProperties": { "not": {} } }, "discovery_url": { "type": "string", "examples": [ "https://provider.example.com/.well-known/openid-configuration" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the identity provider's OIDC Discovery endpoint (/.well-known/openid-configuration). When provided and oidc_metadata is empty, Auth0 automatically retrieves the provider's configuration including endpoints and supported features." }, "type": { "description": "OIDC communication channel type. 'back_channel' (confidential client) exchanges tokens server-side for stronger security; 'front_channel' handles responses in the browser.", "type": "string", "enum": [ "back_channel", "front_channel" ] } }, "required": [ "client_id" ], "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "oidc", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'okta' connection", "type": "object", "properties": { "authorization_endpoint": { "description": "URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/authorize" ], "minLength": 8, "maxLength": 2083, "format": "uri" }, "client_id": { "type": "string", "examples": [ "abc123def456ghi789" ], "minLength": 0, "maxLength": 255, "description": "OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider." }, "connection_settings": { "description": "OAuth 2.0 PKCE (Proof Key for Code Exchange) settings. PKCE enhances security for public clients by preventing authorization code interception attacks. 'auto' (recommended) uses the strongest method supported by the IdP.", "type": "object", "properties": { "pkce": { "description": "PKCE configuration.", "type": "string", "enum": [ "auto", "S256", "plain", "disabled" ] } }, "unevaluatedProperties": { "not": {} } }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 1000, "description": "Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication." }, "dpop_signing_alg": { "description": "Algorithm used for DPoP proof JWT signing. Applicable when strategy=oidc or okta.", "type": "string", "enum": [ "ES256", "ES384", "ES512", "Ed25519" ] }, "federated_connections_access_tokens": { "description": "Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.", "type": "object", "properties": { "active": { "type": "boolean", "description": "Enables refresh tokens and access tokens collection for federated connections" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "icon_url": { "description": "https url of the icon to be shown", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "id_token_session_expiry_supported": { "type": "boolean", "description": "Indicates whether the identity provider supports session expiry via the id_token. If true, the system will use the session_expiry claim in the id_token to determine session expiry." }, "id_token_signed_response_algs": { "type": "array", "items": { "type": "string", "enum": [ "ES256", "ES384", "PS256", "PS384", "RS256", "RS384", "RS512" ], "description": "Algorithm allowed to verify the ID tokens." }, "description": "List of algorithms allowed to verify the ID tokens. Applicable when strategy=oidc or okta." }, "issuer": { "description": "The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.", "type": "string", "examples": [ "https://accounts.example.com" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "jwks_uri": { "description": "URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.", "type": "string", "examples": [ "https://provider.example.com/.well-known/jwks.json" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "oidc_metadata": { "description": "OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata", "type": "object", "properties": { "acr_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "urn:mace:incommon:iap:silver" ], "maxLength": 100 }, "minItems": 0, "maxItems": 30, "description": "A list of the Authentication Context Class References that this OP supports" }, "authorization_endpoint": { "description": "URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/authorize" ], "minLength": 8, "maxLength": 2083, "format": "uri" }, "claim_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "normal" ], "maxLength": 25 }, "minItems": 0, "maxItems": 10, "description": "JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims." }, "claims_locales_supported": { "type": "array", "items": { "type": "string", "examples": [ "en-US" ], "maxLength": 50 }, "minItems": 0, "maxItems": 100, "description": "Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values." }, "claims_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false." }, "claims_supported": { "type": "array", "items": { "type": "string", "examples": [ "sub" ], "maxLength": 100 }, "minItems": 0, "maxItems": 150, "description": "JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list." }, "code_challenge_methods_supported": { "type": "array", "items": { "type": "string", "examples": [ "S256" ], "maxLength": 20 }, "minItems": 0, "maxItems": 10, "description": "JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636." }, "display_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "page" ], "maxLength": 10 }, "minItems": 0, "maxItems": 6, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used." }, "dpop_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "ES256" ], "maxLength": 14 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing." }, "end_session_endpoint": { "type": "string", "examples": [ "https://provider.example.com/oauth/logout" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme." }, "grant_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "authorization_code" ], "maxLength": 100 }, "minItems": 0, "maxItems": 20, "description": "A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"]." }, "id_token_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RSA-OAEP" ], "maxLength": 14 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT" }, "id_token_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT]." }, "id_token_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10, "description": "JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata)." }, "minItems": 1, "maxItems": 26, "description": "A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518" }, "issuer": { "description": "The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.", "type": "string", "examples": [ "https://accounts.example.com" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "jwks_uri": { "description": "URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.", "type": "string", "examples": [ "https://provider.example.com/.well-known/jwks.json" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "op_policy_uri": { "type": "string", "examples": [ "https://provider.example.com/policy" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given." }, "op_tos_uri": { "type": "string", "examples": [ "https://provider.example.com/terms" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given." }, "registration_endpoint": { "type": "string", "examples": [ "https://provider.example.com/oauth/register" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration" }, "request_object_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RSA-OAEP" ], "maxLength": 28 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference." }, "request_object_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference." }, "request_object_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256." }, "request_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false." }, "request_uri_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false." }, "require_request_uri_registration": { "type": "boolean", "description": "Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false." }, "response_modes_supported": { "type": "array", "items": { "type": "string", "examples": [ "query" ], "maxLength": 20 }, "minItems": 0, "maxItems": 16, "description": "A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]" }, "response_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "code" ], "maxLength": 40 }, "minItems": 1, "maxItems": 40, "description": "A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values" }, "scopes_supported": { "type": "array", "items": { "type": "string", "examples": [ "openid" ], "maxLength": 100 }, "minItems": 0, "maxItems": 7000, "description": "A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED" }, "service_documentation": { "type": "string", "examples": [ "https://provider.example.com/docs" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation." }, "subject_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "public" ], "minLength": 0, "maxLength": 100 }, "minItems": 0, "maxItems": 20, "description": "A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public" }, "token_endpoint": { "description": "URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/token" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "token_endpoint_auth_methods_supported": { "type": "array", "items": { "type": "string", "examples": [ "client_secret_basic" ], "maxLength": 60 }, "minItems": 0, "maxItems": 14, "description": "JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749]." }, "token_endpoint_auth_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 24, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used." }, "ui_locales_supported": { "type": "array", "items": { "type": "string", "examples": [ "en-US" ], "maxLength": 50 }, "minItems": 0, "maxItems": 150, "description": "Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values." }, "userinfo_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]." }, "userinfo_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]." }, "userinfo_endpoint": { "description": "Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.", "type": "string", "examples": [ "https://provider.example.com/oauth/userinfo" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "userinfo_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included." } }, "required": [ "authorization_endpoint", "id_token_signing_alg_values_supported", "issuer", "jwks_uri" ], "unevaluatedProperties": { "not": {} } }, "schema_version": { "description": "The internal schema version of the connection options.", "type": "string", "enum": [ "openid-1.0.0", "oidc-v4" ] }, "scope": { "type": "string", "examples": [ "openid profile email" ], "minLength": 6, "maxLength": 255, "description": "Space-separated list of OAuth 2.0 scopes requested during authorization. Must include 'openid' (required by OIDC spec). Common values: 'openid profile email'. Additional scopes depend on the identity provider." }, "send_back_channel_nonce": { "type": "boolean", "description": "When true and type is 'back_channel', includes a cryptographic nonce in authorization requests to prevent replay attacks. The identity provider must include this nonce in the ID token for validation." }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "tenant_domain": { "description": "Tenant domain", "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255 }, "token_endpoint": { "description": "URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/token" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "token_endpoint_auth_method": { "description": "Authentication method used at the identity provider's token endpoint. 'client_secret_post' sends credentials in the request body; 'private_key_jwt' uses a signed JWT assertion for enhanced security. Applicable when strategy=oidc or okta.", "type": "string", "enum": [ "client_secret_post", "private_key_jwt" ] }, "token_endpoint_auth_signing_alg": { "description": "Algorithm used to sign client_assertions. Applicable when strategy=oidc or okta.", "type": "string", "enum": [ "ES256", "ES384", "PS256", "PS384", "RS256", "RS384", "RS512" ] }, "token_endpoint_jwtca_aud_format": { "description": "Specifies the format of the aud (audience) claim included in the JWT used for client authentication at the token endpoint. Accepted values are: 'issuer' (the aud claim is set to the OIDC issuer URL) or 'token_endpoint' (the aud claim is set to the token endpoint URL).", "type": "string", "enum": [ "issuer", "token_endpoint" ] }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "useOauthSpecScope": { "type": "boolean", "description": "When true, uses space-delimited scopes (per OAuth 2.0 spec) instead of comma-delimited when calling the identity provider's authorization endpoint. Only relevant when using the connection_scope parameter. See https://auth0.com/docs/authenticate/identity-providers/adding-scopes-for-an-external-idp#pass-scopes-to-authorize-endpoint" }, "userinfo_endpoint": { "description": "Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.", "type": "string", "examples": [ "https://provider.example.com/oauth/userinfo" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "attribute_map": { "description": "Mapping of claims received from the identity provider (IdP)", "type": "object", "properties": { "attributes": { "description": "Object containing mapping details for incoming claims", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "userinfo_scope": { "type": "string", "examples": [ "openid profile email" ], "minLength": 0, "maxLength": 255, "description": "Scopes to send to the IdP's Userinfo endpoint" }, "mapping_mode": { "description": "Method used to map incoming claims when strategy=okta.", "type": "string", "enum": [ "basic_profile", "use_map" ] } }, "unevaluatedProperties": { "not": {} } }, "domain": { "type": "string", "examples": [ "dev-123456.okta.com" ], "minLength": 4, "maxLength": 255, "description": "Domain of the Okta organization (e.g., dev-123456.okta.com). Should be just the domain of the okta server with no scheme or trailing backslash. Discovery runs only when connection.options.oidc_metadata is empty and a domain is provided" }, "type": { "description": "Connection type", "type": "string", "enum": [ "back_channel" ] } }, "required": [ "client_id" ], "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "okta", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'samlp' connection", "type": "object", "properties": { "assertion_decryption_settings": { "description": "Settings for SAML assertion decryption.", "type": "object", "properties": { "algorithm_exceptions": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 100 }, "maxItems": 10, "description": "A list of insecure algorithms to allow for SAML assertion decryption." }, "algorithm_profile": { "description": "The algorithm profile to use for decrypting SAML assertions.", "type": "string", "enum": [ "v2026-1" ] } }, "required": [ "algorithm_profile" ], "unevaluatedProperties": { "not": {} } }, "cert": { "type": "string", "minLength": 1, "maxLength": 10240, "description": "X.509 signing certificate from the identity provider in .der format. Used to validate signatures in SAML Responses and Assertions. This is an alternative to signingCert and is kept for backward compatibility. Prefer using signingCert instead.", "deprecated": true }, "cert_rollover_notification": { "type": "string", "format": "date-time", "description": "Timestamp of the last certificate expiring soon notification." }, "digestAlgorithm": { "description": "Algorithm used for computing digest values when signing SAML requests and logout requests. Defaults to 'sha256'.", "type": "string", "enum": [ "sha1", "sha256" ] }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 50001, "description": "Domain aliases for the connection" }, "entityId": { "description": "The entity identifier (Issuer) for the SAML Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'. This value is included in SAML AuthnRequest messages sent to the identity provider.", "type": "string", "examples": [ "urn:auth0:my-tenant:my-connection" ], "minLength": 1, "maxLength": 128 }, "expires": { "type": "string", "format": "date-time", "description": "ISO 8601 formatted datetime indicating when the identity provider's signing certificate expires." }, "icon_url": { "description": "URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "idpinitiated": { "description": "Configuration for IdP-Initiated SAML Single Sign-On. When enabled, allows users to initiate login directly from their SAML identity provider without first visiting Auth0. The IdP must include the connection parameter in the post-back URL (Assertion Consumer Service URL).", "type": "object", "properties": { "client_authorizequery": { "type": "string", "minLength": 1, "maxLength": 2048, "description": "The query string sent to the default application" }, "client_id": { "type": "string", "minLength": 1, "maxLength": 256, "description": "The client ID to use for IdP-initiated login requests." }, "client_protocol": { "description": "The response protocol used to communicate with the default application.", "type": "string", "enum": [ "oidc", "samlp", "wsfed" ] }, "enabled": { "type": "boolean", "description": "When true, enables IdP-initiated login support for this SAML connection. Allows users to log in directly from the identity provider without first visiting Auth0." } }, "unevaluatedProperties": { "not": {} } }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "protocolBinding": { "description": "SAML protocol binding mechanism for sending authentication requests to the identity provider.", "type": "string", "enum": [ "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST", "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" ] }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "signatureAlgorithm": { "description": "Algorithm used to sign SAML authentication requests and logout requests using the connection's signing key. Common values: 'rsa-sha256' (RSA signature with SHA-256 digest) or 'rsa-sha1'. Defaults to 'rsa-sha256'.", "type": "string", "enum": [ "rsa-sha1", "rsa-sha256" ] }, "signInEndpoint": { "description": "Identity provider's SAML SingleSignOnService endpoint URL where Auth0 sends SAML authentication requests. This is the primary login URL for the SAML connection. Required unless using metadataUrl or metadataXml.", "type": "string", "examples": [ "https://idp.example.com/saml/sso" ], "minLength": 8, "maxLength": 2048, "format": "uri" }, "signingCert": { "description": "Base64-encoded X.509 certificate from the identity provider used to validate signatures in SAML responses and assertions. The certificate is decoded and used for cryptographic signature verification.", "type": "string", "examples": [ "MIIDDTCCAfWgAwIBAgIJALFkBP7GVlWkMA0GCSqGSIb3DQEBCwUAMCUxIzAhBgNV" ], "minLength": 1, "maxLength": 10240 }, "signSAMLRequest": { "type": "boolean", "description": "When true, Auth0 signs SAML authentication requests using the connection's signing key. The signature includes the request's digest and is validated by the identity provider. Defaults to false (unsigned requests)." }, "subject": { "description": "Certificate Subject Distinguished Name (DN) extracted from the identity provider's signing certificate.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "tenant_domain": { "description": "For SAML connections, the tenant domain used to construct the login endpoint URL. Can be a string for single-tenant or an array of strings for multi-tenant validation.", "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255 }, "thumbprints": { "type": "array", "items": { "type": "string", "examples": [ "ef34ab56cd78901234567890123456789012efab" ], "minLength": 40, "maxLength": 40 }, "minItems": 0, "maxItems": 1, "description": "SHA-1 thumbprints (fingerprints) of the identity provider's signing certificates. Automatically computed from signingCert during connection creation. Each thumbprint must be a 40-character hexadecimal string." }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "debug": { "type": "boolean", "description": "When true, enables detailed SAML debugging by issuing 'w' (warning) events in tenant logs containing SAML request/response details. WARNING: Potentially exposes sensitive user information (PII, credentials) and should only be enabled temporarily for debugging purposes." }, "deflate": { "type": "boolean", "description": "When true, enables DEFLATE compression for SAML requests sent via HTTP-Redirect binding." }, "destinationUrl": { "type": "string", "examples": [ "https://idp.example.com/saml/sso" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "The URL where Auth0 will send SAML authentication requests (the Identity Provider's SSO URL). Must be a valid HTTPS URL." }, "disableFieldsMapFix": { "type": "boolean", "description": "When true, disables the automatic correction of the fieldsMap configuration to ensure proper mapping of SAML attributes to user profile fields. Defaults to false (fieldsMap fix enabled)." }, "disableSignout": { "type": "boolean", "description": "When true, disables sending SAML logout requests (SingleLogoutService) to the identity provider during user sign-out. The user will be logged out of Auth0 but will remain logged into the identity provider. Defaults to false (federated logout enabled)." }, "discovery_url": { "type": "string", "examples": [ "https://provider.example.com/.well-known/openid-configuration" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the identity provider's OIDC Discovery endpoint (/.well-known/openid-configuration). When provided and oidc_metadata is empty, Auth0 automatically retrieves the provider's configuration including endpoints and supported features. Used with Cross App Access.", "x-release-lifecycle": "EA" }, "fieldsMap": { "description": "Maps SAML assertion attributes from the identity provider to Auth0 user profile attributes. Format: { 'auth0_field': 'saml_attribute' } or { 'auth0_field': ['saml_attr1', 'saml_attr2'] } for fallback options. Merged with default mappings for email, name, given_name, family_name, and groups.", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "fieldsMapJsonRaw": { "type": "string", "minLength": 0, "maxLength": 8192, "description": "Raw JSON string representation of the fieldsMap configuration. Used internally for storage and retrieval of the fieldsMap object." }, "global_token_revocation_jwt_iss": { "type": "string", "minLength": 1, "maxLength": 1024, "description": "Expected 'iss' (Issuer) claim value for JWT tokens in Global Token Revocation requests from the identity provider. When configured, Auth0 validates the JWT issuer matches this value before processing token revocation. Must be used together with global_token_revocation_jwt_sub." }, "global_token_revocation_jwt_sub": { "type": "string", "minLength": 1, "maxLength": 1024, "description": "Expected 'sub' (Subject) claim value for JWT tokens in Global Token Revocation requests from the identity provider. When configured, Auth0 validates the JWT subject matches this value before processing token revocation. Must be used together with global_token_revocation_jwt_iss." }, "metadataUrl": { "type": "string", "examples": [ "https://idp.example.com/saml/metadata" ], "minLength": 8, "maxLength": 2048, "format": "uri", "description": "HTTPS URL to the identity provider's SAML metadata document. When provided, Auth0 automatically fetches and parses the metadata to extract signInEndpoint, signOutEndpoint, signingCert, signSAMLRequest, and protocolBinding. Use metadataUrl OR metadataXml, not both." }, "oidc_metadata": { "description": "OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata. Used with Cross App Access.", "x-release-lifecycle": "EA", "type": "object", "properties": { "acr_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "urn:mace:incommon:iap:silver" ], "maxLength": 100 }, "minItems": 0, "maxItems": 30, "description": "A list of the Authentication Context Class References that this OP supports" }, "authorization_endpoint": { "description": "URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/authorize" ], "minLength": 8, "maxLength": 2083, "format": "uri" }, "claim_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "normal" ], "maxLength": 25 }, "minItems": 0, "maxItems": 10, "description": "JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims." }, "claims_locales_supported": { "type": "array", "items": { "type": "string", "examples": [ "en-US" ], "maxLength": 50 }, "minItems": 0, "maxItems": 100, "description": "Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values." }, "claims_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false." }, "claims_supported": { "type": "array", "items": { "type": "string", "examples": [ "sub" ], "maxLength": 100 }, "minItems": 0, "maxItems": 150, "description": "JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list." }, "code_challenge_methods_supported": { "type": "array", "items": { "type": "string", "examples": [ "S256" ], "maxLength": 20 }, "minItems": 0, "maxItems": 10, "description": "JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636." }, "display_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "page" ], "maxLength": 10 }, "minItems": 0, "maxItems": 6, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used." }, "dpop_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "ES256" ], "maxLength": 14 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing." }, "end_session_endpoint": { "type": "string", "examples": [ "https://provider.example.com/oauth/logout" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme." }, "grant_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "authorization_code" ], "maxLength": 100 }, "minItems": 0, "maxItems": 20, "description": "A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"]." }, "id_token_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RSA-OAEP" ], "maxLength": 14 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT" }, "id_token_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT]." }, "id_token_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10, "description": "JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata)." }, "minItems": 1, "maxItems": 26, "description": "A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518" }, "issuer": { "description": "The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.", "type": "string", "examples": [ "https://accounts.example.com" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "jwks_uri": { "description": "URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.", "type": "string", "examples": [ "https://provider.example.com/.well-known/jwks.json" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "op_policy_uri": { "type": "string", "examples": [ "https://provider.example.com/policy" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given." }, "op_tos_uri": { "type": "string", "examples": [ "https://provider.example.com/terms" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given." }, "registration_endpoint": { "type": "string", "examples": [ "https://provider.example.com/oauth/register" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration" }, "request_object_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RSA-OAEP" ], "maxLength": 28 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference." }, "request_object_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference." }, "request_object_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256." }, "request_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false." }, "request_uri_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false." }, "require_request_uri_registration": { "type": "boolean", "description": "Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false." }, "response_modes_supported": { "type": "array", "items": { "type": "string", "examples": [ "query" ], "maxLength": 20 }, "minItems": 0, "maxItems": 16, "description": "A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]" }, "response_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "code" ], "maxLength": 40 }, "minItems": 1, "maxItems": 40, "description": "A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values" }, "scopes_supported": { "type": "array", "items": { "type": "string", "examples": [ "openid" ], "maxLength": 100 }, "minItems": 0, "maxItems": 7000, "description": "A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED" }, "service_documentation": { "type": "string", "examples": [ "https://provider.example.com/docs" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation." }, "subject_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "public" ], "minLength": 0, "maxLength": 100 }, "minItems": 0, "maxItems": 20, "description": "A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public" }, "token_endpoint": { "description": "URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/token" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "token_endpoint_auth_methods_supported": { "type": "array", "items": { "type": "string", "examples": [ "client_secret_basic" ], "maxLength": 60 }, "minItems": 0, "maxItems": 14, "description": "JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749]." }, "token_endpoint_auth_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 24, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used." }, "ui_locales_supported": { "type": "array", "items": { "type": "string", "examples": [ "en-US" ], "maxLength": 50 }, "minItems": 0, "maxItems": 150, "description": "Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values." }, "userinfo_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]." }, "userinfo_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]." }, "userinfo_endpoint": { "description": "Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.", "type": "string", "examples": [ "https://provider.example.com/oauth/userinfo" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "userinfo_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included." } }, "required": [ "authorization_endpoint", "id_token_signing_alg_values_supported", "issuer", "jwks_uri" ], "unevaluatedProperties": { "not": {} } }, "recipientUrl": { "type": "string", "examples": [ "https://idp.example.com/saml/acs" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "The URL where Auth0 will send SAML authentication requests (the Identity Provider's SSO URL). Must be a valid HTTPS URL." }, "requestTemplate": { "type": "string", "minLength": 1, "maxLength": 10240, "description": "Custom XML template for SAML authentication requests. Supports variable substitution using @@variableName@@ syntax. When not provided, uses default SAML AuthnRequest template. See https://auth0.com/docs/authenticate/protocols/saml/saml-sso-integrations/configure-auth0-saml-service-provider#customize-the-request-template" }, "signOutEndpoint": { "type": "string", "examples": [ "https://idp.example.com/saml/slo" ], "minLength": 8, "maxLength": 2048, "format": "uri", "description": "Identity provider's SAML SingleLogoutService endpoint URL where Auth0 sends logout requests for federated sign-out. When not provided, defaults to signInEndpoint. Only used if disableSignout is false." }, "user_id_attribute": { "type": "string", "minLength": 1, "maxLength": 2396, "description": "Custom SAML assertion attribute to use as the unique user identifier. When provided, this attribute is prepended to the default user_id mapping list with highest priority. Accepts a string (single SAML attribute name)." } }, "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "samlp", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'pingfederate' connection", "type": "object", "properties": { "assertion_decryption_settings": { "description": "Settings for SAML assertion decryption.", "type": "object", "properties": { "algorithm_exceptions": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 100 }, "maxItems": 10, "description": "A list of insecure algorithms to allow for SAML assertion decryption." }, "algorithm_profile": { "description": "The algorithm profile to use for decrypting SAML assertions.", "type": "string", "enum": [ "v2026-1" ] } }, "required": [ "algorithm_profile" ], "unevaluatedProperties": { "not": {} } }, "cert": { "type": "string", "minLength": 1, "maxLength": 10240, "description": "X.509 signing certificate from the identity provider in .der format. Used to validate signatures in SAML Responses and Assertions. This is an alternative to signingCert and is kept for backward compatibility. Prefer using signingCert instead.", "deprecated": true }, "cert_rollover_notification": { "type": "string", "format": "date-time", "description": "Timestamp of the last certificate expiring soon notification." }, "digestAlgorithm": { "description": "Algorithm used for computing digest values when signing SAML requests and logout requests. Defaults to 'sha256'.", "type": "string", "enum": [ "sha1", "sha256" ] }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 50001, "description": "Domain aliases for the connection" }, "entityId": { "description": "The entity identifier (Issuer) for the SAML Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'. This value is included in SAML AuthnRequest messages sent to the identity provider.", "type": "string", "examples": [ "urn:auth0:my-tenant:my-connection" ], "minLength": 1, "maxLength": 128 }, "expires": { "type": "string", "format": "date-time", "description": "ISO 8601 formatted datetime indicating when the identity provider's signing certificate expires." }, "icon_url": { "description": "URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "idpinitiated": { "description": "Configuration for IdP-Initiated SAML Single Sign-On. When enabled, allows users to initiate login directly from their SAML identity provider without first visiting Auth0. The IdP must include the connection parameter in the post-back URL (Assertion Consumer Service URL).", "type": "object", "properties": { "client_authorizequery": { "type": "string", "minLength": 1, "maxLength": 2048, "description": "The query string sent to the default application" }, "client_id": { "type": "string", "minLength": 1, "maxLength": 256, "description": "The client ID to use for IdP-initiated login requests." }, "client_protocol": { "description": "The response protocol used to communicate with the default application.", "type": "string", "enum": [ "oidc", "samlp", "wsfed" ] }, "enabled": { "type": "boolean", "description": "When true, enables IdP-initiated login support for this SAML connection. Allows users to log in directly from the identity provider without first visiting Auth0." } }, "unevaluatedProperties": { "not": {} } }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "protocolBinding": { "description": "SAML protocol binding mechanism for sending authentication requests to the identity provider.", "type": "string", "enum": [ "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST", "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" ] }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "signatureAlgorithm": { "description": "Algorithm used to sign SAML authentication requests and logout requests using the connection's signing key. Common values: 'rsa-sha256' (RSA signature with SHA-256 digest) or 'rsa-sha1'. Defaults to 'rsa-sha256'.", "type": "string", "enum": [ "rsa-sha1", "rsa-sha256" ] }, "signInEndpoint": { "description": "Identity provider's SAML SingleSignOnService endpoint URL where Auth0 sends SAML authentication requests. This is the primary login URL for the SAML connection. Required unless using metadataUrl or metadataXml.", "type": "string", "examples": [ "https://idp.example.com/saml/sso" ], "minLength": 8, "maxLength": 2048, "format": "uri" }, "signingCert": { "description": "Base64-encoded X.509 certificate from the identity provider used to validate signatures in SAML responses and assertions. The certificate is decoded and used for cryptographic signature verification.", "type": "string", "examples": [ "MIIDDTCCAfWgAwIBAgIJALFkBP7GVlWkMA0GCSqGSIb3DQEBCwUAMCUxIzAhBgNV" ], "minLength": 1, "maxLength": 10240 }, "signSAMLRequest": { "type": "boolean", "description": "When true, Auth0 signs SAML authentication requests using the connection's signing key. The signature includes the request's digest and is validated by the identity provider. Defaults to false (unsigned requests)." }, "subject": { "description": "Certificate Subject Distinguished Name (DN) extracted from the identity provider's signing certificate.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "tenant_domain": { "description": "For SAML connections, the tenant domain used to construct the login endpoint URL. Can be a string for single-tenant or an array of strings for multi-tenant validation.", "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255 }, "thumbprints": { "type": "array", "items": { "type": "string", "examples": [ "ef34ab56cd78901234567890123456789012efab" ], "minLength": 40, "maxLength": 40 }, "minItems": 0, "maxItems": 1, "description": "SHA-1 thumbprints (fingerprints) of the identity provider's signing certificates. Automatically computed from signingCert during connection creation. Each thumbprint must be a 40-character hexadecimal string." }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "pingFederateBaseUrl": { "type": "string", "examples": [ "https://pingfederate.example.com" ], "minLength": 8, "maxLength": 256, "format": "uri", "description": "URL provided by PingFederate which returns information used for creating the connection" } }, "required": [ "pingFederateBaseUrl" ], "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "pingfederate", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'adfs' connection", "type": "object", "properties": { "adfs_server": { "type": "string", "examples": [ "adfs.example.com" ], "minLength": 0, "maxLength": 2048, "description": "ADFS federation metadata host or XML URL used to discover WS-Fed endpoints and certificates. Errors if adfs_server and fedMetadataXml are both absent." }, "cert_rollover_notification": { "type": "string", "format": "date-time", "description": "Timestamp of the last certificate expiring soon notification." }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 1000, "description": "Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication." }, "entityId": { "description": "The entity identifier (Issuer) for the ADFS Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'.", "type": "string", "examples": [ "urn:auth0:my-tenant:my-connection" ], "minLength": 1, "maxLength": 128 }, "fedMetadataXml": { "type": "string", "minLength": 1, "maxLength": 102400, "description": "Inline XML alternative to 'adfs_server'. Cannot be set together with 'adfs_server'." }, "icon_url": { "description": "URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "prev_thumbprints": { "type": "array", "items": { "type": "string", "examples": [ "AB12CD34EF56789012345678901234567890ABCD" ], "minLength": 0, "maxLength": 64, "description": "Certificate thumbprints for ADFS and Azure AD connections." }, "minItems": 0, "maxItems": 20, "description": "Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string." }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "should_trust_email_verified_connection": { "description": "Choose how Auth0 sets the email_verified field in the user profile.", "type": "string", "enum": [ "never_set_emails_as_verified", "always_set_emails_as_verified" ] }, "signInEndpoint": { "description": "Passive Requestor (WS-Fed) sign-in endpoint discovered from metadata or provided explicitly.", "type": "string", "examples": [ "https://idp.example.com/saml/sso" ], "minLength": 8, "maxLength": 2048, "format": "uri" }, "tenant_domain": { "description": "Tenant domain", "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255 }, "thumbprints": { "type": "array", "items": { "type": "string", "examples": [ "AB12CD34EF56789012345678901234567890ABCD" ], "minLength": 0, "maxLength": 64, "description": "Certificate thumbprints for ADFS and Azure AD connections." }, "minItems": 0, "maxItems": 20, "description": "Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string." }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "user_id_attribute": { "type": "string", "minLength": 1, "maxLength": 128, "description": "Custom ADFS claim to use as the unique user identifier. When provided, this attribute is prepended to the default user_id mapping list with highest priority. Accepts a string (single ADFS claim name)." } }, "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "adfs", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'ad' connection", "type": "object", "properties": { "agentIP": { "description": "IP address of the AD connector agent used to validate that authentication requests originate from the corporate network for Kerberos authentication (managed by the AD Connector agent).", "type": "string", "examples": [ "192.168.1.10" ], "minLength": 2, "maxLength": 39 }, "agentMode": { "type": "boolean", "description": "When enabled, allows direct username/password authentication through the AD connector agent instead of WS-Federation protocol (managed by the AD Connector agent)." }, "agentVersion": { "type": "string", "examples": [ "1.4.2" ], "minLength": 5, "maxLength": 12, "description": "Version identifier of the installed AD connector agent software (managed by the AD Connector agent)." }, "brute_force_protection": { "type": "boolean", "description": "Enables Auth0's brute force protection to prevent credential stuffing attacks. When enabled, blocks suspicious login attempts from specific IP addresses after repeated failures." }, "certAuth": { "type": "boolean", "description": "Enables client SSL certificate authentication for the AD connector, requiring HTTPS on the sign-in endpoint" }, "certs": { "type": "array", "items": { "type": "string", "examples": [ "MIIDDTCCAfWgAwIBAgIJALFkBP7GVlWkMA0GCSqGSIb3DQEBCwUAMCUxIzAhBgNVBAMTGmV4YW1wbGUuYXV0aDAuY29tIENlcnQgQ0EwHhcNMjUwMTAxMDAwMDAwWhcNMjYwMTAxMDAwMDAwWjAUMRIwEAYDVQQDEwlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC7o4qne60TB3wolFrzabc1234567890ABCDEFG" ], "minLength": 256, "maxLength": 3072 }, "minItems": 0, "maxItems": 2, "description": "Array of X.509 certificates in PEM format used for validating SAML signatures from the AD identity provider (managed by the AD Connector agent)." }, "disable_cache": { "type": "boolean", "description": "When enabled, disables caching of AD connector authentication results to ensure real-time validation against the directory" }, "disable_self_service_change_password": { "type": "boolean", "description": "When enabled, hides the 'Forgot Password' link on login pages to prevent users from initiating self-service password resets" }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 1000, "description": "List of domain names that can be used with identifier-first authentication flow to route users to this AD connection; each domain must be a valid DNS name up to 256 characters" }, "icon_url": { "description": "https url of the icon to be shown", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "ips": { "type": "array", "items": { "type": "string", "examples": [ "192.168.1.10" ], "minLength": 2, "maxLength": 39 }, "minItems": 0, "maxItems": 256, "description": "Array of IP address ranges in CIDR notation used to determine if authentication requests originate from the corporate network for Kerberos or certificate authentication." }, "kerberos": { "type": "boolean", "description": "Enables Windows Integrated Authentication (Kerberos) for seamless SSO when users authenticate from within the corporate network IP ranges" }, "kerberos_only": { "type": "boolean", "description": "When true, restricts the connection to Kerberos-only authentication, disallowing username/password fallback." }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "signInEndpoint": { "type": "string", "examples": [ "https://ad-connector.example.com" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "The sign-in endpoint type for the AD-LDAP connector agent (managed by the AD Connector agent)." }, "tenant_domain": { "type": "string", "examples": [ "corp.example.com" ], "minLength": 1, "maxLength": 512, "format": "hostname", "description": "Primary AD domain hint used for HRD and discovery." }, "thumbprints": { "type": "array", "items": { "type": "string", "examples": [ "8233ec9c12a44625d4a64ee413651fd928b5168f" ], "minLength": 40, "maxLength": 40 }, "minItems": 0, "maxItems": 2, "description": "Array of certificate SHA-1 thumbprints for validating signatures. Managed by Auth0 when using the AD Connector agent." }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} } }, "unevaluatedProperties": { "not": {} } }, "strategy": { "type": "string", "const": "ad", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'google-apps' connection", "type": "object", "properties": { "admin_access_token_expiresin": { "type": "string", "format": "date-time", "description": "Expiration timestamp for the `admin_access_token` in ISO 8601 format. Auth0 uses this value to determine when to refresh the token." }, "allow_setting_login_scopes": { "type": "boolean", "description": "When true, allows customization of OAuth scopes requested during user login. Custom scopes are appended to the mandatory email and profile scopes. When false or omitted, only the default email and profile scopes are used. This property is automatically enabled when Token Vault or Connected Accounts features are activated." }, "api_enable_groups": { "type": "boolean", "description": "Enables integration with the Google Workspace Admin SDK Directory API for groups. When true, Auth0 can synchronize groups & group memberships and supports inbound directory provisioning for groups. Defaults to false." }, "api_enable_users": { "type": "boolean", "description": "Enables integration with the Google Workspace Admin SDK Directory API. When true, Auth0 can retrieve extended user attributes (admin status, suspension status, group memberships) and supports inbound directory provisioning (SCIM). Defaults to true." }, "client_id": { "type": "string", "examples": [ "123456789-abc123def456.apps.googleusercontent.com" ], "minLength": 1, "maxLength": 128, "description": "Your Google OAuth 2.0 client ID. You can find this in your [Google Cloud Console](https://console.cloud.google.com/apis/credentials) under the OAuth 2.0 Client IDs section." }, "domain": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 1024, "description": "Primary Google Workspace domain name that users must belong to." }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 1000, "description": "Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication." }, "email": { "type": "boolean", "description": "Whether the OAuth flow requests the `email` scope." }, "ext_agreed_terms": { "type": "boolean", "description": "Fetches the `agreedToTerms` flag from the Google Directory profile." }, "ext_groups": { "type": "boolean", "description": "Enables enrichment with Google group memberships (required for `ext_groups_extended`)." }, "ext_groups_extended": { "type": "boolean", "description": "Controls whether enriched group entries include `id`, `email`, `name` (true) or only the group name (false); can only be set when `ext_groups` is true." }, "ext_is_admin": { "type": "boolean", "description": "Fetches the Google Directory admin flag for the signing-in user." }, "ext_is_suspended": { "type": "boolean", "description": "Fetches the Google Directory suspended flag for the signing-in user." }, "federated_connections_access_tokens": { "description": "Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.", "type": "object", "properties": { "active": { "type": "boolean", "description": "Enables refresh tokens and access tokens collection for federated connections" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "handle_login_from_social": { "type": "boolean", "description": "When enabled, users who sign in with their Google account through a social login will be automatically routed to this Google Workspace connection if their email domain matches the configured tenant_domain or domain_aliases. This ensures enterprise users authenticate through their organization's Google Workspace identity provider rather than through a generic Google social login, enabling access to directory-based attributes and enforcing organizational security policies. Defaults to true for new connections." }, "icon_url": { "description": "URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "map_user_id_to_id": { "type": "boolean", "description": "Determines how Auth0 generates the user_id for Google Workspace users. When false (default), the user's email address is used. When true, Google's stable numeric user ID is used instead, which persists even if the user's email changes. This setting can only be configured when creating the connection and cannot be changed afterward." }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "profile": { "type": "boolean", "description": "Whether the OAuth flow requests the `profile` scope." }, "scope": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 255 }, "minItems": 1, "maxItems": 64, "description": "Additional OAuth scopes requested beyond the default `email profile` scopes; ignored unless `allow_setting_login_scopes` is true." }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "tenant_domain": { "description": "The Google Workspace primary domain used to identify the organization during authentication.", "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255 }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} } }, "required": [ "client_id" ], "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "google-apps", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'waad' connection", "type": "object", "properties": { "api_enable_users": { "type": "boolean", "description": "Enable users API" }, "app_domain": { "type": "string", "examples": [ "contoso.onmicrosoft.com" ], "minLength": 0, "maxLength": 255, "description": "The Azure AD application domain (e.g., 'contoso.onmicrosoft.com'). Used primarily with WS-Federation protocol and Azure AD v1 endpoints." }, "app_id": { "type": "string", "examples": [ "api://contoso-azure-app" ], "minLength": 0, "maxLength": 500, "description": "The Application ID URI (App ID URI) for the Azure AD application. Required when using Azure AD v1 with the Resource Owner Password flow. Used to identify the resource being requested in OAuth token requests." }, "basic_profile": { "type": "boolean", "description": "Includes basic user profile information from Azure AD (name, email, given_name, family_name). Always enabled and required - represents the minimum profile data retrieved during authentication." }, "cert_rollover_notification": { "type": "string", "format": "date-time", "description": "Timestamp of the last certificate expiring soon notification." }, "client_id": { "type": "string", "examples": [ "12345678-1234-1234-1234-123456789012" ], "minLength": 0, "maxLength": 100, "description": "OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider." }, "domain": { "type": "string", "examples": [ "contoso.onmicrosoft.com" ], "minLength": 0, "maxLength": 512, "description": "The primary Azure AD tenant domain (e.g., 'contoso.onmicrosoft.com' or 'contoso.com')." }, "domain_aliases": { "type": "array", "items": { "type": "string", "minLength": 0, "maxLength": 255 }, "minItems": 0, "maxItems": 1000, "description": "Alternative domain names associated with this Azure AD tenant. Allows users from multiple verified domains to authenticate through this connection. Can be an array of domain strings." }, "ext_groups": { "type": "boolean", "description": "When enabled (true), retrieves and stores Azure AD security group memberships for the user. Requires Microsoft Graph API permissions (Directory.Read.All). Allows configuring max_groups_to_retrieve." }, "ext_nested_groups": { "type": "boolean", "description": "When true, stores all groups the user is member of, including transitive group memberships (groups within groups). When false (default), only direct group memberships are included." }, "ext_profile": { "type": "boolean", "description": "When enabled (true), retrieves extended profile attributes from Azure AD via Microsoft Graph API (job title, department, office location, etc.). Requires Graph API permissions. Only available with Azure AD v1 or when explicitly enabled for v2." }, "federated_connections_access_tokens": { "description": "Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.", "type": "object", "properties": { "active": { "type": "boolean", "description": "Enables refresh tokens and access tokens collection for federated connections" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "granted": { "type": "boolean", "description": "Indicates whether admin consent has been granted for the required Azure AD permissions. Read-only status field managed by Auth0 during the OAuth authorization flow." }, "icon_url": { "description": "URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "identity_api": { "description": "The Azure AD endpoint version for authentication. 'microsoft-identity-platform-v2.0' (recommended, default) supports modern OAuth 2.0 features. 'azure-active-directory-v1.0' is the legacy endpoint with protocol limitations. Selection affects available features.", "type": "string", "enum": [ "microsoft-identity-platform-v2.0", "azure-active-directory-v1.0" ] }, "max_groups_to_retrieve": { "type": "string", "examples": [ "100" ], "minLength": 0, "maxLength": 10, "description": "Maximum number of Azure AD groups to retrieve per user during authentication. Helps prevent performance issues for users in many groups. Only applies when ext_groups is enabled. Leave empty to use platform default." }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "scope": { "type": "array", "items": { "type": "string", "minLength": 0, "maxLength": 100 }, "minItems": 0, "maxItems": 100, "description": "OAuth 2.0 scopes to request from Azure AD during authentication. Each scope represents a permission (e.g., 'User.Read', 'Group.Read.All'). Only applies with Microsoft Identity Platform v2.0. See Microsoft Graph permissions reference for available scopes." }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "should_trust_email_verified_connection": { "description": "Choose how Auth0 sets the email_verified field in the user profile.", "type": "string", "enum": [ "never_set_emails_as_verified", "always_set_emails_as_verified" ] }, "tenant_domain": { "anyOf": [ { "type": "string", "examples": [ "contoso.onmicrosoft.com" ], "minLength": 0, "maxLength": 512, "format": "hostname", "description": "Azure AD tenant domain as a hostname (e.g. contoso.onmicrosoft.com)." }, { "type": "string", "format": "uuid", "description": "Azure AD tenant domain as a UUID tenant ID." } ], "description": "The Azure AD tenant domain or tenant ID (UUID). Auto-populated from the 'domain' field. Can be either a hostname (e.g., 'contoso.onmicrosoft.com') or a UUID tenant ID." }, "tenantId": { "type": "string", "examples": [ "12345678-1234-1234-1234-123456789012" ], "minLength": 36, "maxLength": 36, "format": "uuid", "description": "The Azure AD tenant ID as a UUID. The unique identifier for your Azure AD organization. Must be a valid 36-character UUID." }, "thumbprints": { "type": "array", "items": { "type": "string", "examples": [ "AB12CD34EF56789012345678901234567890ABCD" ], "minLength": 0, "maxLength": 64, "description": "Certificate thumbprints for ADFS and Azure AD connections." }, "minItems": 0, "maxItems": 20, "description": "Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string." }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "use_wsfed": { "type": "boolean", "description": "Indicates WS-Federation protocol usage. When true, uses WS-Federation; when false, uses OpenID Connect." }, "useCommonEndpoint": { "type": "boolean", "description": "When enabled (true), uses the Azure AD common endpoint for multi-tenant authentication. Allows users from any Azure AD organization to sign in. Requires userid_attribute set to 'sub' (not 'oid'). Cannot be used with SCIM provisioning. Defaults to false." }, "userid_attribute": { "description": "The Azure AD claim to use as the unique user identifier. 'oid' (Object ID) is recommended for single-tenant connections and required for SCIM. 'sub' (Subject) is required for multi-tenant/common endpoint. Only applies with OpenID Connect protocol.", "type": "string", "enum": [ "oid", "sub" ] }, "waad_protocol": { "description": "The authentication protocol for Azure AD v1 endpoints. 'openid-connect' (default, recommended) uses modern OAuth 2.0/OIDC. 'ws-federation' is a legacy SAML-based protocol for older integrations. Only available with Azure AD v1 API.", "type": "string", "enum": [ "ws-federation", "openid-connect" ] } }, "required": [ "client_id" ], "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "waad", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" } ] }, "previous_object": { "description": "The event content as it was prior to the change described by this event, when applicable.", "oneOf": [ { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" }, "cross_app_access": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "options": { "description": "Options for the 'oidc' connection", "type": "object", "properties": { "authorization_endpoint": { "description": "URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/authorize" ], "minLength": 8, "maxLength": 2083, "format": "uri" }, "client_id": { "type": "string", "examples": [ "abc123def456ghi789" ], "minLength": 0, "maxLength": 255, "description": "OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider." }, "connection_settings": { "description": "OAuth 2.0 PKCE (Proof Key for Code Exchange) settings. PKCE enhances security for public clients by preventing authorization code interception attacks. 'auto' (recommended) uses the strongest method supported by the IdP.", "type": "object", "properties": { "pkce": { "description": "PKCE configuration.", "type": "string", "enum": [ "auto", "S256", "plain", "disabled" ] } }, "unevaluatedProperties": { "not": {} } }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 1000, "description": "Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication." }, "dpop_signing_alg": { "description": "Algorithm used for DPoP proof JWT signing. Applicable when strategy=oidc or okta.", "type": "string", "enum": [ "ES256", "ES384", "ES512", "Ed25519" ] }, "federated_connections_access_tokens": { "description": "Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.", "type": "object", "properties": { "active": { "type": "boolean", "description": "Enables refresh tokens and access tokens collection for federated connections" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "icon_url": { "description": "https url of the icon to be shown", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "id_token_session_expiry_supported": { "type": "boolean", "description": "Indicates whether the identity provider supports session expiry via the id_token. If true, the system will use the session_expiry claim in the id_token to determine session expiry." }, "id_token_signed_response_algs": { "type": "array", "items": { "type": "string", "enum": [ "ES256", "ES384", "PS256", "PS384", "RS256", "RS384", "RS512" ], "description": "Algorithm allowed to verify the ID tokens." }, "description": "List of algorithms allowed to verify the ID tokens. Applicable when strategy=oidc or okta." }, "issuer": { "description": "The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.", "type": "string", "examples": [ "https://accounts.example.com" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "jwks_uri": { "description": "URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.", "type": "string", "examples": [ "https://provider.example.com/.well-known/jwks.json" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "oidc_metadata": { "description": "OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata", "type": "object", "properties": { "acr_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "urn:mace:incommon:iap:silver" ], "maxLength": 100 }, "minItems": 0, "maxItems": 30, "description": "A list of the Authentication Context Class References that this OP supports" }, "authorization_endpoint": { "description": "URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/authorize" ], "minLength": 8, "maxLength": 2083, "format": "uri" }, "claim_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "normal" ], "maxLength": 25 }, "minItems": 0, "maxItems": 10, "description": "JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims." }, "claims_locales_supported": { "type": "array", "items": { "type": "string", "examples": [ "en-US" ], "maxLength": 50 }, "minItems": 0, "maxItems": 100, "description": "Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values." }, "claims_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false." }, "claims_supported": { "type": "array", "items": { "type": "string", "examples": [ "sub" ], "maxLength": 100 }, "minItems": 0, "maxItems": 150, "description": "JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list." }, "code_challenge_methods_supported": { "type": "array", "items": { "type": "string", "examples": [ "S256" ], "maxLength": 20 }, "minItems": 0, "maxItems": 10, "description": "JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636." }, "display_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "page" ], "maxLength": 10 }, "minItems": 0, "maxItems": 6, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used." }, "dpop_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "ES256" ], "maxLength": 14 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing." }, "end_session_endpoint": { "type": "string", "examples": [ "https://provider.example.com/oauth/logout" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme." }, "grant_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "authorization_code" ], "maxLength": 100 }, "minItems": 0, "maxItems": 20, "description": "A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"]." }, "id_token_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RSA-OAEP" ], "maxLength": 14 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT" }, "id_token_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT]." }, "id_token_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10, "description": "JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata)." }, "minItems": 1, "maxItems": 26, "description": "A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518" }, "issuer": { "description": "The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.", "type": "string", "examples": [ "https://accounts.example.com" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "jwks_uri": { "description": "URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.", "type": "string", "examples": [ "https://provider.example.com/.well-known/jwks.json" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "op_policy_uri": { "type": "string", "examples": [ "https://provider.example.com/policy" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given." }, "op_tos_uri": { "type": "string", "examples": [ "https://provider.example.com/terms" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given." }, "registration_endpoint": { "type": "string", "examples": [ "https://provider.example.com/oauth/register" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration" }, "request_object_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RSA-OAEP" ], "maxLength": 28 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference." }, "request_object_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference." }, "request_object_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256." }, "request_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false." }, "request_uri_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false." }, "require_request_uri_registration": { "type": "boolean", "description": "Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false." }, "response_modes_supported": { "type": "array", "items": { "type": "string", "examples": [ "query" ], "maxLength": 20 }, "minItems": 0, "maxItems": 16, "description": "A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]" }, "response_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "code" ], "maxLength": 40 }, "minItems": 1, "maxItems": 40, "description": "A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values" }, "scopes_supported": { "type": "array", "items": { "type": "string", "examples": [ "openid" ], "maxLength": 100 }, "minItems": 0, "maxItems": 7000, "description": "A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED" }, "service_documentation": { "type": "string", "examples": [ "https://provider.example.com/docs" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation." }, "subject_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "public" ], "minLength": 0, "maxLength": 100 }, "minItems": 0, "maxItems": 20, "description": "A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public" }, "token_endpoint": { "description": "URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/token" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "token_endpoint_auth_methods_supported": { "type": "array", "items": { "type": "string", "examples": [ "client_secret_basic" ], "maxLength": 60 }, "minItems": 0, "maxItems": 14, "description": "JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749]." }, "token_endpoint_auth_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 24, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used." }, "ui_locales_supported": { "type": "array", "items": { "type": "string", "examples": [ "en-US" ], "maxLength": 50 }, "minItems": 0, "maxItems": 150, "description": "Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values." }, "userinfo_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]." }, "userinfo_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]." }, "userinfo_endpoint": { "description": "Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.", "type": "string", "examples": [ "https://provider.example.com/oauth/userinfo" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "userinfo_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included." } }, "required": [ "authorization_endpoint", "id_token_signing_alg_values_supported", "issuer", "jwks_uri" ], "unevaluatedProperties": { "not": {} } }, "schema_version": { "description": "The internal schema version of the connection options.", "type": "string", "enum": [ "openid-1.0.0", "oidc-v4" ] }, "scope": { "type": "string", "examples": [ "openid profile email" ], "minLength": 6, "maxLength": 255, "description": "Space-separated list of OAuth 2.0 scopes requested during authorization. Must include 'openid' (required by OIDC spec). Common values: 'openid profile email'. Additional scopes depend on the identity provider." }, "send_back_channel_nonce": { "type": "boolean", "description": "When true and type is 'back_channel', includes a cryptographic nonce in authorization requests to prevent replay attacks. The identity provider must include this nonce in the ID token for validation." }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "tenant_domain": { "description": "Tenant domain", "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255 }, "token_endpoint": { "description": "URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/token" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "token_endpoint_auth_method": { "description": "Authentication method used at the identity provider's token endpoint. 'client_secret_post' sends credentials in the request body; 'private_key_jwt' uses a signed JWT assertion for enhanced security. Applicable when strategy=oidc or okta.", "type": "string", "enum": [ "client_secret_post", "private_key_jwt" ] }, "token_endpoint_auth_signing_alg": { "description": "Algorithm used to sign client_assertions. Applicable when strategy=oidc or okta.", "type": "string", "enum": [ "ES256", "ES384", "PS256", "PS384", "RS256", "RS384", "RS512" ] }, "token_endpoint_jwtca_aud_format": { "description": "Specifies the format of the aud (audience) claim included in the JWT used for client authentication at the token endpoint. Accepted values are: 'issuer' (the aud claim is set to the OIDC issuer URL) or 'token_endpoint' (the aud claim is set to the token endpoint URL).", "type": "string", "enum": [ "issuer", "token_endpoint" ] }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "useOauthSpecScope": { "type": "boolean", "description": "When true, uses space-delimited scopes (per OAuth 2.0 spec) instead of comma-delimited when calling the identity provider's authorization endpoint. Only relevant when using the connection_scope parameter. See https://auth0.com/docs/authenticate/identity-providers/adding-scopes-for-an-external-idp#pass-scopes-to-authorize-endpoint" }, "userinfo_endpoint": { "description": "Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.", "type": "string", "examples": [ "https://provider.example.com/oauth/userinfo" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "attribute_map": { "description": "Configuration for mapping claims from the identity provider to Auth0 user profile attributes. Allows customizing which IdP claims populate user fields and how they are transformed.", "type": "object", "properties": { "attributes": { "description": "Object containing mapping details for incoming claims", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "userinfo_scope": { "type": "string", "examples": [ "openid profile email" ], "minLength": 0, "maxLength": 255, "description": "Scopes to send to the IdP's Userinfo endpoint" }, "mapping_mode": { "description": "Method used to map incoming claims when strategy=oidc.", "type": "string", "enum": [ "bind_all", "use_map" ] } }, "unevaluatedProperties": { "not": {} } }, "discovery_url": { "type": "string", "examples": [ "https://provider.example.com/.well-known/openid-configuration" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the identity provider's OIDC Discovery endpoint (/.well-known/openid-configuration). When provided and oidc_metadata is empty, Auth0 automatically retrieves the provider's configuration including endpoints and supported features." }, "type": { "description": "OIDC communication channel type. 'back_channel' (confidential client) exchanges tokens server-side for stronger security; 'front_channel' handles responses in the browser.", "type": "string", "enum": [ "back_channel", "front_channel" ] } }, "required": [ "client_id" ], "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "oidc", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'okta' connection", "type": "object", "properties": { "authorization_endpoint": { "description": "URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/authorize" ], "minLength": 8, "maxLength": 2083, "format": "uri" }, "client_id": { "type": "string", "examples": [ "abc123def456ghi789" ], "minLength": 0, "maxLength": 255, "description": "OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider." }, "connection_settings": { "description": "OAuth 2.0 PKCE (Proof Key for Code Exchange) settings. PKCE enhances security for public clients by preventing authorization code interception attacks. 'auto' (recommended) uses the strongest method supported by the IdP.", "type": "object", "properties": { "pkce": { "description": "PKCE configuration.", "type": "string", "enum": [ "auto", "S256", "plain", "disabled" ] } }, "unevaluatedProperties": { "not": {} } }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 1000, "description": "Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication." }, "dpop_signing_alg": { "description": "Algorithm used for DPoP proof JWT signing. Applicable when strategy=oidc or okta.", "type": "string", "enum": [ "ES256", "ES384", "ES512", "Ed25519" ] }, "federated_connections_access_tokens": { "description": "Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.", "type": "object", "properties": { "active": { "type": "boolean", "description": "Enables refresh tokens and access tokens collection for federated connections" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "icon_url": { "description": "https url of the icon to be shown", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "id_token_session_expiry_supported": { "type": "boolean", "description": "Indicates whether the identity provider supports session expiry via the id_token. If true, the system will use the session_expiry claim in the id_token to determine session expiry." }, "id_token_signed_response_algs": { "type": "array", "items": { "type": "string", "enum": [ "ES256", "ES384", "PS256", "PS384", "RS256", "RS384", "RS512" ], "description": "Algorithm allowed to verify the ID tokens." }, "description": "List of algorithms allowed to verify the ID tokens. Applicable when strategy=oidc or okta." }, "issuer": { "description": "The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.", "type": "string", "examples": [ "https://accounts.example.com" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "jwks_uri": { "description": "URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.", "type": "string", "examples": [ "https://provider.example.com/.well-known/jwks.json" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "oidc_metadata": { "description": "OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata", "type": "object", "properties": { "acr_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "urn:mace:incommon:iap:silver" ], "maxLength": 100 }, "minItems": 0, "maxItems": 30, "description": "A list of the Authentication Context Class References that this OP supports" }, "authorization_endpoint": { "description": "URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/authorize" ], "minLength": 8, "maxLength": 2083, "format": "uri" }, "claim_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "normal" ], "maxLength": 25 }, "minItems": 0, "maxItems": 10, "description": "JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims." }, "claims_locales_supported": { "type": "array", "items": { "type": "string", "examples": [ "en-US" ], "maxLength": 50 }, "minItems": 0, "maxItems": 100, "description": "Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values." }, "claims_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false." }, "claims_supported": { "type": "array", "items": { "type": "string", "examples": [ "sub" ], "maxLength": 100 }, "minItems": 0, "maxItems": 150, "description": "JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list." }, "code_challenge_methods_supported": { "type": "array", "items": { "type": "string", "examples": [ "S256" ], "maxLength": 20 }, "minItems": 0, "maxItems": 10, "description": "JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636." }, "display_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "page" ], "maxLength": 10 }, "minItems": 0, "maxItems": 6, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used." }, "dpop_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "ES256" ], "maxLength": 14 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing." }, "end_session_endpoint": { "type": "string", "examples": [ "https://provider.example.com/oauth/logout" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme." }, "grant_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "authorization_code" ], "maxLength": 100 }, "minItems": 0, "maxItems": 20, "description": "A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"]." }, "id_token_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RSA-OAEP" ], "maxLength": 14 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT" }, "id_token_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT]." }, "id_token_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10, "description": "JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata)." }, "minItems": 1, "maxItems": 26, "description": "A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518" }, "issuer": { "description": "The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.", "type": "string", "examples": [ "https://accounts.example.com" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "jwks_uri": { "description": "URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.", "type": "string", "examples": [ "https://provider.example.com/.well-known/jwks.json" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "op_policy_uri": { "type": "string", "examples": [ "https://provider.example.com/policy" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given." }, "op_tos_uri": { "type": "string", "examples": [ "https://provider.example.com/terms" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given." }, "registration_endpoint": { "type": "string", "examples": [ "https://provider.example.com/oauth/register" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration" }, "request_object_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RSA-OAEP" ], "maxLength": 28 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference." }, "request_object_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference." }, "request_object_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256." }, "request_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false." }, "request_uri_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false." }, "require_request_uri_registration": { "type": "boolean", "description": "Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false." }, "response_modes_supported": { "type": "array", "items": { "type": "string", "examples": [ "query" ], "maxLength": 20 }, "minItems": 0, "maxItems": 16, "description": "A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]" }, "response_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "code" ], "maxLength": 40 }, "minItems": 1, "maxItems": 40, "description": "A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values" }, "scopes_supported": { "type": "array", "items": { "type": "string", "examples": [ "openid" ], "maxLength": 100 }, "minItems": 0, "maxItems": 7000, "description": "A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED" }, "service_documentation": { "type": "string", "examples": [ "https://provider.example.com/docs" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation." }, "subject_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "public" ], "minLength": 0, "maxLength": 100 }, "minItems": 0, "maxItems": 20, "description": "A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public" }, "token_endpoint": { "description": "URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/token" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "token_endpoint_auth_methods_supported": { "type": "array", "items": { "type": "string", "examples": [ "client_secret_basic" ], "maxLength": 60 }, "minItems": 0, "maxItems": 14, "description": "JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749]." }, "token_endpoint_auth_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 24, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used." }, "ui_locales_supported": { "type": "array", "items": { "type": "string", "examples": [ "en-US" ], "maxLength": 50 }, "minItems": 0, "maxItems": 150, "description": "Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values." }, "userinfo_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]." }, "userinfo_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]." }, "userinfo_endpoint": { "description": "Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.", "type": "string", "examples": [ "https://provider.example.com/oauth/userinfo" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "userinfo_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included." } }, "required": [ "authorization_endpoint", "id_token_signing_alg_values_supported", "issuer", "jwks_uri" ], "unevaluatedProperties": { "not": {} } }, "schema_version": { "description": "The internal schema version of the connection options.", "type": "string", "enum": [ "openid-1.0.0", "oidc-v4" ] }, "scope": { "type": "string", "examples": [ "openid profile email" ], "minLength": 6, "maxLength": 255, "description": "Space-separated list of OAuth 2.0 scopes requested during authorization. Must include 'openid' (required by OIDC spec). Common values: 'openid profile email'. Additional scopes depend on the identity provider." }, "send_back_channel_nonce": { "type": "boolean", "description": "When true and type is 'back_channel', includes a cryptographic nonce in authorization requests to prevent replay attacks. The identity provider must include this nonce in the ID token for validation." }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "tenant_domain": { "description": "Tenant domain", "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255 }, "token_endpoint": { "description": "URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/token" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "token_endpoint_auth_method": { "description": "Authentication method used at the identity provider's token endpoint. 'client_secret_post' sends credentials in the request body; 'private_key_jwt' uses a signed JWT assertion for enhanced security. Applicable when strategy=oidc or okta.", "type": "string", "enum": [ "client_secret_post", "private_key_jwt" ] }, "token_endpoint_auth_signing_alg": { "description": "Algorithm used to sign client_assertions. Applicable when strategy=oidc or okta.", "type": "string", "enum": [ "ES256", "ES384", "PS256", "PS384", "RS256", "RS384", "RS512" ] }, "token_endpoint_jwtca_aud_format": { "description": "Specifies the format of the aud (audience) claim included in the JWT used for client authentication at the token endpoint. Accepted values are: 'issuer' (the aud claim is set to the OIDC issuer URL) or 'token_endpoint' (the aud claim is set to the token endpoint URL).", "type": "string", "enum": [ "issuer", "token_endpoint" ] }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "useOauthSpecScope": { "type": "boolean", "description": "When true, uses space-delimited scopes (per OAuth 2.0 spec) instead of comma-delimited when calling the identity provider's authorization endpoint. Only relevant when using the connection_scope parameter. See https://auth0.com/docs/authenticate/identity-providers/adding-scopes-for-an-external-idp#pass-scopes-to-authorize-endpoint" }, "userinfo_endpoint": { "description": "Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.", "type": "string", "examples": [ "https://provider.example.com/oauth/userinfo" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "attribute_map": { "description": "Mapping of claims received from the identity provider (IdP)", "type": "object", "properties": { "attributes": { "description": "Object containing mapping details for incoming claims", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "userinfo_scope": { "type": "string", "examples": [ "openid profile email" ], "minLength": 0, "maxLength": 255, "description": "Scopes to send to the IdP's Userinfo endpoint" }, "mapping_mode": { "description": "Method used to map incoming claims when strategy=okta.", "type": "string", "enum": [ "basic_profile", "use_map" ] } }, "unevaluatedProperties": { "not": {} } }, "domain": { "type": "string", "examples": [ "dev-123456.okta.com" ], "minLength": 4, "maxLength": 255, "description": "Domain of the Okta organization (e.g., dev-123456.okta.com). Should be just the domain of the okta server with no scheme or trailing backslash. Discovery runs only when connection.options.oidc_metadata is empty and a domain is provided" }, "type": { "description": "Connection type", "type": "string", "enum": [ "back_channel" ] } }, "required": [ "client_id" ], "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "okta", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'samlp' connection", "type": "object", "properties": { "assertion_decryption_settings": { "description": "Settings for SAML assertion decryption.", "type": "object", "properties": { "algorithm_exceptions": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 100 }, "maxItems": 10, "description": "A list of insecure algorithms to allow for SAML assertion decryption." }, "algorithm_profile": { "description": "The algorithm profile to use for decrypting SAML assertions.", "type": "string", "enum": [ "v2026-1" ] } }, "required": [ "algorithm_profile" ], "unevaluatedProperties": { "not": {} } }, "cert": { "type": "string", "minLength": 1, "maxLength": 10240, "description": "X.509 signing certificate from the identity provider in .der format. Used to validate signatures in SAML Responses and Assertions. This is an alternative to signingCert and is kept for backward compatibility. Prefer using signingCert instead.", "deprecated": true }, "cert_rollover_notification": { "type": "string", "format": "date-time", "description": "Timestamp of the last certificate expiring soon notification." }, "digestAlgorithm": { "description": "Algorithm used for computing digest values when signing SAML requests and logout requests. Defaults to 'sha256'.", "type": "string", "enum": [ "sha1", "sha256" ] }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 50001, "description": "Domain aliases for the connection" }, "entityId": { "description": "The entity identifier (Issuer) for the SAML Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'. This value is included in SAML AuthnRequest messages sent to the identity provider.", "type": "string", "examples": [ "urn:auth0:my-tenant:my-connection" ], "minLength": 1, "maxLength": 128 }, "expires": { "type": "string", "format": "date-time", "description": "ISO 8601 formatted datetime indicating when the identity provider's signing certificate expires." }, "icon_url": { "description": "URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "idpinitiated": { "description": "Configuration for IdP-Initiated SAML Single Sign-On. When enabled, allows users to initiate login directly from their SAML identity provider without first visiting Auth0. The IdP must include the connection parameter in the post-back URL (Assertion Consumer Service URL).", "type": "object", "properties": { "client_authorizequery": { "type": "string", "minLength": 1, "maxLength": 2048, "description": "The query string sent to the default application" }, "client_id": { "type": "string", "minLength": 1, "maxLength": 256, "description": "The client ID to use for IdP-initiated login requests." }, "client_protocol": { "description": "The response protocol used to communicate with the default application.", "type": "string", "enum": [ "oidc", "samlp", "wsfed" ] }, "enabled": { "type": "boolean", "description": "When true, enables IdP-initiated login support for this SAML connection. Allows users to log in directly from the identity provider without first visiting Auth0." } }, "unevaluatedProperties": { "not": {} } }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "protocolBinding": { "description": "SAML protocol binding mechanism for sending authentication requests to the identity provider.", "type": "string", "enum": [ "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST", "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" ] }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "signatureAlgorithm": { "description": "Algorithm used to sign SAML authentication requests and logout requests using the connection's signing key. Common values: 'rsa-sha256' (RSA signature with SHA-256 digest) or 'rsa-sha1'. Defaults to 'rsa-sha256'.", "type": "string", "enum": [ "rsa-sha1", "rsa-sha256" ] }, "signInEndpoint": { "description": "Identity provider's SAML SingleSignOnService endpoint URL where Auth0 sends SAML authentication requests. This is the primary login URL for the SAML connection. Required unless using metadataUrl or metadataXml.", "type": "string", "examples": [ "https://idp.example.com/saml/sso" ], "minLength": 8, "maxLength": 2048, "format": "uri" }, "signingCert": { "description": "Base64-encoded X.509 certificate from the identity provider used to validate signatures in SAML responses and assertions. The certificate is decoded and used for cryptographic signature verification.", "type": "string", "examples": [ "MIIDDTCCAfWgAwIBAgIJALFkBP7GVlWkMA0GCSqGSIb3DQEBCwUAMCUxIzAhBgNV" ], "minLength": 1, "maxLength": 10240 }, "signSAMLRequest": { "type": "boolean", "description": "When true, Auth0 signs SAML authentication requests using the connection's signing key. The signature includes the request's digest and is validated by the identity provider. Defaults to false (unsigned requests)." }, "subject": { "description": "Certificate Subject Distinguished Name (DN) extracted from the identity provider's signing certificate.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "tenant_domain": { "description": "For SAML connections, the tenant domain used to construct the login endpoint URL. Can be a string for single-tenant or an array of strings for multi-tenant validation.", "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255 }, "thumbprints": { "type": "array", "items": { "type": "string", "examples": [ "ef34ab56cd78901234567890123456789012efab" ], "minLength": 40, "maxLength": 40 }, "minItems": 0, "maxItems": 1, "description": "SHA-1 thumbprints (fingerprints) of the identity provider's signing certificates. Automatically computed from signingCert during connection creation. Each thumbprint must be a 40-character hexadecimal string." }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "debug": { "type": "boolean", "description": "When true, enables detailed SAML debugging by issuing 'w' (warning) events in tenant logs containing SAML request/response details. WARNING: Potentially exposes sensitive user information (PII, credentials) and should only be enabled temporarily for debugging purposes." }, "deflate": { "type": "boolean", "description": "When true, enables DEFLATE compression for SAML requests sent via HTTP-Redirect binding." }, "destinationUrl": { "type": "string", "examples": [ "https://idp.example.com/saml/sso" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "The URL where Auth0 will send SAML authentication requests (the Identity Provider's SSO URL). Must be a valid HTTPS URL." }, "disableFieldsMapFix": { "type": "boolean", "description": "When true, disables the automatic correction of the fieldsMap configuration to ensure proper mapping of SAML attributes to user profile fields. Defaults to false (fieldsMap fix enabled)." }, "disableSignout": { "type": "boolean", "description": "When true, disables sending SAML logout requests (SingleLogoutService) to the identity provider during user sign-out. The user will be logged out of Auth0 but will remain logged into the identity provider. Defaults to false (federated logout enabled)." }, "discovery_url": { "type": "string", "examples": [ "https://provider.example.com/.well-known/openid-configuration" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the identity provider's OIDC Discovery endpoint (/.well-known/openid-configuration). When provided and oidc_metadata is empty, Auth0 automatically retrieves the provider's configuration including endpoints and supported features. Used with Cross App Access.", "x-release-lifecycle": "EA" }, "fieldsMap": { "description": "Maps SAML assertion attributes from the identity provider to Auth0 user profile attributes. Format: { 'auth0_field': 'saml_attribute' } or { 'auth0_field': ['saml_attr1', 'saml_attr2'] } for fallback options. Merged with default mappings for email, name, given_name, family_name, and groups.", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "fieldsMapJsonRaw": { "type": "string", "minLength": 0, "maxLength": 8192, "description": "Raw JSON string representation of the fieldsMap configuration. Used internally for storage and retrieval of the fieldsMap object." }, "global_token_revocation_jwt_iss": { "type": "string", "minLength": 1, "maxLength": 1024, "description": "Expected 'iss' (Issuer) claim value for JWT tokens in Global Token Revocation requests from the identity provider. When configured, Auth0 validates the JWT issuer matches this value before processing token revocation. Must be used together with global_token_revocation_jwt_sub." }, "global_token_revocation_jwt_sub": { "type": "string", "minLength": 1, "maxLength": 1024, "description": "Expected 'sub' (Subject) claim value for JWT tokens in Global Token Revocation requests from the identity provider. When configured, Auth0 validates the JWT subject matches this value before processing token revocation. Must be used together with global_token_revocation_jwt_iss." }, "metadataUrl": { "type": "string", "examples": [ "https://idp.example.com/saml/metadata" ], "minLength": 8, "maxLength": 2048, "format": "uri", "description": "HTTPS URL to the identity provider's SAML metadata document. When provided, Auth0 automatically fetches and parses the metadata to extract signInEndpoint, signOutEndpoint, signingCert, signSAMLRequest, and protocolBinding. Use metadataUrl OR metadataXml, not both." }, "oidc_metadata": { "description": "OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata. Used with Cross App Access.", "x-release-lifecycle": "EA", "type": "object", "properties": { "acr_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "urn:mace:incommon:iap:silver" ], "maxLength": 100 }, "minItems": 0, "maxItems": 30, "description": "A list of the Authentication Context Class References that this OP supports" }, "authorization_endpoint": { "description": "URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/authorize" ], "minLength": 8, "maxLength": 2083, "format": "uri" }, "claim_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "normal" ], "maxLength": 25 }, "minItems": 0, "maxItems": 10, "description": "JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims." }, "claims_locales_supported": { "type": "array", "items": { "type": "string", "examples": [ "en-US" ], "maxLength": 50 }, "minItems": 0, "maxItems": 100, "description": "Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values." }, "claims_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false." }, "claims_supported": { "type": "array", "items": { "type": "string", "examples": [ "sub" ], "maxLength": 100 }, "minItems": 0, "maxItems": 150, "description": "JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list." }, "code_challenge_methods_supported": { "type": "array", "items": { "type": "string", "examples": [ "S256" ], "maxLength": 20 }, "minItems": 0, "maxItems": 10, "description": "JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636." }, "display_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "page" ], "maxLength": 10 }, "minItems": 0, "maxItems": 6, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used." }, "dpop_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "ES256" ], "maxLength": 14 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing." }, "end_session_endpoint": { "type": "string", "examples": [ "https://provider.example.com/oauth/logout" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme." }, "grant_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "authorization_code" ], "maxLength": 100 }, "minItems": 0, "maxItems": 20, "description": "A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"]." }, "id_token_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RSA-OAEP" ], "maxLength": 14 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT" }, "id_token_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT]." }, "id_token_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10, "description": "JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata)." }, "minItems": 1, "maxItems": 26, "description": "A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518" }, "issuer": { "description": "The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.", "type": "string", "examples": [ "https://accounts.example.com" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "jwks_uri": { "description": "URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.", "type": "string", "examples": [ "https://provider.example.com/.well-known/jwks.json" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "op_policy_uri": { "type": "string", "examples": [ "https://provider.example.com/policy" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given." }, "op_tos_uri": { "type": "string", "examples": [ "https://provider.example.com/terms" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given." }, "registration_endpoint": { "type": "string", "examples": [ "https://provider.example.com/oauth/register" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration" }, "request_object_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RSA-OAEP" ], "maxLength": 28 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference." }, "request_object_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference." }, "request_object_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256." }, "request_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false." }, "request_uri_parameter_supported": { "type": "boolean", "description": "Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false." }, "require_request_uri_registration": { "type": "boolean", "description": "Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false." }, "response_modes_supported": { "type": "array", "items": { "type": "string", "examples": [ "query" ], "maxLength": 20 }, "minItems": 0, "maxItems": 16, "description": "A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]" }, "response_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "code" ], "maxLength": 40 }, "minItems": 1, "maxItems": 40, "description": "A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values" }, "scopes_supported": { "type": "array", "items": { "type": "string", "examples": [ "openid" ], "maxLength": 100 }, "minItems": 0, "maxItems": 7000, "description": "A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED" }, "service_documentation": { "type": "string", "examples": [ "https://provider.example.com/docs" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation." }, "subject_types_supported": { "type": "array", "items": { "type": "string", "examples": [ "public" ], "minLength": 0, "maxLength": 100 }, "minItems": 0, "maxItems": 20, "description": "A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public" }, "token_endpoint": { "description": "URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.", "type": "string", "examples": [ "https://provider.example.com/oauth/token" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "token_endpoint_auth_methods_supported": { "type": "array", "items": { "type": "string", "examples": [ "client_secret_basic" ], "maxLength": 60 }, "minItems": 0, "maxItems": 14, "description": "JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749]." }, "token_endpoint_auth_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 24, "description": "JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used." }, "ui_locales_supported": { "type": "array", "items": { "type": "string", "examples": [ "en-US" ], "maxLength": 50 }, "minItems": 0, "maxItems": 150, "description": "Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values." }, "userinfo_encryption_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]." }, "userinfo_encryption_enc_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "A128CBC-HS256" ], "maxLength": 26 }, "minItems": 0, "maxItems": 12, "description": "JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]." }, "userinfo_endpoint": { "description": "Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.", "type": "string", "examples": [ "https://provider.example.com/oauth/userinfo" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "userinfo_signing_alg_values_supported": { "type": "array", "items": { "type": "string", "examples": [ "RS256" ], "maxLength": 10 }, "minItems": 0, "maxItems": 26, "description": "JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included." } }, "required": [ "authorization_endpoint", "id_token_signing_alg_values_supported", "issuer", "jwks_uri" ], "unevaluatedProperties": { "not": {} } }, "recipientUrl": { "type": "string", "examples": [ "https://idp.example.com/saml/acs" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "The URL where Auth0 will send SAML authentication requests (the Identity Provider's SSO URL). Must be a valid HTTPS URL." }, "requestTemplate": { "type": "string", "minLength": 1, "maxLength": 10240, "description": "Custom XML template for SAML authentication requests. Supports variable substitution using @@variableName@@ syntax. When not provided, uses default SAML AuthnRequest template. See https://auth0.com/docs/authenticate/protocols/saml/saml-sso-integrations/configure-auth0-saml-service-provider#customize-the-request-template" }, "signOutEndpoint": { "type": "string", "examples": [ "https://idp.example.com/saml/slo" ], "minLength": 8, "maxLength": 2048, "format": "uri", "description": "Identity provider's SAML SingleLogoutService endpoint URL where Auth0 sends logout requests for federated sign-out. When not provided, defaults to signInEndpoint. Only used if disableSignout is false." }, "user_id_attribute": { "type": "string", "minLength": 1, "maxLength": 2396, "description": "Custom SAML assertion attribute to use as the unique user identifier. When provided, this attribute is prepended to the default user_id mapping list with highest priority. Accepts a string (single SAML attribute name)." } }, "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "samlp", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'pingfederate' connection", "type": "object", "properties": { "assertion_decryption_settings": { "description": "Settings for SAML assertion decryption.", "type": "object", "properties": { "algorithm_exceptions": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 100 }, "maxItems": 10, "description": "A list of insecure algorithms to allow for SAML assertion decryption." }, "algorithm_profile": { "description": "The algorithm profile to use for decrypting SAML assertions.", "type": "string", "enum": [ "v2026-1" ] } }, "required": [ "algorithm_profile" ], "unevaluatedProperties": { "not": {} } }, "cert": { "type": "string", "minLength": 1, "maxLength": 10240, "description": "X.509 signing certificate from the identity provider in .der format. Used to validate signatures in SAML Responses and Assertions. This is an alternative to signingCert and is kept for backward compatibility. Prefer using signingCert instead.", "deprecated": true }, "cert_rollover_notification": { "type": "string", "format": "date-time", "description": "Timestamp of the last certificate expiring soon notification." }, "digestAlgorithm": { "description": "Algorithm used for computing digest values when signing SAML requests and logout requests. Defaults to 'sha256'.", "type": "string", "enum": [ "sha1", "sha256" ] }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 50001, "description": "Domain aliases for the connection" }, "entityId": { "description": "The entity identifier (Issuer) for the SAML Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'. This value is included in SAML AuthnRequest messages sent to the identity provider.", "type": "string", "examples": [ "urn:auth0:my-tenant:my-connection" ], "minLength": 1, "maxLength": 128 }, "expires": { "type": "string", "format": "date-time", "description": "ISO 8601 formatted datetime indicating when the identity provider's signing certificate expires." }, "icon_url": { "description": "URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "idpinitiated": { "description": "Configuration for IdP-Initiated SAML Single Sign-On. When enabled, allows users to initiate login directly from their SAML identity provider without first visiting Auth0. The IdP must include the connection parameter in the post-back URL (Assertion Consumer Service URL).", "type": "object", "properties": { "client_authorizequery": { "type": "string", "minLength": 1, "maxLength": 2048, "description": "The query string sent to the default application" }, "client_id": { "type": "string", "minLength": 1, "maxLength": 256, "description": "The client ID to use for IdP-initiated login requests." }, "client_protocol": { "description": "The response protocol used to communicate with the default application.", "type": "string", "enum": [ "oidc", "samlp", "wsfed" ] }, "enabled": { "type": "boolean", "description": "When true, enables IdP-initiated login support for this SAML connection. Allows users to log in directly from the identity provider without first visiting Auth0." } }, "unevaluatedProperties": { "not": {} } }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "protocolBinding": { "description": "SAML protocol binding mechanism for sending authentication requests to the identity provider.", "type": "string", "enum": [ "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST", "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" ] }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "signatureAlgorithm": { "description": "Algorithm used to sign SAML authentication requests and logout requests using the connection's signing key. Common values: 'rsa-sha256' (RSA signature with SHA-256 digest) or 'rsa-sha1'. Defaults to 'rsa-sha256'.", "type": "string", "enum": [ "rsa-sha1", "rsa-sha256" ] }, "signInEndpoint": { "description": "Identity provider's SAML SingleSignOnService endpoint URL where Auth0 sends SAML authentication requests. This is the primary login URL for the SAML connection. Required unless using metadataUrl or metadataXml.", "type": "string", "examples": [ "https://idp.example.com/saml/sso" ], "minLength": 8, "maxLength": 2048, "format": "uri" }, "signingCert": { "description": "Base64-encoded X.509 certificate from the identity provider used to validate signatures in SAML responses and assertions. The certificate is decoded and used for cryptographic signature verification.", "type": "string", "examples": [ "MIIDDTCCAfWgAwIBAgIJALFkBP7GVlWkMA0GCSqGSIb3DQEBCwUAMCUxIzAhBgNV" ], "minLength": 1, "maxLength": 10240 }, "signSAMLRequest": { "type": "boolean", "description": "When true, Auth0 signs SAML authentication requests using the connection's signing key. The signature includes the request's digest and is validated by the identity provider. Defaults to false (unsigned requests)." }, "subject": { "description": "Certificate Subject Distinguished Name (DN) extracted from the identity provider's signing certificate.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "tenant_domain": { "description": "For SAML connections, the tenant domain used to construct the login endpoint URL. Can be a string for single-tenant or an array of strings for multi-tenant validation.", "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255 }, "thumbprints": { "type": "array", "items": { "type": "string", "examples": [ "ef34ab56cd78901234567890123456789012efab" ], "minLength": 40, "maxLength": 40 }, "minItems": 0, "maxItems": 1, "description": "SHA-1 thumbprints (fingerprints) of the identity provider's signing certificates. Automatically computed from signingCert during connection creation. Each thumbprint must be a 40-character hexadecimal string." }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "pingFederateBaseUrl": { "type": "string", "examples": [ "https://pingfederate.example.com" ], "minLength": 8, "maxLength": 256, "format": "uri", "description": "URL provided by PingFederate which returns information used for creating the connection" } }, "required": [ "pingFederateBaseUrl" ], "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "pingfederate", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'adfs' connection", "type": "object", "properties": { "adfs_server": { "type": "string", "examples": [ "adfs.example.com" ], "minLength": 0, "maxLength": 2048, "description": "ADFS federation metadata host or XML URL used to discover WS-Fed endpoints and certificates. Errors if adfs_server and fedMetadataXml are both absent." }, "cert_rollover_notification": { "type": "string", "format": "date-time", "description": "Timestamp of the last certificate expiring soon notification." }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 1000, "description": "Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication." }, "entityId": { "description": "The entity identifier (Issuer) for the ADFS Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'.", "type": "string", "examples": [ "urn:auth0:my-tenant:my-connection" ], "minLength": 1, "maxLength": 128 }, "fedMetadataXml": { "type": "string", "minLength": 1, "maxLength": 102400, "description": "Inline XML alternative to 'adfs_server'. Cannot be set together with 'adfs_server'." }, "icon_url": { "description": "URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "prev_thumbprints": { "type": "array", "items": { "type": "string", "examples": [ "AB12CD34EF56789012345678901234567890ABCD" ], "minLength": 0, "maxLength": 64, "description": "Certificate thumbprints for ADFS and Azure AD connections." }, "minItems": 0, "maxItems": 20, "description": "Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string." }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "should_trust_email_verified_connection": { "description": "Choose how Auth0 sets the email_verified field in the user profile.", "type": "string", "enum": [ "never_set_emails_as_verified", "always_set_emails_as_verified" ] }, "signInEndpoint": { "description": "Passive Requestor (WS-Fed) sign-in endpoint discovered from metadata or provided explicitly.", "type": "string", "examples": [ "https://idp.example.com/saml/sso" ], "minLength": 8, "maxLength": 2048, "format": "uri" }, "tenant_domain": { "description": "Tenant domain", "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255 }, "thumbprints": { "type": "array", "items": { "type": "string", "examples": [ "AB12CD34EF56789012345678901234567890ABCD" ], "minLength": 0, "maxLength": 64, "description": "Certificate thumbprints for ADFS and Azure AD connections." }, "minItems": 0, "maxItems": 20, "description": "Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string." }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "user_id_attribute": { "type": "string", "minLength": 1, "maxLength": 128, "description": "Custom ADFS claim to use as the unique user identifier. When provided, this attribute is prepended to the default user_id mapping list with highest priority. Accepts a string (single ADFS claim name)." } }, "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "adfs", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'ad' connection", "type": "object", "properties": { "agentIP": { "description": "IP address of the AD connector agent used to validate that authentication requests originate from the corporate network for Kerberos authentication (managed by the AD Connector agent).", "type": "string", "examples": [ "192.168.1.10" ], "minLength": 2, "maxLength": 39 }, "agentMode": { "type": "boolean", "description": "When enabled, allows direct username/password authentication through the AD connector agent instead of WS-Federation protocol (managed by the AD Connector agent)." }, "agentVersion": { "type": "string", "examples": [ "1.4.2" ], "minLength": 5, "maxLength": 12, "description": "Version identifier of the installed AD connector agent software (managed by the AD Connector agent)." }, "brute_force_protection": { "type": "boolean", "description": "Enables Auth0's brute force protection to prevent credential stuffing attacks. When enabled, blocks suspicious login attempts from specific IP addresses after repeated failures." }, "certAuth": { "type": "boolean", "description": "Enables client SSL certificate authentication for the AD connector, requiring HTTPS on the sign-in endpoint" }, "certs": { "type": "array", "items": { "type": "string", "examples": [ "MIIDDTCCAfWgAwIBAgIJALFkBP7GVlWkMA0GCSqGSIb3DQEBCwUAMCUxIzAhBgNVBAMTGmV4YW1wbGUuYXV0aDAuY29tIENlcnQgQ0EwHhcNMjUwMTAxMDAwMDAwWhcNMjYwMTAxMDAwMDAwWjAUMRIwEAYDVQQDEwlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC7o4qne60TB3wolFrzabc1234567890ABCDEFG" ], "minLength": 256, "maxLength": 3072 }, "minItems": 0, "maxItems": 2, "description": "Array of X.509 certificates in PEM format used for validating SAML signatures from the AD identity provider (managed by the AD Connector agent)." }, "disable_cache": { "type": "boolean", "description": "When enabled, disables caching of AD connector authentication results to ensure real-time validation against the directory" }, "disable_self_service_change_password": { "type": "boolean", "description": "When enabled, hides the 'Forgot Password' link on login pages to prevent users from initiating self-service password resets" }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 1000, "description": "List of domain names that can be used with identifier-first authentication flow to route users to this AD connection; each domain must be a valid DNS name up to 256 characters" }, "icon_url": { "description": "https url of the icon to be shown", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "ips": { "type": "array", "items": { "type": "string", "examples": [ "192.168.1.10" ], "minLength": 2, "maxLength": 39 }, "minItems": 0, "maxItems": 256, "description": "Array of IP address ranges in CIDR notation used to determine if authentication requests originate from the corporate network for Kerberos or certificate authentication." }, "kerberos": { "type": "boolean", "description": "Enables Windows Integrated Authentication (Kerberos) for seamless SSO when users authenticate from within the corporate network IP ranges" }, "kerberos_only": { "type": "boolean", "description": "When true, restricts the connection to Kerberos-only authentication, disallowing username/password fallback." }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "signInEndpoint": { "type": "string", "examples": [ "https://ad-connector.example.com" ], "minLength": 8, "maxLength": 255, "format": "uri", "description": "The sign-in endpoint type for the AD-LDAP connector agent (managed by the AD Connector agent)." }, "tenant_domain": { "type": "string", "examples": [ "corp.example.com" ], "minLength": 1, "maxLength": 512, "format": "hostname", "description": "Primary AD domain hint used for HRD and discovery." }, "thumbprints": { "type": "array", "items": { "type": "string", "examples": [ "8233ec9c12a44625d4a64ee413651fd928b5168f" ], "minLength": 40, "maxLength": 40 }, "minItems": 0, "maxItems": 2, "description": "Array of certificate SHA-1 thumbprints for validating signatures. Managed by Auth0 when using the AD Connector agent." }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} } }, "unevaluatedProperties": { "not": {} } }, "strategy": { "type": "string", "const": "ad", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'google-apps' connection", "type": "object", "properties": { "admin_access_token_expiresin": { "type": "string", "format": "date-time", "description": "Expiration timestamp for the `admin_access_token` in ISO 8601 format. Auth0 uses this value to determine when to refresh the token." }, "allow_setting_login_scopes": { "type": "boolean", "description": "When true, allows customization of OAuth scopes requested during user login. Custom scopes are appended to the mandatory email and profile scopes. When false or omitted, only the default email and profile scopes are used. This property is automatically enabled when Token Vault or Connected Accounts features are activated." }, "api_enable_groups": { "type": "boolean", "description": "Enables integration with the Google Workspace Admin SDK Directory API for groups. When true, Auth0 can synchronize groups & group memberships and supports inbound directory provisioning for groups. Defaults to false." }, "api_enable_users": { "type": "boolean", "description": "Enables integration with the Google Workspace Admin SDK Directory API. When true, Auth0 can retrieve extended user attributes (admin status, suspension status, group memberships) and supports inbound directory provisioning (SCIM). Defaults to true." }, "client_id": { "type": "string", "examples": [ "123456789-abc123def456.apps.googleusercontent.com" ], "minLength": 1, "maxLength": 128, "description": "Your Google OAuth 2.0 client ID. You can find this in your [Google Cloud Console](https://console.cloud.google.com/apis/credentials) under the OAuth 2.0 Client IDs section." }, "domain": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 1024, "description": "Primary Google Workspace domain name that users must belong to." }, "domain_aliases": { "type": "array", "items": { "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255, "description": "A domain alias used for Home Realm Discovery." }, "minItems": 0, "maxItems": 1000, "description": "Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication." }, "email": { "type": "boolean", "description": "Whether the OAuth flow requests the `email` scope." }, "ext_agreed_terms": { "type": "boolean", "description": "Fetches the `agreedToTerms` flag from the Google Directory profile." }, "ext_groups": { "type": "boolean", "description": "Enables enrichment with Google group memberships (required for `ext_groups_extended`)." }, "ext_groups_extended": { "type": "boolean", "description": "Controls whether enriched group entries include `id`, `email`, `name` (true) or only the group name (false); can only be set when `ext_groups` is true." }, "ext_is_admin": { "type": "boolean", "description": "Fetches the Google Directory admin flag for the signing-in user." }, "ext_is_suspended": { "type": "boolean", "description": "Fetches the Google Directory suspended flag for the signing-in user." }, "federated_connections_access_tokens": { "description": "Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.", "type": "object", "properties": { "active": { "type": "boolean", "description": "Enables refresh tokens and access tokens collection for federated connections" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "handle_login_from_social": { "type": "boolean", "description": "When enabled, users who sign in with their Google account through a social login will be automatically routed to this Google Workspace connection if their email domain matches the configured tenant_domain or domain_aliases. This ensures enterprise users authenticate through their organization's Google Workspace identity provider rather than through a generic Google social login, enabling access to directory-based attributes and enforcing organizational security policies. Defaults to true for new connections." }, "icon_url": { "description": "URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "map_user_id_to_id": { "type": "boolean", "description": "Determines how Auth0 generates the user_id for Google Workspace users. When false (default), the user's email address is used. When true, Google's stable numeric user ID is used instead, which persists even if the user's email changes. This setting can only be configured when creating the connection and cannot be changed afterward." }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "profile": { "type": "boolean", "description": "Whether the OAuth flow requests the `profile` scope." }, "scope": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 255 }, "minItems": 1, "maxItems": 64, "description": "Additional OAuth scopes requested beyond the default `email profile` scopes; ignored unless `allow_setting_login_scopes` is true." }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "tenant_domain": { "description": "The Google Workspace primary domain used to identify the organization during authentication.", "type": "string", "examples": [ "example.com" ], "minLength": 1, "maxLength": 255 }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} } }, "required": [ "client_id" ], "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "google-apps", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" }, { "type": "object", "properties": { "authentication": { "description": "Configure the purpose of a connection to be used for authentication during login.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "connected_accounts": { "description": "Configure the purpose of a connection to be used for connected accounts and Token Vault.", "type": "object", "properties": { "active": { "type": "boolean" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "display_name": { "type": "string", "examples": [ "My Enterprise Connection" ], "minLength": 1, "maxLength": 128, "description": "Connection name used in the new universal login experience" }, "enabled_clients": { "type": "array", "items": { "type": "string" }, "examples": [ [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] ], "description": "Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients." }, "id": { "description": "The connection's identifier", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "is_domain_connection": { "type": "boolean", "description": "true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.)" }, "metadata": { "description": "Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.", "type": "object", "properties": {}, "unevaluatedProperties": { "type": "string" } }, "name": { "description": "The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "realms": { "type": "array", "items": { "type": "string" }, "examples": [ [ "example.com" ] ], "minItems": 0, "maxItems": 10, "description": "Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm." }, "options": { "description": "Options for the 'waad' connection", "type": "object", "properties": { "api_enable_users": { "type": "boolean", "description": "Enable users API" }, "app_domain": { "type": "string", "examples": [ "contoso.onmicrosoft.com" ], "minLength": 0, "maxLength": 255, "description": "The Azure AD application domain (e.g., 'contoso.onmicrosoft.com'). Used primarily with WS-Federation protocol and Azure AD v1 endpoints." }, "app_id": { "type": "string", "examples": [ "api://contoso-azure-app" ], "minLength": 0, "maxLength": 500, "description": "The Application ID URI (App ID URI) for the Azure AD application. Required when using Azure AD v1 with the Resource Owner Password flow. Used to identify the resource being requested in OAuth token requests." }, "basic_profile": { "type": "boolean", "description": "Includes basic user profile information from Azure AD (name, email, given_name, family_name). Always enabled and required - represents the minimum profile data retrieved during authentication." }, "cert_rollover_notification": { "type": "string", "format": "date-time", "description": "Timestamp of the last certificate expiring soon notification." }, "client_id": { "type": "string", "examples": [ "12345678-1234-1234-1234-123456789012" ], "minLength": 0, "maxLength": 100, "description": "OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider." }, "domain": { "type": "string", "examples": [ "contoso.onmicrosoft.com" ], "minLength": 0, "maxLength": 512, "description": "The primary Azure AD tenant domain (e.g., 'contoso.onmicrosoft.com' or 'contoso.com')." }, "domain_aliases": { "type": "array", "items": { "type": "string", "minLength": 0, "maxLength": 255 }, "minItems": 0, "maxItems": 1000, "description": "Alternative domain names associated with this Azure AD tenant. Allows users from multiple verified domains to authenticate through this connection. Can be an array of domain strings." }, "ext_groups": { "type": "boolean", "description": "When enabled (true), retrieves and stores Azure AD security group memberships for the user. Requires Microsoft Graph API permissions (Directory.Read.All). Allows configuring max_groups_to_retrieve." }, "ext_nested_groups": { "type": "boolean", "description": "When true, stores all groups the user is member of, including transitive group memberships (groups within groups). When false (default), only direct group memberships are included." }, "ext_profile": { "type": "boolean", "description": "When enabled (true), retrieves extended profile attributes from Azure AD via Microsoft Graph API (job title, department, office location, etc.). Requires Graph API permissions. Only available with Azure AD v1 or when explicitly enabled for v2." }, "federated_connections_access_tokens": { "description": "Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.", "type": "object", "properties": { "active": { "type": "boolean", "description": "Enables refresh tokens and access tokens collection for federated connections" } }, "required": [ "active" ], "unevaluatedProperties": { "not": {} } }, "granted": { "type": "boolean", "description": "Indicates whether admin consent has been granted for the required Azure AD permissions. Read-only status field managed by Auth0 during the OAuth authorization flow." }, "icon_url": { "description": "URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.", "type": "string", "examples": [ "https://example.com/logo.png" ], "minLength": 8, "maxLength": 255, "format": "uri" }, "identity_api": { "description": "The Azure AD endpoint version for authentication. 'microsoft-identity-platform-v2.0' (recommended, default) supports modern OAuth 2.0 features. 'azure-active-directory-v1.0' is the legacy endpoint with protocol limitations. Selection affects available features.", "type": "string", "enum": [ "microsoft-identity-platform-v2.0", "azure-active-directory-v1.0" ] }, "max_groups_to_retrieve": { "type": "string", "examples": [ "100" ], "minLength": 0, "maxLength": 10, "description": "Maximum number of Azure AD groups to retrieve per user during authentication. Helps prevent performance issues for users in many groups. Only applies when ext_groups is enabled. Leave empty to use platform default." }, "non_persistent_attrs": { "type": "array", "items": { "type": "string", "examples": [ "ethnicity" ], "minLength": 0, "maxLength": 255, "description": "A user field name that should not be stored in the Auth0 database." }, "minItems": 0, "maxItems": 96, "description": "An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)" }, "scope": { "type": "array", "items": { "type": "string", "minLength": 0, "maxLength": 100 }, "minItems": 0, "maxItems": 100, "description": "OAuth 2.0 scopes to request from Azure AD during authentication. Each scope represents a permission (e.g., 'User.Read', 'Group.Read.All'). Only applies with Microsoft Identity Platform v2.0. See Microsoft Graph permissions reference for available scopes." }, "set_user_root_attributes": { "description": "Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.", "type": "string", "enum": [ "on_each_login", "on_first_login", "never_on_login" ] }, "should_trust_email_verified_connection": { "description": "Choose how Auth0 sets the email_verified field in the user profile.", "type": "string", "enum": [ "never_set_emails_as_verified", "always_set_emails_as_verified" ] }, "tenant_domain": { "anyOf": [ { "type": "string", "examples": [ "contoso.onmicrosoft.com" ], "minLength": 0, "maxLength": 512, "format": "hostname", "description": "Azure AD tenant domain as a hostname (e.g. contoso.onmicrosoft.com)." }, { "type": "string", "format": "uuid", "description": "Azure AD tenant domain as a UUID tenant ID." } ], "description": "The Azure AD tenant domain or tenant ID (UUID). Auto-populated from the 'domain' field. Can be either a hostname (e.g., 'contoso.onmicrosoft.com') or a UUID tenant ID." }, "tenantId": { "type": "string", "examples": [ "12345678-1234-1234-1234-123456789012" ], "minLength": 36, "maxLength": 36, "format": "uuid", "description": "The Azure AD tenant ID as a UUID. The unique identifier for your Azure AD organization. Must be a valid 36-character UUID." }, "thumbprints": { "type": "array", "items": { "type": "string", "examples": [ "AB12CD34EF56789012345678901234567890ABCD" ], "minLength": 0, "maxLength": 64, "description": "Certificate thumbprints for ADFS and Azure AD connections." }, "minItems": 0, "maxItems": 20, "description": "Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string." }, "upstream_params": { "description": "Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "use_wsfed": { "type": "boolean", "description": "Indicates WS-Federation protocol usage. When true, uses WS-Federation; when false, uses OpenID Connect." }, "useCommonEndpoint": { "type": "boolean", "description": "When enabled (true), uses the Azure AD common endpoint for multi-tenant authentication. Allows users from any Azure AD organization to sign in. Requires userid_attribute set to 'sub' (not 'oid'). Cannot be used with SCIM provisioning. Defaults to false." }, "userid_attribute": { "description": "The Azure AD claim to use as the unique user identifier. 'oid' (Object ID) is recommended for single-tenant connections and required for SCIM. 'sub' (Subject) is required for multi-tenant/common endpoint. Only applies with OpenID Connect protocol.", "type": "string", "enum": [ "oid", "sub" ] }, "waad_protocol": { "description": "The authentication protocol for Azure AD v1 endpoints. 'openid-connect' (default, recommended) uses modern OAuth 2.0/OIDC. 'ws-federation' is a legacy SAML-based protocol for older integrations. Only available with Azure AD v1 API.", "type": "string", "enum": [ "ws-federation", "openid-connect" ] } }, "required": [ "client_id" ], "unevaluatedProperties": { "not": {} } }, "show_as_button": { "type": "boolean", "description": "Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`." }, "strategy": { "type": "string", "const": "waad", "description": "The connection strategy." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "authn-b2b-enterprise-federations" } ] }, "context": { "description": "Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.", "type": "object", "properties": { "client": { "type": "object", "properties": { "id": { "description": "The client identifier.", "type": "string", "examples": [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] }, "name": { "type": "string", "description": "The client name." }, "metadata": { "description": "Client metadata.", "type": "object", "properties": {}, "unevaluatedProperties": {} } }, "required": [ "id", "name", "metadata" ], "unevaluatedProperties": { "not": {} }, "description": "The OAuth Client requesting or presenting an access token.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "connection": { "type": "object", "properties": { "id": { "description": "The ID of the connection.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "name": { "description": "The name of the connection.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "strategy": { "type": "string", "description": "The auth strategy implemented by the connection." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "description": "The Auth0 Connection used for the authentication transaction that generated the event.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "request": { "type": "object", "properties": { "geo": { "description": "Geographic information about the request origin.", "type": "object", "properties": { "continent_code": { "type": "string", "description": "Continent code." }, "country_code": { "type": "string", "description": "Country code." }, "country_name": { "type": "string", "description": "Country name." }, "latitude": { "type": "number", "description": "Latitude coordinate." }, "longitude": { "type": "number", "description": "Longitude coordinate." }, "subdivision_code": { "type": "string", "description": "Subdivision (state/province) code." }, "subdivision_name": { "type": "string", "description": "Subdivision (state/province) name." }, "city_name": { "type": "string", "description": "City name." }, "time_zone": { "type": "string", "description": "Time zone." } }, "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "hostname": { "type": "string", "description": "The hostname the request is for." }, "custom_domain": { "type": "string", "description": "The custom domain used in the request (if any)." }, "ip": { "type": "string", "description": "The originating IP address of the request." }, "method": { "type": "string", "description": "The HTTP method used for the request." }, "user_agent": { "type": "string", "description": "The value of the `User-Agent` header." } }, "required": [ "geo", "hostname", "ip", "method", "user_agent" ], "unevaluatedProperties": { "not": {} }, "description": "An HTTP request.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "tenant": { "type": "object", "properties": { "id": { "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]", "description": "User-provided tenant identifier." } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a tenant in event context" }, "transaction": { "type": "object", "properties": { "acr_values": { "type": "array", "items": { "type": "string" }, "description": "acr_values in the request." }, "locale": { "type": "string", "description": "The locale used for this transaction." }, "login_hint": { "type": "string", "description": "Hint about the login identifier the user might use in this transaction." }, "prompt": { "type": "array", "items": { "type": "string" }, "description": "Instructions indicating whether the user may be prompted for re-authentication and consent." }, "protocol": { "description": "The protocol used for this transaction.", "type": "string", "enum": [ "oidc-basic-profile", "oidc-implicit-profile", "oauth2-device-code", "oauth2-resource-owner", "oauth2-resource-owner-jwt-bearer", "oauth2-password", "oauth2-webauthn", "oauth2-access-token", "oauth2-refresh-token", "oauth2-token-exchange", "oidc-hybrid-profile", "samlp", "wsfed", "wstrust-usernamemixed" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "redirect_uri": { "type": "string", "description": "The URL to which the client will be redirected when the transaction completes." }, "requested_scopes": { "type": "array", "items": { "type": "string" }, "description": "The scopes requested." }, "response_mode": { "description": "This transaction's method for returning parameters from the Authorization Endpoint.", "type": "string", "enum": [ "query", "fragment", "form_post", "web_message" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "response_type": { "type": "array", "items": { "type": "string", "enum": [ "code", "token", "id_token" ], "description": "OAuth/OIDC response types.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "description": "The kind of credential issued by this transaction." }, "state": { "type": "string", "description": "The OAuth state parameter for this transaction." }, "ui_locales": { "type": "array", "items": { "type": "string" }, "description": "The ui_locales requested for this transaction." } }, "required": [ "acr_values", "locale", "requested_scopes", "ui_locales" ], "unevaluatedProperties": { "not": {} }, "description": "An auth transaction.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "tenant" ], "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "object" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "platform-streaming-foundations" }, "a0tenant": { "description": "The auth0 tenant ID to which the event is associated.", "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]" }, "a0stream": { "description": "The auth0 event stream ID of the stream the event was delivered on.\nPresent when the event is delivered via an event stream; omitted when\nevents are retrieved via the Events API (GET /api/v2/events).", "type": "string", "examples": [ "est_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "est_[a-zA-Z0-9]{22}" } }, "required": [ "specversion", "type", "source", "id", "time", "data", "a0tenant" ], "unevaluatedProperties": { "not": {} }, "description": "Represents an event that occurs when a connection is updated.", "x-release-lifecycle": "EA", "x-auth0-owner": "iam-login", "x-auth0-event-category": "connection", "example": { "specversion": "1.0", "type": "connection.updated", "source": "urn:auth0:example.auth0app.com", "id": "evt_vjFVP5pVdfvsfRKatshkVV", "time": "2025-02-01T12:34:56Z", "data": { "object": { "authentication": { "active": false }, "display_name": "My Enterprise Connection", "enabled_clients": [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ], "id": "con_kFOHQUeaCSC1Kjqz", "is_domain_connection": false, "metadata": {}, "name": "Username-Password-Authentication", "realms": [ "example.com" ], "connected_accounts": { "active": false, "cross_app_access": false }, "options": { "authorization_endpoint": "https://provider.example.com/oauth/authorize", "client_id": "abc123def456ghi789", "connection_settings": { "pkce": "auto" }, "domain_aliases": [ "example.com" ], "dpop_signing_alg": "ES256", "federated_connections_access_tokens": { "active": false }, "icon_url": "https://example.com/logo.png", "id_token_session_expiry_supported": false, "id_token_signed_response_algs": [ "ES256" ], "issuer": "https://accounts.example.com", "jwks_uri": "https://provider.example.com/.well-known/jwks.json", "non_persistent_attrs": [ "ethnicity" ], "oidc_metadata": { "acr_values_supported": [ "urn:mace:incommon:iap:silver" ], "authorization_endpoint": "https://provider.example.com/oauth/authorize", "claim_types_supported": [ "normal" ], "claims_locales_supported": [ "en-US" ], "claims_parameter_supported": false, "claims_supported": [ "sub" ], "code_challenge_methods_supported": [ "S256" ], "display_values_supported": [ "page" ], "dpop_signing_alg_values_supported": [ "ES256" ], "end_session_endpoint": "https://provider.example.com/oauth/logout", "grant_types_supported": [ "authorization_code" ], "id_token_encryption_alg_values_supported": [ "RSA-OAEP" ], "id_token_encryption_enc_values_supported": [ "A128CBC-HS256" ], "id_token_signing_alg_values_supported": [ "RS256" ], "issuer": "https://accounts.example.com", "jwks_uri": "https://provider.example.com/.well-known/jwks.json", "op_policy_uri": "https://provider.example.com/policy", "op_tos_uri": "https://provider.example.com/terms", "registration_endpoint": "https://provider.example.com/oauth/register", "request_object_encryption_alg_values_supported": [ "RSA-OAEP" ], "request_object_encryption_enc_values_supported": [ "A128CBC-HS256" ], "request_object_signing_alg_values_supported": [ "RS256" ], "request_parameter_supported": false, "request_uri_parameter_supported": false, "require_request_uri_registration": false, "response_modes_supported": [ "query" ], "response_types_supported": [ "code" ], "scopes_supported": [ "openid" ], "service_documentation": "https://provider.example.com/docs", "subject_types_supported": [ "public" ], "token_endpoint": "https://provider.example.com/oauth/token", "token_endpoint_auth_methods_supported": [ "client_secret_basic" ], "token_endpoint_auth_signing_alg_values_supported": [ "RS256" ], "ui_locales_supported": [ "en-US" ], "userinfo_encryption_alg_values_supported": [ "RS256" ], "userinfo_encryption_enc_values_supported": [ "A128CBC-HS256" ], "userinfo_endpoint": "https://provider.example.com/oauth/userinfo", "userinfo_signing_alg_values_supported": [ "RS256" ] }, "schema_version": "openid-1.0.0", "scope": "openid profile email", "send_back_channel_nonce": false, "set_user_root_attributes": "on_each_login", "tenant_domain": "example.com", "token_endpoint": "https://provider.example.com/oauth/token", "token_endpoint_auth_method": "client_secret_post", "token_endpoint_auth_signing_alg": "ES256", "token_endpoint_jwtca_aud_format": "issuer", "upstream_params": {}, "useOauthSpecScope": false, "userinfo_endpoint": "https://provider.example.com/oauth/userinfo", "attribute_map": { "attributes": {}, "userinfo_scope": "openid profile email", "mapping_mode": "bind_all" }, "discovery_url": "https://provider.example.com/.well-known/openid-configuration", "type": "back_channel" }, "show_as_button": false, "strategy": "oidc" }, "previous_object": { "authentication": { "active": false }, "display_name": "My Enterprise Connection", "enabled_clients": [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ], "id": "con_kFOHQUeaCSC1Kjqz", "is_domain_connection": false, "metadata": {}, "name": "Username-Password-Authentication", "realms": [ "example.com" ], "connected_accounts": { "active": false, "cross_app_access": false }, "options": { "authorization_endpoint": "https://provider.example.com/oauth/authorize", "client_id": "abc123def456ghi789", "connection_settings": { "pkce": "auto" }, "domain_aliases": [ "example.com" ], "dpop_signing_alg": "ES256", "federated_connections_access_tokens": { "active": false }, "icon_url": "https://example.com/logo.png", "id_token_session_expiry_supported": false, "id_token_signed_response_algs": [ "ES256" ], "issuer": "https://accounts.example.com", "jwks_uri": "https://provider.example.com/.well-known/jwks.json", "non_persistent_attrs": [ "ethnicity" ], "oidc_metadata": { "acr_values_supported": [ "urn:mace:incommon:iap:silver" ], "authorization_endpoint": "https://provider.example.com/oauth/authorize", "claim_types_supported": [ "normal" ], "claims_locales_supported": [ "en-US" ], "claims_parameter_supported": false, "claims_supported": [ "sub" ], "code_challenge_methods_supported": [ "S256" ], "display_values_supported": [ "page" ], "dpop_signing_alg_values_supported": [ "ES256" ], "end_session_endpoint": "https://provider.example.com/oauth/logout", "grant_types_supported": [ "authorization_code" ], "id_token_encryption_alg_values_supported": [ "RSA-OAEP" ], "id_token_encryption_enc_values_supported": [ "A128CBC-HS256" ], "id_token_signing_alg_values_supported": [ "RS256" ], "issuer": "https://accounts.example.com", "jwks_uri": "https://provider.example.com/.well-known/jwks.json", "op_policy_uri": "https://provider.example.com/policy", "op_tos_uri": "https://provider.example.com/terms", "registration_endpoint": "https://provider.example.com/oauth/register", "request_object_encryption_alg_values_supported": [ "RSA-OAEP" ], "request_object_encryption_enc_values_supported": [ "A128CBC-HS256" ], "request_object_signing_alg_values_supported": [ "RS256" ], "request_parameter_supported": false, "request_uri_parameter_supported": false, "require_request_uri_registration": false, "response_modes_supported": [ "query" ], "response_types_supported": [ "code" ], "scopes_supported": [ "openid" ], "service_documentation": "https://provider.example.com/docs", "subject_types_supported": [ "public" ], "token_endpoint": "https://provider.example.com/oauth/token", "token_endpoint_auth_methods_supported": [ "client_secret_basic" ], "token_endpoint_auth_signing_alg_values_supported": [ "RS256" ], "ui_locales_supported": [ "en-US" ], "userinfo_encryption_alg_values_supported": [ "RS256" ], "userinfo_encryption_enc_values_supported": [ "A128CBC-HS256" ], "userinfo_endpoint": "https://provider.example.com/oauth/userinfo", "userinfo_signing_alg_values_supported": [ "RS256" ] }, "schema_version": "openid-1.0.0", "scope": "openid profile email", "send_back_channel_nonce": false, "set_user_root_attributes": "on_each_login", "tenant_domain": "example.com", "token_endpoint": "https://provider.example.com/oauth/token", "token_endpoint_auth_method": "client_secret_post", "token_endpoint_auth_signing_alg": "ES256", "token_endpoint_jwtca_aud_format": "issuer", "upstream_params": {}, "useOauthSpecScope": false, "userinfo_endpoint": "https://provider.example.com/oauth/userinfo", "attribute_map": { "attributes": {}, "userinfo_scope": "openid profile email", "mapping_mode": "bind_all" }, "discovery_url": "https://provider.example.com/.well-known/openid-configuration", "type": "back_channel" }, "show_as_button": false, "strategy": "oidc" }, "context": { "client": { "id": "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc", "name": "sample", "metadata": {} }, "connection": { "id": "con_kFOHQUeaCSC1Kjqz", "name": "Username-Password-Authentication", "strategy": "sample" }, "request": { "geo": { "continent_code": "sample", "country_code": "sample", "country_name": "sample", "latitude": 3.14, "longitude": 3.14, "subdivision_code": "sample", "subdivision_name": "sample", "city_name": "sample", "time_zone": "sample" }, "hostname": "sample", "custom_domain": "sample", "ip": "sample", "method": "sample", "user_agent": "sample" }, "tenant": { "id": "my-tenant" }, "transaction": { "acr_values": [ "sample" ], "locale": "sample", "login_hint": "sample", "prompt": [ "sample" ], "protocol": "oidc-basic-profile", "redirect_uri": "sample", "requested_scopes": [ "sample" ], "response_mode": "query", "response_type": [ "code" ], "state": "sample", "ui_locales": [ "sample" ] } } }, "a0tenant": "my-tenant", "a0stream": "est_vjFVP5pVdfvsfRKatshkVV" } }, "group.created": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "group.created", "type": "object", "properties": { "specversion": { "description": "The version of the CloudEvents specification which the event uses.", "type": "string", "enum": [ "1.0" ], "x-auth0-owner": "platform-streaming-foundations" }, "type": { "type": "string", "const": "group.created", "description": "The type of the event which has happened." }, "source": { "type": "string", "examples": [ "urn:auth0:example.auth0app.com" ], "description": "The source of the event. This will take the form 'urn:auth0:.'." }, "id": { "description": "A unique identifier for the event.", "type": "string", "examples": [ "evt_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "evt_[a-zA-Z0-9]{22}" }, "time": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "An ISO-8601 timestamp indicating when the event physically occurred." }, "data": { "description": "The event payload.", "type": "object", "properties": { "object": { "description": "The event content.", "oneOf": [ { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "name": { "type": "string", "examples": [ "My Group" ], "description": "The name of the group." }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "created_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was created (ISO_8601 format)." }, "type": { "type": "string", "const": "connection", "description": "The type of the group." }, "connection_id": { "description": "The connection ID associated with the group.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" } }, "required": [ "id", "name", "created_at", "type", "connection_id" ], "unevaluatedProperties": { "not": {} }, "description": "Represents a connection group entity." }, { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "name": { "type": "string", "examples": [ "My Group" ], "description": "The name of the group." }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "created_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was created (ISO_8601 format)." }, "type": { "type": "string", "const": "organization", "description": "The type of the group." }, "organization_id": { "description": "The organization ID associated with the group.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" } }, "required": [ "id", "name", "created_at", "type", "organization_id" ], "unevaluatedProperties": { "not": {} }, "description": "Represents an organization group entity." }, { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "name": { "type": "string", "examples": [ "My Group" ], "description": "The name of the group." }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "created_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was created (ISO_8601 format)." }, "type": { "type": "string", "const": "tenant", "description": "The type of the group." } }, "required": [ "id", "name", "created_at", "type" ], "unevaluatedProperties": { "not": {} }, "description": "Represents a tenant group entity." } ] }, "previous_object": { "description": "The event content as it was prior to the change described by this event, when applicable.", "oneOf": [ { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "name": { "type": "string", "examples": [ "My Group" ], "description": "The name of the group." }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "created_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was created (ISO_8601 format)." }, "type": { "type": "string", "const": "connection", "description": "The type of the group." }, "connection_id": { "description": "The connection ID associated with the group.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" } }, "required": [ "id", "name", "created_at", "type", "connection_id" ], "unevaluatedProperties": { "not": {} }, "description": "Represents a connection group entity." }, { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "name": { "type": "string", "examples": [ "My Group" ], "description": "The name of the group." }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "created_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was created (ISO_8601 format)." }, "type": { "type": "string", "const": "organization", "description": "The type of the group." }, "organization_id": { "description": "The organization ID associated with the group.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" } }, "required": [ "id", "name", "created_at", "type", "organization_id" ], "unevaluatedProperties": { "not": {} }, "description": "Represents an organization group entity." }, { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "name": { "type": "string", "examples": [ "My Group" ], "description": "The name of the group." }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "created_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was created (ISO_8601 format)." }, "type": { "type": "string", "const": "tenant", "description": "The type of the group." } }, "required": [ "id", "name", "created_at", "type" ], "unevaluatedProperties": { "not": {} }, "description": "Represents a tenant group entity." } ] }, "context": { "description": "Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.", "type": "object", "properties": { "client": { "type": "object", "properties": { "id": { "description": "The client identifier.", "type": "string", "examples": [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] }, "name": { "type": "string", "description": "The client name." }, "metadata": { "description": "Client metadata.", "type": "object", "properties": {}, "unevaluatedProperties": {} } }, "required": [ "id", "name", "metadata" ], "unevaluatedProperties": { "not": {} }, "description": "The OAuth Client requesting or presenting an access token.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "connection": { "type": "object", "properties": { "id": { "description": "The ID of the connection.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "name": { "description": "The name of the connection.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "strategy": { "type": "string", "description": "The auth strategy implemented by the connection." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "description": "The Auth0 Connection used for the authentication transaction that generated the event.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "request": { "type": "object", "properties": { "geo": { "description": "Geographic information about the request origin.", "type": "object", "properties": { "continent_code": { "type": "string", "description": "Continent code." }, "country_code": { "type": "string", "description": "Country code." }, "country_name": { "type": "string", "description": "Country name." }, "latitude": { "type": "number", "description": "Latitude coordinate." }, "longitude": { "type": "number", "description": "Longitude coordinate." }, "subdivision_code": { "type": "string", "description": "Subdivision (state/province) code." }, "subdivision_name": { "type": "string", "description": "Subdivision (state/province) name." }, "city_name": { "type": "string", "description": "City name." }, "time_zone": { "type": "string", "description": "Time zone." } }, "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "hostname": { "type": "string", "description": "The hostname the request is for." }, "custom_domain": { "type": "string", "description": "The custom domain used in the request (if any)." }, "ip": { "type": "string", "description": "The originating IP address of the request." }, "method": { "type": "string", "description": "The HTTP method used for the request." }, "user_agent": { "type": "string", "description": "The value of the `User-Agent` header." } }, "required": [ "geo", "hostname", "ip", "method", "user_agent" ], "unevaluatedProperties": { "not": {} }, "description": "An HTTP request.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "tenant": { "type": "object", "properties": { "id": { "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]", "description": "User-provided tenant identifier." } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a tenant in event context" }, "transaction": { "type": "object", "properties": { "acr_values": { "type": "array", "items": { "type": "string" }, "description": "acr_values in the request." }, "locale": { "type": "string", "description": "The locale used for this transaction." }, "login_hint": { "type": "string", "description": "Hint about the login identifier the user might use in this transaction." }, "prompt": { "type": "array", "items": { "type": "string" }, "description": "Instructions indicating whether the user may be prompted for re-authentication and consent." }, "protocol": { "description": "The protocol used for this transaction.", "type": "string", "enum": [ "oidc-basic-profile", "oidc-implicit-profile", "oauth2-device-code", "oauth2-resource-owner", "oauth2-resource-owner-jwt-bearer", "oauth2-password", "oauth2-webauthn", "oauth2-access-token", "oauth2-refresh-token", "oauth2-token-exchange", "oidc-hybrid-profile", "samlp", "wsfed", "wstrust-usernamemixed" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "redirect_uri": { "type": "string", "description": "The URL to which the client will be redirected when the transaction completes." }, "requested_scopes": { "type": "array", "items": { "type": "string" }, "description": "The scopes requested." }, "response_mode": { "description": "This transaction's method for returning parameters from the Authorization Endpoint.", "type": "string", "enum": [ "query", "fragment", "form_post", "web_message" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "response_type": { "type": "array", "items": { "type": "string", "enum": [ "code", "token", "id_token" ], "description": "OAuth/OIDC response types.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "description": "The kind of credential issued by this transaction." }, "state": { "type": "string", "description": "The OAuth state parameter for this transaction." }, "ui_locales": { "type": "array", "items": { "type": "string" }, "description": "The ui_locales requested for this transaction." } }, "required": [ "acr_values", "locale", "requested_scopes", "ui_locales" ], "unevaluatedProperties": { "not": {} }, "description": "An auth transaction.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "tenant" ], "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "object" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "platform-streaming-foundations" }, "a0tenant": { "description": "The auth0 tenant ID to which the event is associated.", "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]" }, "a0stream": { "description": "The auth0 event stream ID of the stream the event was delivered on.\nPresent when the event is delivered via an event stream; omitted when\nevents are retrieved via the Events API (GET /api/v2/events).", "type": "string", "examples": [ "est_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "est_[a-zA-Z0-9]{22}" } }, "required": [ "specversion", "type", "source", "id", "time", "data", "a0tenant" ], "unevaluatedProperties": { "not": {} }, "description": "Represents an event that occurs when a group is created.", "x-release-lifecycle": "EA", "x-auth0-owner": "authn-b2b-acceleration", "x-auth0-event-category": "group", "example": { "specversion": "1.0", "type": "group.created", "source": "urn:auth0:example.auth0app.com", "id": "evt_vjFVP5pVdfvsfRKatshkVV", "time": "2025-02-01T12:34:56Z", "data": { "object": { "id": "grp_01949dad80fc7d56", "name": "My Group", "external_id": "my-external-id", "created_at": "2025-02-01T12:34:56Z", "type": "connection", "connection_id": "con_kFOHQUeaCSC1Kjqz" }, "previous_object": { "id": "grp_01949dad80fc7d56", "name": "My Group", "external_id": "my-external-id", "created_at": "2025-02-01T12:34:56Z", "type": "connection", "connection_id": "con_kFOHQUeaCSC1Kjqz" }, "context": { "client": { "id": "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc", "name": "sample", "metadata": {} }, "connection": { "id": "con_kFOHQUeaCSC1Kjqz", "name": "Username-Password-Authentication", "strategy": "sample" }, "request": { "geo": { "continent_code": "sample", "country_code": "sample", "country_name": "sample", "latitude": 3.14, "longitude": 3.14, "subdivision_code": "sample", "subdivision_name": "sample", "city_name": "sample", "time_zone": "sample" }, "hostname": "sample", "custom_domain": "sample", "ip": "sample", "method": "sample", "user_agent": "sample" }, "tenant": { "id": "my-tenant" }, "transaction": { "acr_values": [ "sample" ], "locale": "sample", "login_hint": "sample", "prompt": [ "sample" ], "protocol": "oidc-basic-profile", "redirect_uri": "sample", "requested_scopes": [ "sample" ], "response_mode": "query", "response_type": [ "code" ], "state": "sample", "ui_locales": [ "sample" ] } } }, "a0tenant": "my-tenant", "a0stream": "est_vjFVP5pVdfvsfRKatshkVV" } }, "group.deleted": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "group.deleted", "type": "object", "properties": { "specversion": { "description": "The version of the CloudEvents specification which the event uses.", "type": "string", "enum": [ "1.0" ], "x-auth0-owner": "platform-streaming-foundations" }, "type": { "type": "string", "const": "group.deleted", "description": "The type of the event which has happened." }, "source": { "type": "string", "examples": [ "urn:auth0:example.auth0app.com" ], "description": "The source of the event. This will take the form 'urn:auth0:.'." }, "id": { "description": "A unique identifier for the event.", "type": "string", "examples": [ "evt_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "evt_[a-zA-Z0-9]{22}" }, "time": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "An ISO-8601 timestamp indicating when the event physically occurred." }, "data": { "description": "The event payload.", "type": "object", "properties": { "object": { "description": "The event content.", "oneOf": [ { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "name": { "type": "string", "examples": [ "My Group" ], "description": "The name of the group." }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "created_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was created (ISO_8601 format)." }, "type": { "type": "string", "const": "connection", "description": "The type of the group." }, "connection_id": { "description": "The connection ID associated with the group.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "updated_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was last updated/modified (ISO_8601 format)." } }, "required": [ "id", "name", "created_at", "type", "connection_id", "updated_at" ], "unevaluatedProperties": { "not": {} }, "description": "Connection group with updated_at timestamp" }, { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "name": { "type": "string", "examples": [ "My Group" ], "description": "The name of the group." }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "created_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was created (ISO_8601 format)." }, "type": { "type": "string", "const": "organization", "description": "The type of the group." }, "organization_id": { "description": "The organization ID associated with the group.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" }, "updated_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was last updated/modified (ISO_8601 format)." } }, "required": [ "id", "name", "created_at", "type", "organization_id", "updated_at" ], "unevaluatedProperties": { "not": {} }, "description": "Organization group with updated_at timestamp" }, { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "name": { "type": "string", "examples": [ "My Group" ], "description": "The name of the group." }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "created_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was created (ISO_8601 format)." }, "type": { "type": "string", "const": "tenant", "description": "The type of the group." }, "updated_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was last updated/modified (ISO_8601 format)." } }, "required": [ "id", "name", "created_at", "type", "updated_at" ], "unevaluatedProperties": { "not": {} }, "description": "Tenant group with updated_at timestamp" } ] }, "previous_object": { "description": "The event content as it was prior to the change described by this event, when applicable.", "oneOf": [ { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "name": { "type": "string", "examples": [ "My Group" ], "description": "The name of the group." }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "created_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was created (ISO_8601 format)." }, "type": { "type": "string", "const": "connection", "description": "The type of the group." }, "connection_id": { "description": "The connection ID associated with the group.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "updated_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was last updated/modified (ISO_8601 format)." } }, "required": [ "id", "name", "created_at", "type", "connection_id", "updated_at" ], "unevaluatedProperties": { "not": {} }, "description": "Connection group with updated_at timestamp" }, { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "name": { "type": "string", "examples": [ "My Group" ], "description": "The name of the group." }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "created_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was created (ISO_8601 format)." }, "type": { "type": "string", "const": "organization", "description": "The type of the group." }, "organization_id": { "description": "The organization ID associated with the group.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" }, "updated_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was last updated/modified (ISO_8601 format)." } }, "required": [ "id", "name", "created_at", "type", "organization_id", "updated_at" ], "unevaluatedProperties": { "not": {} }, "description": "Organization group with updated_at timestamp" }, { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "name": { "type": "string", "examples": [ "My Group" ], "description": "The name of the group." }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "created_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was created (ISO_8601 format)." }, "type": { "type": "string", "const": "tenant", "description": "The type of the group." }, "updated_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was last updated/modified (ISO_8601 format)." } }, "required": [ "id", "name", "created_at", "type", "updated_at" ], "unevaluatedProperties": { "not": {} }, "description": "Tenant group with updated_at timestamp" } ] }, "context": { "description": "Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.", "type": "object", "properties": { "client": { "type": "object", "properties": { "id": { "description": "The client identifier.", "type": "string", "examples": [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] }, "name": { "type": "string", "description": "The client name." }, "metadata": { "description": "Client metadata.", "type": "object", "properties": {}, "unevaluatedProperties": {} } }, "required": [ "id", "name", "metadata" ], "unevaluatedProperties": { "not": {} }, "description": "The OAuth Client requesting or presenting an access token.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "connection": { "type": "object", "properties": { "id": { "description": "The ID of the connection.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "name": { "description": "The name of the connection.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "strategy": { "type": "string", "description": "The auth strategy implemented by the connection." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "description": "The Auth0 Connection used for the authentication transaction that generated the event.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "request": { "type": "object", "properties": { "geo": { "description": "Geographic information about the request origin.", "type": "object", "properties": { "continent_code": { "type": "string", "description": "Continent code." }, "country_code": { "type": "string", "description": "Country code." }, "country_name": { "type": "string", "description": "Country name." }, "latitude": { "type": "number", "description": "Latitude coordinate." }, "longitude": { "type": "number", "description": "Longitude coordinate." }, "subdivision_code": { "type": "string", "description": "Subdivision (state/province) code." }, "subdivision_name": { "type": "string", "description": "Subdivision (state/province) name." }, "city_name": { "type": "string", "description": "City name." }, "time_zone": { "type": "string", "description": "Time zone." } }, "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "hostname": { "type": "string", "description": "The hostname the request is for." }, "custom_domain": { "type": "string", "description": "The custom domain used in the request (if any)." }, "ip": { "type": "string", "description": "The originating IP address of the request." }, "method": { "type": "string", "description": "The HTTP method used for the request." }, "user_agent": { "type": "string", "description": "The value of the `User-Agent` header." } }, "required": [ "geo", "hostname", "ip", "method", "user_agent" ], "unevaluatedProperties": { "not": {} }, "description": "An HTTP request.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "tenant": { "type": "object", "properties": { "id": { "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]", "description": "User-provided tenant identifier." } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a tenant in event context" }, "transaction": { "type": "object", "properties": { "acr_values": { "type": "array", "items": { "type": "string" }, "description": "acr_values in the request." }, "locale": { "type": "string", "description": "The locale used for this transaction." }, "login_hint": { "type": "string", "description": "Hint about the login identifier the user might use in this transaction." }, "prompt": { "type": "array", "items": { "type": "string" }, "description": "Instructions indicating whether the user may be prompted for re-authentication and consent." }, "protocol": { "description": "The protocol used for this transaction.", "type": "string", "enum": [ "oidc-basic-profile", "oidc-implicit-profile", "oauth2-device-code", "oauth2-resource-owner", "oauth2-resource-owner-jwt-bearer", "oauth2-password", "oauth2-webauthn", "oauth2-access-token", "oauth2-refresh-token", "oauth2-token-exchange", "oidc-hybrid-profile", "samlp", "wsfed", "wstrust-usernamemixed" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "redirect_uri": { "type": "string", "description": "The URL to which the client will be redirected when the transaction completes." }, "requested_scopes": { "type": "array", "items": { "type": "string" }, "description": "The scopes requested." }, "response_mode": { "description": "This transaction's method for returning parameters from the Authorization Endpoint.", "type": "string", "enum": [ "query", "fragment", "form_post", "web_message" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "response_type": { "type": "array", "items": { "type": "string", "enum": [ "code", "token", "id_token" ], "description": "OAuth/OIDC response types.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "description": "The kind of credential issued by this transaction." }, "state": { "type": "string", "description": "The OAuth state parameter for this transaction." }, "ui_locales": { "type": "array", "items": { "type": "string" }, "description": "The ui_locales requested for this transaction." } }, "required": [ "acr_values", "locale", "requested_scopes", "ui_locales" ], "unevaluatedProperties": { "not": {} }, "description": "An auth transaction.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "tenant" ], "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "object" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "platform-streaming-foundations" }, "a0tenant": { "description": "The auth0 tenant ID to which the event is associated.", "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]" }, "a0stream": { "description": "The auth0 event stream ID of the stream the event was delivered on.\nPresent when the event is delivered via an event stream; omitted when\nevents are retrieved via the Events API (GET /api/v2/events).", "type": "string", "examples": [ "est_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "est_[a-zA-Z0-9]{22}" } }, "required": [ "specversion", "type", "source", "id", "time", "data", "a0tenant" ], "unevaluatedProperties": { "not": {} }, "description": "Represents an event that occurs when a group is deleted.", "x-release-lifecycle": "EA", "x-auth0-owner": "authn-b2b-acceleration", "x-auth0-event-category": "group", "example": { "specversion": "1.0", "type": "group.deleted", "source": "urn:auth0:example.auth0app.com", "id": "evt_vjFVP5pVdfvsfRKatshkVV", "time": "2025-02-01T12:34:56Z", "data": { "object": { "id": "grp_01949dad80fc7d56", "name": "My Group", "external_id": "my-external-id", "created_at": "2025-02-01T12:34:56Z", "type": "connection", "connection_id": "con_kFOHQUeaCSC1Kjqz", "updated_at": "2025-02-01T12:34:56Z" }, "previous_object": { "id": "grp_01949dad80fc7d56", "name": "My Group", "external_id": "my-external-id", "created_at": "2025-02-01T12:34:56Z", "type": "connection", "connection_id": "con_kFOHQUeaCSC1Kjqz", "updated_at": "2025-02-01T12:34:56Z" }, "context": { "client": { "id": "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc", "name": "sample", "metadata": {} }, "connection": { "id": "con_kFOHQUeaCSC1Kjqz", "name": "Username-Password-Authentication", "strategy": "sample" }, "request": { "geo": { "continent_code": "sample", "country_code": "sample", "country_name": "sample", "latitude": 3.14, "longitude": 3.14, "subdivision_code": "sample", "subdivision_name": "sample", "city_name": "sample", "time_zone": "sample" }, "hostname": "sample", "custom_domain": "sample", "ip": "sample", "method": "sample", "user_agent": "sample" }, "tenant": { "id": "my-tenant" }, "transaction": { "acr_values": [ "sample" ], "locale": "sample", "login_hint": "sample", "prompt": [ "sample" ], "protocol": "oidc-basic-profile", "redirect_uri": "sample", "requested_scopes": [ "sample" ], "response_mode": "query", "response_type": [ "code" ], "state": "sample", "ui_locales": [ "sample" ] } } }, "a0tenant": "my-tenant", "a0stream": "est_vjFVP5pVdfvsfRKatshkVV" } }, "group.member.added": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "group.member.added", "type": "object", "properties": { "specversion": { "description": "The version of the CloudEvents specification which the event uses.", "type": "string", "enum": [ "1.0" ], "x-auth0-owner": "platform-streaming-foundations" }, "type": { "type": "string", "const": "group.member.added", "description": "The type of the event which has happened." }, "source": { "type": "string", "examples": [ "urn:auth0:example.auth0app.com" ], "description": "The source of the event. This will take the form 'urn:auth0:.'." }, "id": { "description": "A unique identifier for the event.", "type": "string", "examples": [ "evt_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "evt_[a-zA-Z0-9]{22}" }, "time": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "An ISO-8601 timestamp indicating when the event physically occurred." }, "data": { "description": "The event payload.", "type": "object", "properties": { "object": { "description": "The event content.", "type": "object", "properties": { "group": { "description": "The group the member belongs to.", "oneOf": [ { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "type": { "type": "string", "const": "connection", "description": "The type of the group." }, "connection_id": { "description": "The connection ID associated with the group.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" } }, "required": [ "id", "type", "connection_id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a connection group" }, { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "type": { "type": "string", "const": "organization", "description": "The type of the group." }, "organization_id": { "description": "The organization ID associated with the group.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" } }, "required": [ "id", "type", "organization_id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to an organization group" }, { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "type": { "type": "string", "const": "tenant", "description": "The type of the group." } }, "required": [ "id", "type" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a tenant group" } ] }, "member": { "description": "The member that is a part of the group.", "oneOf": [ { "type": "object", "properties": { "member_type": { "type": "string", "const": "user", "description": "Type discriminator for user members" }, "id": { "type": "string", "examples": [ "user@example.com" ], "description": "The user's unique identifier" } }, "required": [ "member_type", "id" ], "unevaluatedProperties": { "not": {} }, "description": "A group member of member_type user" }, { "type": "object", "properties": { "member_type": { "type": "string", "const": "connection", "description": "Type discriminator for connection members" }, "id": { "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "description": "The connection member's unique identifier" }, "type": { "type": "string", "examples": [ "connection" ], "description": "The type of the connection" }, "connection_id": { "description": "Connection ID associated with the member", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" } }, "required": [ "member_type", "id", "type", "connection_id" ], "unevaluatedProperties": { "not": {} }, "description": "A group member of member_type group" } ], "title": "Group Member" } }, "required": [ "group", "member" ], "unevaluatedProperties": { "not": {} } }, "previous_object": { "description": "The event content as it was prior to the change described by this event, when applicable.", "type": "object", "properties": { "group": { "description": "The group the member belongs to.", "oneOf": [ { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "type": { "type": "string", "const": "connection", "description": "The type of the group." }, "connection_id": { "description": "The connection ID associated with the group.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" } }, "required": [ "id", "type", "connection_id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a connection group" }, { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "type": { "type": "string", "const": "organization", "description": "The type of the group." }, "organization_id": { "description": "The organization ID associated with the group.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" } }, "required": [ "id", "type", "organization_id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to an organization group" }, { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "type": { "type": "string", "const": "tenant", "description": "The type of the group." } }, "required": [ "id", "type" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a tenant group" } ] }, "member": { "description": "The member that is a part of the group.", "oneOf": [ { "type": "object", "properties": { "member_type": { "type": "string", "const": "user", "description": "Type discriminator for user members" }, "id": { "type": "string", "examples": [ "user@example.com" ], "description": "The user's unique identifier" } }, "required": [ "member_type", "id" ], "unevaluatedProperties": { "not": {} }, "description": "A group member of member_type user" }, { "type": "object", "properties": { "member_type": { "type": "string", "const": "connection", "description": "Type discriminator for connection members" }, "id": { "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "description": "The connection member's unique identifier" }, "type": { "type": "string", "examples": [ "connection" ], "description": "The type of the connection" }, "connection_id": { "description": "Connection ID associated with the member", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" } }, "required": [ "member_type", "id", "type", "connection_id" ], "unevaluatedProperties": { "not": {} }, "description": "A group member of member_type group" } ], "title": "Group Member" } }, "required": [ "group", "member" ], "unevaluatedProperties": { "not": {} } }, "context": { "description": "Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.", "type": "object", "properties": { "client": { "type": "object", "properties": { "id": { "description": "The client identifier.", "type": "string", "examples": [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] }, "name": { "type": "string", "description": "The client name." }, "metadata": { "description": "Client metadata.", "type": "object", "properties": {}, "unevaluatedProperties": {} } }, "required": [ "id", "name", "metadata" ], "unevaluatedProperties": { "not": {} }, "description": "The OAuth Client requesting or presenting an access token.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "connection": { "type": "object", "properties": { "id": { "description": "The ID of the connection.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "name": { "description": "The name of the connection.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "strategy": { "type": "string", "description": "The auth strategy implemented by the connection." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "description": "The Auth0 Connection used for the authentication transaction that generated the event.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "request": { "type": "object", "properties": { "geo": { "description": "Geographic information about the request origin.", "type": "object", "properties": { "continent_code": { "type": "string", "description": "Continent code." }, "country_code": { "type": "string", "description": "Country code." }, "country_name": { "type": "string", "description": "Country name." }, "latitude": { "type": "number", "description": "Latitude coordinate." }, "longitude": { "type": "number", "description": "Longitude coordinate." }, "subdivision_code": { "type": "string", "description": "Subdivision (state/province) code." }, "subdivision_name": { "type": "string", "description": "Subdivision (state/province) name." }, "city_name": { "type": "string", "description": "City name." }, "time_zone": { "type": "string", "description": "Time zone." } }, "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "hostname": { "type": "string", "description": "The hostname the request is for." }, "custom_domain": { "type": "string", "description": "The custom domain used in the request (if any)." }, "ip": { "type": "string", "description": "The originating IP address of the request." }, "method": { "type": "string", "description": "The HTTP method used for the request." }, "user_agent": { "type": "string", "description": "The value of the `User-Agent` header." } }, "required": [ "geo", "hostname", "ip", "method", "user_agent" ], "unevaluatedProperties": { "not": {} }, "description": "An HTTP request.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "tenant": { "type": "object", "properties": { "id": { "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]", "description": "User-provided tenant identifier." } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a tenant in event context" }, "transaction": { "type": "object", "properties": { "acr_values": { "type": "array", "items": { "type": "string" }, "description": "acr_values in the request." }, "locale": { "type": "string", "description": "The locale used for this transaction." }, "login_hint": { "type": "string", "description": "Hint about the login identifier the user might use in this transaction." }, "prompt": { "type": "array", "items": { "type": "string" }, "description": "Instructions indicating whether the user may be prompted for re-authentication and consent." }, "protocol": { "description": "The protocol used for this transaction.", "type": "string", "enum": [ "oidc-basic-profile", "oidc-implicit-profile", "oauth2-device-code", "oauth2-resource-owner", "oauth2-resource-owner-jwt-bearer", "oauth2-password", "oauth2-webauthn", "oauth2-access-token", "oauth2-refresh-token", "oauth2-token-exchange", "oidc-hybrid-profile", "samlp", "wsfed", "wstrust-usernamemixed" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "redirect_uri": { "type": "string", "description": "The URL to which the client will be redirected when the transaction completes." }, "requested_scopes": { "type": "array", "items": { "type": "string" }, "description": "The scopes requested." }, "response_mode": { "description": "This transaction's method for returning parameters from the Authorization Endpoint.", "type": "string", "enum": [ "query", "fragment", "form_post", "web_message" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "response_type": { "type": "array", "items": { "type": "string", "enum": [ "code", "token", "id_token" ], "description": "OAuth/OIDC response types.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "description": "The kind of credential issued by this transaction." }, "state": { "type": "string", "description": "The OAuth state parameter for this transaction." }, "ui_locales": { "type": "array", "items": { "type": "string" }, "description": "The ui_locales requested for this transaction." } }, "required": [ "acr_values", "locale", "requested_scopes", "ui_locales" ], "unevaluatedProperties": { "not": {} }, "description": "An auth transaction.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "tenant" ], "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "object" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "platform-streaming-foundations" }, "a0tenant": { "description": "The auth0 tenant ID to which the event is associated.", "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]" }, "a0stream": { "description": "The auth0 event stream ID of the stream the event was delivered on.\nPresent when the event is delivered via an event stream; omitted when\nevents are retrieved via the Events API (GET /api/v2/events).", "type": "string", "examples": [ "est_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "est_[a-zA-Z0-9]{22}" } }, "required": [ "specversion", "type", "source", "id", "time", "data", "a0tenant" ], "unevaluatedProperties": { "not": {} }, "description": "Represents an event that occurs when a member is added to a group.", "x-release-lifecycle": "EA", "x-auth0-owner": "authn-b2b-acceleration", "x-auth0-event-category": "group", "example": { "specversion": "1.0", "type": "group.member.added", "source": "urn:auth0:example.auth0app.com", "id": "evt_vjFVP5pVdfvsfRKatshkVV", "time": "2025-02-01T12:34:56Z", "data": { "object": { "group": { "id": "grp_01949dad80fc7d56", "external_id": "my-external-id", "type": "connection", "connection_id": "con_kFOHQUeaCSC1Kjqz" }, "member": { "member_type": "user", "id": "user@example.com" } }, "previous_object": { "group": { "id": "grp_01949dad80fc7d56", "external_id": "my-external-id", "type": "connection", "connection_id": "con_kFOHQUeaCSC1Kjqz" }, "member": { "member_type": "user", "id": "user@example.com" } }, "context": { "client": { "id": "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc", "name": "sample", "metadata": {} }, "connection": { "id": "con_kFOHQUeaCSC1Kjqz", "name": "Username-Password-Authentication", "strategy": "sample" }, "request": { "geo": { "continent_code": "sample", "country_code": "sample", "country_name": "sample", "latitude": 3.14, "longitude": 3.14, "subdivision_code": "sample", "subdivision_name": "sample", "city_name": "sample", "time_zone": "sample" }, "hostname": "sample", "custom_domain": "sample", "ip": "sample", "method": "sample", "user_agent": "sample" }, "tenant": { "id": "my-tenant" }, "transaction": { "acr_values": [ "sample" ], "locale": "sample", "login_hint": "sample", "prompt": [ "sample" ], "protocol": "oidc-basic-profile", "redirect_uri": "sample", "requested_scopes": [ "sample" ], "response_mode": "query", "response_type": [ "code" ], "state": "sample", "ui_locales": [ "sample" ] } } }, "a0tenant": "my-tenant", "a0stream": "est_vjFVP5pVdfvsfRKatshkVV" } }, "group.member.deleted": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "group.member.deleted", "type": "object", "properties": { "specversion": { "description": "The version of the CloudEvents specification which the event uses.", "type": "string", "enum": [ "1.0" ], "x-auth0-owner": "platform-streaming-foundations" }, "type": { "type": "string", "const": "group.member.deleted", "description": "The type of the event which has happened." }, "source": { "type": "string", "examples": [ "urn:auth0:example.auth0app.com" ], "description": "The source of the event. This will take the form 'urn:auth0:.'." }, "id": { "description": "A unique identifier for the event.", "type": "string", "examples": [ "evt_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "evt_[a-zA-Z0-9]{22}" }, "time": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "An ISO-8601 timestamp indicating when the event physically occurred." }, "data": { "description": "The event payload.", "type": "object", "properties": { "object": { "description": "The event content.", "type": "object", "properties": { "group": { "description": "The group the member belongs to.", "oneOf": [ { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "type": { "type": "string", "const": "connection", "description": "The type of the group." }, "connection_id": { "description": "The connection ID associated with the group.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" } }, "required": [ "id", "type", "connection_id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a connection group" }, { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "type": { "type": "string", "const": "organization", "description": "The type of the group." }, "organization_id": { "description": "The organization ID associated with the group.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" } }, "required": [ "id", "type", "organization_id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to an organization group" }, { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "type": { "type": "string", "const": "tenant", "description": "The type of the group." } }, "required": [ "id", "type" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a tenant group" } ] }, "member": { "description": "The member that is a part of the group.", "oneOf": [ { "type": "object", "properties": { "member_type": { "type": "string", "const": "user", "description": "Type discriminator for user members" }, "id": { "type": "string", "examples": [ "user@example.com" ], "description": "The user's unique identifier" } }, "required": [ "member_type", "id" ], "unevaluatedProperties": { "not": {} }, "description": "A group member of member_type user" }, { "type": "object", "properties": { "member_type": { "type": "string", "const": "connection", "description": "Type discriminator for connection members" }, "id": { "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "description": "The connection member's unique identifier" }, "type": { "type": "string", "examples": [ "connection" ], "description": "The type of the connection" }, "connection_id": { "description": "Connection ID associated with the member", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" } }, "required": [ "member_type", "id", "type", "connection_id" ], "unevaluatedProperties": { "not": {} }, "description": "A group member of member_type group" } ], "title": "Group Member" } }, "required": [ "group", "member" ], "unevaluatedProperties": { "not": {} } }, "previous_object": { "description": "The event content as it was prior to the change described by this event, when applicable.", "type": "object", "properties": { "group": { "description": "The group the member belongs to.", "oneOf": [ { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "type": { "type": "string", "const": "connection", "description": "The type of the group." }, "connection_id": { "description": "The connection ID associated with the group.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" } }, "required": [ "id", "type", "connection_id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a connection group" }, { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "type": { "type": "string", "const": "organization", "description": "The type of the group." }, "organization_id": { "description": "The organization ID associated with the group.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" } }, "required": [ "id", "type", "organization_id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to an organization group" }, { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "type": { "type": "string", "const": "tenant", "description": "The type of the group." } }, "required": [ "id", "type" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a tenant group" } ] }, "member": { "description": "The member that is a part of the group.", "oneOf": [ { "type": "object", "properties": { "member_type": { "type": "string", "const": "user", "description": "Type discriminator for user members" }, "id": { "type": "string", "examples": [ "user@example.com" ], "description": "The user's unique identifier" } }, "required": [ "member_type", "id" ], "unevaluatedProperties": { "not": {} }, "description": "A group member of member_type user" }, { "type": "object", "properties": { "member_type": { "type": "string", "const": "connection", "description": "Type discriminator for connection members" }, "id": { "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "description": "The connection member's unique identifier" }, "type": { "type": "string", "examples": [ "connection" ], "description": "The type of the connection" }, "connection_id": { "description": "Connection ID associated with the member", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" } }, "required": [ "member_type", "id", "type", "connection_id" ], "unevaluatedProperties": { "not": {} }, "description": "A group member of member_type group" } ], "title": "Group Member" } }, "required": [ "group", "member" ], "unevaluatedProperties": { "not": {} } }, "context": { "description": "Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.", "type": "object", "properties": { "client": { "type": "object", "properties": { "id": { "description": "The client identifier.", "type": "string", "examples": [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] }, "name": { "type": "string", "description": "The client name." }, "metadata": { "description": "Client metadata.", "type": "object", "properties": {}, "unevaluatedProperties": {} } }, "required": [ "id", "name", "metadata" ], "unevaluatedProperties": { "not": {} }, "description": "The OAuth Client requesting or presenting an access token.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "connection": { "type": "object", "properties": { "id": { "description": "The ID of the connection.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "name": { "description": "The name of the connection.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "strategy": { "type": "string", "description": "The auth strategy implemented by the connection." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "description": "The Auth0 Connection used for the authentication transaction that generated the event.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "request": { "type": "object", "properties": { "geo": { "description": "Geographic information about the request origin.", "type": "object", "properties": { "continent_code": { "type": "string", "description": "Continent code." }, "country_code": { "type": "string", "description": "Country code." }, "country_name": { "type": "string", "description": "Country name." }, "latitude": { "type": "number", "description": "Latitude coordinate." }, "longitude": { "type": "number", "description": "Longitude coordinate." }, "subdivision_code": { "type": "string", "description": "Subdivision (state/province) code." }, "subdivision_name": { "type": "string", "description": "Subdivision (state/province) name." }, "city_name": { "type": "string", "description": "City name." }, "time_zone": { "type": "string", "description": "Time zone." } }, "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "hostname": { "type": "string", "description": "The hostname the request is for." }, "custom_domain": { "type": "string", "description": "The custom domain used in the request (if any)." }, "ip": { "type": "string", "description": "The originating IP address of the request." }, "method": { "type": "string", "description": "The HTTP method used for the request." }, "user_agent": { "type": "string", "description": "The value of the `User-Agent` header." } }, "required": [ "geo", "hostname", "ip", "method", "user_agent" ], "unevaluatedProperties": { "not": {} }, "description": "An HTTP request.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "tenant": { "type": "object", "properties": { "id": { "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]", "description": "User-provided tenant identifier." } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a tenant in event context" }, "transaction": { "type": "object", "properties": { "acr_values": { "type": "array", "items": { "type": "string" }, "description": "acr_values in the request." }, "locale": { "type": "string", "description": "The locale used for this transaction." }, "login_hint": { "type": "string", "description": "Hint about the login identifier the user might use in this transaction." }, "prompt": { "type": "array", "items": { "type": "string" }, "description": "Instructions indicating whether the user may be prompted for re-authentication and consent." }, "protocol": { "description": "The protocol used for this transaction.", "type": "string", "enum": [ "oidc-basic-profile", "oidc-implicit-profile", "oauth2-device-code", "oauth2-resource-owner", "oauth2-resource-owner-jwt-bearer", "oauth2-password", "oauth2-webauthn", "oauth2-access-token", "oauth2-refresh-token", "oauth2-token-exchange", "oidc-hybrid-profile", "samlp", "wsfed", "wstrust-usernamemixed" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "redirect_uri": { "type": "string", "description": "The URL to which the client will be redirected when the transaction completes." }, "requested_scopes": { "type": "array", "items": { "type": "string" }, "description": "The scopes requested." }, "response_mode": { "description": "This transaction's method for returning parameters from the Authorization Endpoint.", "type": "string", "enum": [ "query", "fragment", "form_post", "web_message" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "response_type": { "type": "array", "items": { "type": "string", "enum": [ "code", "token", "id_token" ], "description": "OAuth/OIDC response types.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "description": "The kind of credential issued by this transaction." }, "state": { "type": "string", "description": "The OAuth state parameter for this transaction." }, "ui_locales": { "type": "array", "items": { "type": "string" }, "description": "The ui_locales requested for this transaction." } }, "required": [ "acr_values", "locale", "requested_scopes", "ui_locales" ], "unevaluatedProperties": { "not": {} }, "description": "An auth transaction.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "tenant" ], "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "object" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "platform-streaming-foundations" }, "a0tenant": { "description": "The auth0 tenant ID to which the event is associated.", "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]" }, "a0stream": { "description": "The auth0 event stream ID of the stream the event was delivered on.\nPresent when the event is delivered via an event stream; omitted when\nevents are retrieved via the Events API (GET /api/v2/events).", "type": "string", "examples": [ "est_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "est_[a-zA-Z0-9]{22}" } }, "required": [ "specversion", "type", "source", "id", "time", "data", "a0tenant" ], "unevaluatedProperties": { "not": {} }, "description": "Represents an event that occurs when a member is removed from a group.", "x-release-lifecycle": "EA", "x-auth0-owner": "authn-b2b-acceleration", "x-auth0-event-category": "group", "example": { "specversion": "1.0", "type": "group.member.deleted", "source": "urn:auth0:example.auth0app.com", "id": "evt_vjFVP5pVdfvsfRKatshkVV", "time": "2025-02-01T12:34:56Z", "data": { "object": { "group": { "id": "grp_01949dad80fc7d56", "external_id": "my-external-id", "type": "connection", "connection_id": "con_kFOHQUeaCSC1Kjqz" }, "member": { "member_type": "user", "id": "user@example.com" } }, "previous_object": { "group": { "id": "grp_01949dad80fc7d56", "external_id": "my-external-id", "type": "connection", "connection_id": "con_kFOHQUeaCSC1Kjqz" }, "member": { "member_type": "user", "id": "user@example.com" } }, "context": { "client": { "id": "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc", "name": "sample", "metadata": {} }, "connection": { "id": "con_kFOHQUeaCSC1Kjqz", "name": "Username-Password-Authentication", "strategy": "sample" }, "request": { "geo": { "continent_code": "sample", "country_code": "sample", "country_name": "sample", "latitude": 3.14, "longitude": 3.14, "subdivision_code": "sample", "subdivision_name": "sample", "city_name": "sample", "time_zone": "sample" }, "hostname": "sample", "custom_domain": "sample", "ip": "sample", "method": "sample", "user_agent": "sample" }, "tenant": { "id": "my-tenant" }, "transaction": { "acr_values": [ "sample" ], "locale": "sample", "login_hint": "sample", "prompt": [ "sample" ], "protocol": "oidc-basic-profile", "redirect_uri": "sample", "requested_scopes": [ "sample" ], "response_mode": "query", "response_type": [ "code" ], "state": "sample", "ui_locales": [ "sample" ] } } }, "a0tenant": "my-tenant", "a0stream": "est_vjFVP5pVdfvsfRKatshkVV" } }, "group.role.assigned": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "group.role.assigned", "type": "object", "properties": { "specversion": { "description": "The version of the CloudEvents specification which the event uses.", "type": "string", "enum": [ "1.0" ], "x-auth0-owner": "platform-streaming-foundations" }, "type": { "type": "string", "const": "group.role.assigned", "description": "The type of the event which has happened." }, "source": { "type": "string", "examples": [ "urn:auth0:example.auth0app.com" ], "description": "The source of the event. This will take the form 'urn:auth0:.'." }, "id": { "description": "A unique identifier for the event.", "type": "string", "examples": [ "evt_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "evt_[a-zA-Z0-9]{22}" }, "time": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "An ISO-8601 timestamp indicating when the event physically occurred." }, "data": { "description": "The event payload.", "type": "object", "properties": { "object": { "description": "The event content.", "type": "object", "properties": { "group": { "description": "The group the role is assigned to.", "oneOf": [ { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "type": { "type": "string", "const": "connection", "description": "The type of the group." }, "connection_id": { "description": "The connection ID associated with the group.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" } }, "required": [ "id", "type", "connection_id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a connection group" }, { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "type": { "type": "string", "const": "organization", "description": "The type of the group." }, "organization_id": { "description": "The organization ID associated with the group.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" } }, "required": [ "id", "type", "organization_id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to an organization group" }, { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "type": { "type": "string", "const": "tenant", "description": "The type of the group." } }, "required": [ "id", "type" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a tenant group" } ] }, "role": { "description": "The role assigned to the group.", "type": "object", "properties": { "id": { "description": "The ID of the role.", "type": "string", "examples": [ "rol_1234567890abcdef" ], "pattern": "rol_[a-zA-Z0-9]{16}" }, "name": { "type": "string", "examples": [ "role-name" ], "description": "The name of the role." } }, "required": [ "id", "name" ], "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "created_at": { "type": "string", "format": "date-time", "description": "The time at which the role was assigned to the group." } }, "required": [ "group", "role", "created_at" ], "unevaluatedProperties": { "not": {} } }, "previous_object": { "description": "The event content as it was prior to the change described by this event, when applicable.", "type": "object", "properties": { "group": { "description": "The group the role is assigned to.", "oneOf": [ { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "type": { "type": "string", "const": "connection", "description": "The type of the group." }, "connection_id": { "description": "The connection ID associated with the group.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" } }, "required": [ "id", "type", "connection_id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a connection group" }, { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "type": { "type": "string", "const": "organization", "description": "The type of the group." }, "organization_id": { "description": "The organization ID associated with the group.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" } }, "required": [ "id", "type", "organization_id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to an organization group" }, { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "type": { "type": "string", "const": "tenant", "description": "The type of the group." } }, "required": [ "id", "type" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a tenant group" } ] }, "role": { "description": "The role assigned to the group.", "type": "object", "properties": { "id": { "description": "The ID of the role.", "type": "string", "examples": [ "rol_1234567890abcdef" ], "pattern": "rol_[a-zA-Z0-9]{16}" }, "name": { "type": "string", "examples": [ "role-name" ], "description": "The name of the role." } }, "required": [ "id", "name" ], "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "created_at": { "type": "string", "format": "date-time", "description": "The time at which the role was assigned to the group." } }, "required": [ "group", "role", "created_at" ], "unevaluatedProperties": { "not": {} } }, "context": { "description": "Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.", "type": "object", "properties": { "client": { "type": "object", "properties": { "id": { "description": "The client identifier.", "type": "string", "examples": [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] }, "name": { "type": "string", "description": "The client name." }, "metadata": { "description": "Client metadata.", "type": "object", "properties": {}, "unevaluatedProperties": {} } }, "required": [ "id", "name", "metadata" ], "unevaluatedProperties": { "not": {} }, "description": "The OAuth Client requesting or presenting an access token.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "connection": { "type": "object", "properties": { "id": { "description": "The ID of the connection.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "name": { "description": "The name of the connection.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "strategy": { "type": "string", "description": "The auth strategy implemented by the connection." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "description": "The Auth0 Connection used for the authentication transaction that generated the event.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "request": { "type": "object", "properties": { "geo": { "description": "Geographic information about the request origin.", "type": "object", "properties": { "continent_code": { "type": "string", "description": "Continent code." }, "country_code": { "type": "string", "description": "Country code." }, "country_name": { "type": "string", "description": "Country name." }, "latitude": { "type": "number", "description": "Latitude coordinate." }, "longitude": { "type": "number", "description": "Longitude coordinate." }, "subdivision_code": { "type": "string", "description": "Subdivision (state/province) code." }, "subdivision_name": { "type": "string", "description": "Subdivision (state/province) name." }, "city_name": { "type": "string", "description": "City name." }, "time_zone": { "type": "string", "description": "Time zone." } }, "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "hostname": { "type": "string", "description": "The hostname the request is for." }, "custom_domain": { "type": "string", "description": "The custom domain used in the request (if any)." }, "ip": { "type": "string", "description": "The originating IP address of the request." }, "method": { "type": "string", "description": "The HTTP method used for the request." }, "user_agent": { "type": "string", "description": "The value of the `User-Agent` header." } }, "required": [ "geo", "hostname", "ip", "method", "user_agent" ], "unevaluatedProperties": { "not": {} }, "description": "An HTTP request.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "tenant": { "type": "object", "properties": { "id": { "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]", "description": "User-provided tenant identifier." } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a tenant in event context" }, "transaction": { "type": "object", "properties": { "acr_values": { "type": "array", "items": { "type": "string" }, "description": "acr_values in the request." }, "locale": { "type": "string", "description": "The locale used for this transaction." }, "login_hint": { "type": "string", "description": "Hint about the login identifier the user might use in this transaction." }, "prompt": { "type": "array", "items": { "type": "string" }, "description": "Instructions indicating whether the user may be prompted for re-authentication and consent." }, "protocol": { "description": "The protocol used for this transaction.", "type": "string", "enum": [ "oidc-basic-profile", "oidc-implicit-profile", "oauth2-device-code", "oauth2-resource-owner", "oauth2-resource-owner-jwt-bearer", "oauth2-password", "oauth2-webauthn", "oauth2-access-token", "oauth2-refresh-token", "oauth2-token-exchange", "oidc-hybrid-profile", "samlp", "wsfed", "wstrust-usernamemixed" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "redirect_uri": { "type": "string", "description": "The URL to which the client will be redirected when the transaction completes." }, "requested_scopes": { "type": "array", "items": { "type": "string" }, "description": "The scopes requested." }, "response_mode": { "description": "This transaction's method for returning parameters from the Authorization Endpoint.", "type": "string", "enum": [ "query", "fragment", "form_post", "web_message" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "response_type": { "type": "array", "items": { "type": "string", "enum": [ "code", "token", "id_token" ], "description": "OAuth/OIDC response types.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "description": "The kind of credential issued by this transaction." }, "state": { "type": "string", "description": "The OAuth state parameter for this transaction." }, "ui_locales": { "type": "array", "items": { "type": "string" }, "description": "The ui_locales requested for this transaction." } }, "required": [ "acr_values", "locale", "requested_scopes", "ui_locales" ], "unevaluatedProperties": { "not": {} }, "description": "An auth transaction.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "tenant" ], "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "object" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "platform-streaming-foundations" }, "a0tenant": { "description": "The auth0 tenant ID to which the event is associated.", "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]" }, "a0stream": { "description": "The auth0 event stream ID of the stream the event was delivered on.\nPresent when the event is delivered via an event stream; omitted when\nevents are retrieved via the Events API (GET /api/v2/events).", "type": "string", "examples": [ "est_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "est_[a-zA-Z0-9]{22}" } }, "required": [ "specversion", "type", "source", "id", "time", "data", "a0tenant" ], "unevaluatedProperties": { "not": {} }, "description": "Represents an event that occurs when a role is assigned to a group.", "x-release-lifecycle": "GA", "x-auth0-owner": "authn-b2b-acceleration", "x-auth0-event-category": "group", "example": { "specversion": "1.0", "type": "group.role.assigned", "source": "urn:auth0:example.auth0app.com", "id": "evt_vjFVP5pVdfvsfRKatshkVV", "time": "2025-02-01T12:34:56Z", "data": { "object": { "group": { "id": "grp_01949dad80fc7d56", "external_id": "my-external-id", "type": "connection", "connection_id": "con_kFOHQUeaCSC1Kjqz" }, "role": { "id": "rol_1234567890abcdef", "name": "role-name" }, "created_at": "2023-04-01T13:45:30Z" }, "previous_object": { "group": { "id": "grp_01949dad80fc7d56", "external_id": "my-external-id", "type": "connection", "connection_id": "con_kFOHQUeaCSC1Kjqz" }, "role": { "id": "rol_1234567890abcdef", "name": "role-name" }, "created_at": "2023-04-01T13:45:30Z" }, "context": { "client": { "id": "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc", "name": "sample", "metadata": {} }, "connection": { "id": "con_kFOHQUeaCSC1Kjqz", "name": "Username-Password-Authentication", "strategy": "sample" }, "request": { "geo": { "continent_code": "sample", "country_code": "sample", "country_name": "sample", "latitude": 3.14, "longitude": 3.14, "subdivision_code": "sample", "subdivision_name": "sample", "city_name": "sample", "time_zone": "sample" }, "hostname": "sample", "custom_domain": "sample", "ip": "sample", "method": "sample", "user_agent": "sample" }, "tenant": { "id": "my-tenant" }, "transaction": { "acr_values": [ "sample" ], "locale": "sample", "login_hint": "sample", "prompt": [ "sample" ], "protocol": "oidc-basic-profile", "redirect_uri": "sample", "requested_scopes": [ "sample" ], "response_mode": "query", "response_type": [ "code" ], "state": "sample", "ui_locales": [ "sample" ] } } }, "a0tenant": "my-tenant", "a0stream": "est_vjFVP5pVdfvsfRKatshkVV" } }, "group.role.deleted": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "group.role.deleted", "type": "object", "properties": { "specversion": { "description": "The version of the CloudEvents specification which the event uses.", "type": "string", "enum": [ "1.0" ], "x-auth0-owner": "platform-streaming-foundations" }, "type": { "type": "string", "const": "group.role.deleted", "description": "The type of the event which has happened." }, "source": { "type": "string", "examples": [ "urn:auth0:example.auth0app.com" ], "description": "The source of the event. This will take the form 'urn:auth0:.'." }, "id": { "description": "A unique identifier for the event.", "type": "string", "examples": [ "evt_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "evt_[a-zA-Z0-9]{22}" }, "time": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "An ISO-8601 timestamp indicating when the event physically occurred." }, "data": { "description": "The event payload.", "type": "object", "properties": { "object": { "description": "The event content.", "type": "object", "properties": { "group": { "description": "The group the role is removed from.", "oneOf": [ { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "type": { "type": "string", "const": "connection", "description": "The type of the group." }, "connection_id": { "description": "The connection ID associated with the group.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" } }, "required": [ "id", "type", "connection_id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a connection group" }, { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "type": { "type": "string", "const": "organization", "description": "The type of the group." }, "organization_id": { "description": "The organization ID associated with the group.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" } }, "required": [ "id", "type", "organization_id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to an organization group" }, { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "type": { "type": "string", "const": "tenant", "description": "The type of the group." } }, "required": [ "id", "type" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a tenant group" } ] }, "role": { "description": "The role removed from the group.", "type": "object", "properties": { "id": { "description": "The ID of the role.", "type": "string", "examples": [ "rol_1234567890abcdef" ], "pattern": "rol_[a-zA-Z0-9]{16}" } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} } }, "deleted_at": { "type": "string", "format": "date-time", "description": "The time at which the role was removed from the group." } }, "required": [ "group", "role", "deleted_at" ], "unevaluatedProperties": { "not": {} } }, "previous_object": { "description": "The event content as it was prior to the change described by this event, when applicable.", "type": "object", "properties": { "group": { "description": "The group the role is assigned to.", "oneOf": [ { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "type": { "type": "string", "const": "connection", "description": "The type of the group." }, "connection_id": { "description": "The connection ID associated with the group.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" } }, "required": [ "id", "type", "connection_id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a connection group" }, { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "type": { "type": "string", "const": "organization", "description": "The type of the group." }, "organization_id": { "description": "The organization ID associated with the group.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" } }, "required": [ "id", "type", "organization_id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to an organization group" }, { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "type": { "type": "string", "const": "tenant", "description": "The type of the group." } }, "required": [ "id", "type" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a tenant group" } ] }, "role": { "description": "The role assigned to the group.", "type": "object", "properties": { "id": { "description": "The ID of the role.", "type": "string", "examples": [ "rol_1234567890abcdef" ], "pattern": "rol_[a-zA-Z0-9]{16}" }, "name": { "type": "string", "examples": [ "role-name" ], "description": "The name of the role." } }, "required": [ "id", "name" ], "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "created_at": { "type": "string", "format": "date-time", "description": "The time at which the role was assigned to the group." } }, "required": [ "group", "role", "created_at" ], "unevaluatedProperties": { "not": {} } }, "context": { "description": "Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.", "type": "object", "properties": { "client": { "type": "object", "properties": { "id": { "description": "The client identifier.", "type": "string", "examples": [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] }, "name": { "type": "string", "description": "The client name." }, "metadata": { "description": "Client metadata.", "type": "object", "properties": {}, "unevaluatedProperties": {} } }, "required": [ "id", "name", "metadata" ], "unevaluatedProperties": { "not": {} }, "description": "The OAuth Client requesting or presenting an access token.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "connection": { "type": "object", "properties": { "id": { "description": "The ID of the connection.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "name": { "description": "The name of the connection.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "strategy": { "type": "string", "description": "The auth strategy implemented by the connection." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "description": "The Auth0 Connection used for the authentication transaction that generated the event.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "request": { "type": "object", "properties": { "geo": { "description": "Geographic information about the request origin.", "type": "object", "properties": { "continent_code": { "type": "string", "description": "Continent code." }, "country_code": { "type": "string", "description": "Country code." }, "country_name": { "type": "string", "description": "Country name." }, "latitude": { "type": "number", "description": "Latitude coordinate." }, "longitude": { "type": "number", "description": "Longitude coordinate." }, "subdivision_code": { "type": "string", "description": "Subdivision (state/province) code." }, "subdivision_name": { "type": "string", "description": "Subdivision (state/province) name." }, "city_name": { "type": "string", "description": "City name." }, "time_zone": { "type": "string", "description": "Time zone." } }, "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "hostname": { "type": "string", "description": "The hostname the request is for." }, "custom_domain": { "type": "string", "description": "The custom domain used in the request (if any)." }, "ip": { "type": "string", "description": "The originating IP address of the request." }, "method": { "type": "string", "description": "The HTTP method used for the request." }, "user_agent": { "type": "string", "description": "The value of the `User-Agent` header." } }, "required": [ "geo", "hostname", "ip", "method", "user_agent" ], "unevaluatedProperties": { "not": {} }, "description": "An HTTP request.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "tenant": { "type": "object", "properties": { "id": { "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]", "description": "User-provided tenant identifier." } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a tenant in event context" }, "transaction": { "type": "object", "properties": { "acr_values": { "type": "array", "items": { "type": "string" }, "description": "acr_values in the request." }, "locale": { "type": "string", "description": "The locale used for this transaction." }, "login_hint": { "type": "string", "description": "Hint about the login identifier the user might use in this transaction." }, "prompt": { "type": "array", "items": { "type": "string" }, "description": "Instructions indicating whether the user may be prompted for re-authentication and consent." }, "protocol": { "description": "The protocol used for this transaction.", "type": "string", "enum": [ "oidc-basic-profile", "oidc-implicit-profile", "oauth2-device-code", "oauth2-resource-owner", "oauth2-resource-owner-jwt-bearer", "oauth2-password", "oauth2-webauthn", "oauth2-access-token", "oauth2-refresh-token", "oauth2-token-exchange", "oidc-hybrid-profile", "samlp", "wsfed", "wstrust-usernamemixed" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "redirect_uri": { "type": "string", "description": "The URL to which the client will be redirected when the transaction completes." }, "requested_scopes": { "type": "array", "items": { "type": "string" }, "description": "The scopes requested." }, "response_mode": { "description": "This transaction's method for returning parameters from the Authorization Endpoint.", "type": "string", "enum": [ "query", "fragment", "form_post", "web_message" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "response_type": { "type": "array", "items": { "type": "string", "enum": [ "code", "token", "id_token" ], "description": "OAuth/OIDC response types.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "description": "The kind of credential issued by this transaction." }, "state": { "type": "string", "description": "The OAuth state parameter for this transaction." }, "ui_locales": { "type": "array", "items": { "type": "string" }, "description": "The ui_locales requested for this transaction." } }, "required": [ "acr_values", "locale", "requested_scopes", "ui_locales" ], "unevaluatedProperties": { "not": {} }, "description": "An auth transaction.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "tenant" ], "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "object" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "platform-streaming-foundations" }, "a0tenant": { "description": "The auth0 tenant ID to which the event is associated.", "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]" }, "a0stream": { "description": "The auth0 event stream ID of the stream the event was delivered on.\nPresent when the event is delivered via an event stream; omitted when\nevents are retrieved via the Events API (GET /api/v2/events).", "type": "string", "examples": [ "est_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "est_[a-zA-Z0-9]{22}" } }, "required": [ "specversion", "type", "source", "id", "time", "data", "a0tenant" ], "unevaluatedProperties": { "not": {} }, "description": "Represents an event that occurs when a role is removed from a group.", "x-release-lifecycle": "GA", "x-auth0-owner": "authn-b2b-acceleration", "x-auth0-event-category": "group", "example": { "specversion": "1.0", "type": "group.role.deleted", "source": "urn:auth0:example.auth0app.com", "id": "evt_vjFVP5pVdfvsfRKatshkVV", "time": "2025-02-01T12:34:56Z", "data": { "object": { "group": { "id": "grp_01949dad80fc7d56", "external_id": "my-external-id", "type": "connection", "connection_id": "con_kFOHQUeaCSC1Kjqz" }, "role": { "id": "rol_1234567890abcdef" }, "deleted_at": "2023-04-01T13:45:30Z" }, "previous_object": { "group": { "id": "grp_01949dad80fc7d56", "external_id": "my-external-id", "type": "connection", "connection_id": "con_kFOHQUeaCSC1Kjqz" }, "role": { "id": "rol_1234567890abcdef", "name": "role-name" }, "created_at": "2023-04-01T13:45:30Z" }, "context": { "client": { "id": "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc", "name": "sample", "metadata": {} }, "connection": { "id": "con_kFOHQUeaCSC1Kjqz", "name": "Username-Password-Authentication", "strategy": "sample" }, "request": { "geo": { "continent_code": "sample", "country_code": "sample", "country_name": "sample", "latitude": 3.14, "longitude": 3.14, "subdivision_code": "sample", "subdivision_name": "sample", "city_name": "sample", "time_zone": "sample" }, "hostname": "sample", "custom_domain": "sample", "ip": "sample", "method": "sample", "user_agent": "sample" }, "tenant": { "id": "my-tenant" }, "transaction": { "acr_values": [ "sample" ], "locale": "sample", "login_hint": "sample", "prompt": [ "sample" ], "protocol": "oidc-basic-profile", "redirect_uri": "sample", "requested_scopes": [ "sample" ], "response_mode": "query", "response_type": [ "code" ], "state": "sample", "ui_locales": [ "sample" ] } } }, "a0tenant": "my-tenant", "a0stream": "est_vjFVP5pVdfvsfRKatshkVV" } }, "group.updated": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "group.updated", "type": "object", "properties": { "specversion": { "description": "The version of the CloudEvents specification which the event uses.", "type": "string", "enum": [ "1.0" ], "x-auth0-owner": "platform-streaming-foundations" }, "type": { "type": "string", "const": "group.updated", "description": "The type of the event which has happened." }, "source": { "type": "string", "examples": [ "urn:auth0:example.auth0app.com" ], "description": "The source of the event. This will take the form 'urn:auth0:.'." }, "id": { "description": "A unique identifier for the event.", "type": "string", "examples": [ "evt_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "evt_[a-zA-Z0-9]{22}" }, "time": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "An ISO-8601 timestamp indicating when the event physically occurred." }, "data": { "description": "The event payload.", "type": "object", "properties": { "object": { "description": "The event content.", "oneOf": [ { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "name": { "type": "string", "examples": [ "My Group" ], "description": "The name of the group." }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "created_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was created (ISO_8601 format)." }, "type": { "type": "string", "const": "connection", "description": "The type of the group." }, "connection_id": { "description": "The connection ID associated with the group.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "updated_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was last updated/modified (ISO_8601 format)." } }, "required": [ "id", "name", "created_at", "type", "connection_id", "updated_at" ], "unevaluatedProperties": { "not": {} }, "description": "Connection group with updated_at timestamp" }, { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "name": { "type": "string", "examples": [ "My Group" ], "description": "The name of the group." }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "created_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was created (ISO_8601 format)." }, "type": { "type": "string", "const": "organization", "description": "The type of the group." }, "organization_id": { "description": "The organization ID associated with the group.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" }, "updated_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was last updated/modified (ISO_8601 format)." } }, "required": [ "id", "name", "created_at", "type", "organization_id", "updated_at" ], "unevaluatedProperties": { "not": {} }, "description": "Organization group with updated_at timestamp" }, { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "name": { "type": "string", "examples": [ "My Group" ], "description": "The name of the group." }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "created_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was created (ISO_8601 format)." }, "type": { "type": "string", "const": "tenant", "description": "The type of the group." }, "updated_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was last updated/modified (ISO_8601 format)." } }, "required": [ "id", "name", "created_at", "type", "updated_at" ], "unevaluatedProperties": { "not": {} }, "description": "Tenant group with updated_at timestamp" } ] }, "previous_object": { "description": "The event content as it was prior to the change described by this event, when applicable.", "oneOf": [ { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "name": { "type": "string", "examples": [ "My Group" ], "description": "The name of the group." }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "created_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was created (ISO_8601 format)." }, "type": { "type": "string", "const": "connection", "description": "The type of the group." }, "connection_id": { "description": "The connection ID associated with the group.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "updated_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was last updated/modified (ISO_8601 format)." } }, "required": [ "id", "name", "created_at", "type", "connection_id", "updated_at" ], "unevaluatedProperties": { "not": {} }, "description": "Connection group with updated_at timestamp" }, { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "name": { "type": "string", "examples": [ "My Group" ], "description": "The name of the group." }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "created_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was created (ISO_8601 format)." }, "type": { "type": "string", "const": "organization", "description": "The type of the group." }, "organization_id": { "description": "The organization ID associated with the group.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" }, "updated_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was last updated/modified (ISO_8601 format)." } }, "required": [ "id", "name", "created_at", "type", "organization_id", "updated_at" ], "unevaluatedProperties": { "not": {} }, "description": "Organization group with updated_at timestamp" }, { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "name": { "type": "string", "examples": [ "My Group" ], "description": "The name of the group." }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "created_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was created (ISO_8601 format)." }, "type": { "type": "string", "const": "tenant", "description": "The type of the group." }, "updated_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was last updated/modified (ISO_8601 format)." } }, "required": [ "id", "name", "created_at", "type", "updated_at" ], "unevaluatedProperties": { "not": {} }, "description": "Tenant group with updated_at timestamp" } ] }, "context": { "description": "Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.", "type": "object", "properties": { "client": { "type": "object", "properties": { "id": { "description": "The client identifier.", "type": "string", "examples": [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] }, "name": { "type": "string", "description": "The client name." }, "metadata": { "description": "Client metadata.", "type": "object", "properties": {}, "unevaluatedProperties": {} } }, "required": [ "id", "name", "metadata" ], "unevaluatedProperties": { "not": {} }, "description": "The OAuth Client requesting or presenting an access token.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "connection": { "type": "object", "properties": { "id": { "description": "The ID of the connection.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "name": { "description": "The name of the connection.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "strategy": { "type": "string", "description": "The auth strategy implemented by the connection." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "description": "The Auth0 Connection used for the authentication transaction that generated the event.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "request": { "type": "object", "properties": { "geo": { "description": "Geographic information about the request origin.", "type": "object", "properties": { "continent_code": { "type": "string", "description": "Continent code." }, "country_code": { "type": "string", "description": "Country code." }, "country_name": { "type": "string", "description": "Country name." }, "latitude": { "type": "number", "description": "Latitude coordinate." }, "longitude": { "type": "number", "description": "Longitude coordinate." }, "subdivision_code": { "type": "string", "description": "Subdivision (state/province) code." }, "subdivision_name": { "type": "string", "description": "Subdivision (state/province) name." }, "city_name": { "type": "string", "description": "City name." }, "time_zone": { "type": "string", "description": "Time zone." } }, "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "hostname": { "type": "string", "description": "The hostname the request is for." }, "custom_domain": { "type": "string", "description": "The custom domain used in the request (if any)." }, "ip": { "type": "string", "description": "The originating IP address of the request." }, "method": { "type": "string", "description": "The HTTP method used for the request." }, "user_agent": { "type": "string", "description": "The value of the `User-Agent` header." } }, "required": [ "geo", "hostname", "ip", "method", "user_agent" ], "unevaluatedProperties": { "not": {} }, "description": "An HTTP request.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "tenant": { "type": "object", "properties": { "id": { "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]", "description": "User-provided tenant identifier." } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a tenant in event context" }, "transaction": { "type": "object", "properties": { "acr_values": { "type": "array", "items": { "type": "string" }, "description": "acr_values in the request." }, "locale": { "type": "string", "description": "The locale used for this transaction." }, "login_hint": { "type": "string", "description": "Hint about the login identifier the user might use in this transaction." }, "prompt": { "type": "array", "items": { "type": "string" }, "description": "Instructions indicating whether the user may be prompted for re-authentication and consent." }, "protocol": { "description": "The protocol used for this transaction.", "type": "string", "enum": [ "oidc-basic-profile", "oidc-implicit-profile", "oauth2-device-code", "oauth2-resource-owner", "oauth2-resource-owner-jwt-bearer", "oauth2-password", "oauth2-webauthn", "oauth2-access-token", "oauth2-refresh-token", "oauth2-token-exchange", "oidc-hybrid-profile", "samlp", "wsfed", "wstrust-usernamemixed" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "redirect_uri": { "type": "string", "description": "The URL to which the client will be redirected when the transaction completes." }, "requested_scopes": { "type": "array", "items": { "type": "string" }, "description": "The scopes requested." }, "response_mode": { "description": "This transaction's method for returning parameters from the Authorization Endpoint.", "type": "string", "enum": [ "query", "fragment", "form_post", "web_message" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "response_type": { "type": "array", "items": { "type": "string", "enum": [ "code", "token", "id_token" ], "description": "OAuth/OIDC response types.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "description": "The kind of credential issued by this transaction." }, "state": { "type": "string", "description": "The OAuth state parameter for this transaction." }, "ui_locales": { "type": "array", "items": { "type": "string" }, "description": "The ui_locales requested for this transaction." } }, "required": [ "acr_values", "locale", "requested_scopes", "ui_locales" ], "unevaluatedProperties": { "not": {} }, "description": "An auth transaction.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "tenant" ], "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "object" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "platform-streaming-foundations" }, "a0tenant": { "description": "The auth0 tenant ID to which the event is associated.", "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]" }, "a0stream": { "description": "The auth0 event stream ID of the stream the event was delivered on.\nPresent when the event is delivered via an event stream; omitted when\nevents are retrieved via the Events API (GET /api/v2/events).", "type": "string", "examples": [ "est_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "est_[a-zA-Z0-9]{22}" } }, "required": [ "specversion", "type", "source", "id", "time", "data", "a0tenant" ], "unevaluatedProperties": { "not": {} }, "description": "Represents an event that occurs when a group is updated.", "x-release-lifecycle": "EA", "x-auth0-owner": "authn-b2b-acceleration", "x-auth0-event-category": "group", "example": { "specversion": "1.0", "type": "group.updated", "source": "urn:auth0:example.auth0app.com", "id": "evt_vjFVP5pVdfvsfRKatshkVV", "time": "2025-02-01T12:34:56Z", "data": { "object": { "id": "grp_01949dad80fc7d56", "name": "My Group", "external_id": "my-external-id", "created_at": "2025-02-01T12:34:56Z", "type": "connection", "connection_id": "con_kFOHQUeaCSC1Kjqz", "updated_at": "2025-02-01T12:34:56Z" }, "previous_object": { "id": "grp_01949dad80fc7d56", "name": "My Group", "external_id": "my-external-id", "created_at": "2025-02-01T12:34:56Z", "type": "connection", "connection_id": "con_kFOHQUeaCSC1Kjqz", "updated_at": "2025-02-01T12:34:56Z" }, "context": { "client": { "id": "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc", "name": "sample", "metadata": {} }, "connection": { "id": "con_kFOHQUeaCSC1Kjqz", "name": "Username-Password-Authentication", "strategy": "sample" }, "request": { "geo": { "continent_code": "sample", "country_code": "sample", "country_name": "sample", "latitude": 3.14, "longitude": 3.14, "subdivision_code": "sample", "subdivision_name": "sample", "city_name": "sample", "time_zone": "sample" }, "hostname": "sample", "custom_domain": "sample", "ip": "sample", "method": "sample", "user_agent": "sample" }, "tenant": { "id": "my-tenant" }, "transaction": { "acr_values": [ "sample" ], "locale": "sample", "login_hint": "sample", "prompt": [ "sample" ], "protocol": "oidc-basic-profile", "redirect_uri": "sample", "requested_scopes": [ "sample" ], "response_mode": "query", "response_type": [ "code" ], "state": "sample", "ui_locales": [ "sample" ] } } }, "a0tenant": "my-tenant", "a0stream": "est_vjFVP5pVdfvsfRKatshkVV" } }, "organization.connection.added": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "organization.connection.added", "type": "object", "properties": { "specversion": { "description": "The version of the CloudEvents specification which the event uses.", "type": "string", "enum": [ "1.0" ], "x-auth0-owner": "platform-streaming-foundations" }, "type": { "type": "string", "const": "organization.connection.added", "description": "The type of the event which has happened." }, "source": { "type": "string", "examples": [ "urn:auth0:example.auth0app.com" ], "description": "The source of the event. This will take the form 'urn:auth0:.'." }, "id": { "description": "A unique identifier for the event.", "type": "string", "examples": [ "evt_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "evt_[a-zA-Z0-9]{22}" }, "time": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "An ISO-8601 timestamp indicating when the event physically occurred." }, "data": { "description": "The event payload.", "type": "object", "properties": { "object": { "description": "The event content.", "type": "object", "properties": { "organization": { "type": "object", "properties": { "name": { "description": "The human-readable identifier for the organization that will be used by end-users to direct them to their organization in your application..", "type": "string", "examples": [ "my-organization" ], "pattern": "^(?:(?!org_))[a-z0-9]([a-z0-9-_]*[a-z0-9])?$" }, "id": { "description": "ID of the organization.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} }, "description": "Information about an Auth0 Organization.", "x-release-lifecycle": "EA", "x-auth0-owner": "authn-b2b-organizations" }, "connection": { "type": "object", "properties": { "id": { "description": "The ID of the connection.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} } }, "assign_membership_on_login": { "type": "boolean", "description": "When true, all users that log in with this connection will be automatically granted membership\nin the organization. When false, users must be granted membership in the organization before\nlogging in with this connection." }, "show_as_button": { "type": "boolean", "description": "Determines whether a connection should be displayed on this organization’s login prompt.\nOnly applicable for enterprise connections." }, "is_signup_enabled": { "type": "boolean", "description": "Determines whether organization signup should be enabled for this organization connection.\nOnly applicable for database connections." }, "is_enabled": { "type": "boolean", "description": "Determines whether the connection is enabled for the organization." }, "organization_access_level": { "description": "The access level granted to the connection for an organization.", "oneOf": [ { "type": "string", "const": "none" }, { "type": "string", "const": "readonly" }, { "type": "string", "const": "limited" }, { "type": "string", "const": "full" } ] }, "organization_member_access_level": { "description": "The organization member access level granted to the connection for an organization.", "oneOf": [ { "type": "string", "const": "none" }, { "type": "string", "const": "readonly" }, { "type": "string", "const": "limited" }, { "type": "string", "const": "full" } ] } }, "required": [ "organization", "connection" ], "unevaluatedProperties": { "not": {} } }, "previous_object": { "description": "The event content as it was prior to the change described by this event, when applicable.", "type": "object", "properties": { "organization": { "type": "object", "properties": { "name": { "description": "The human-readable identifier for the organization that will be used by end-users to direct them to their organization in your application..", "type": "string", "examples": [ "my-organization" ], "pattern": "^(?:(?!org_))[a-z0-9]([a-z0-9-_]*[a-z0-9])?$" }, "id": { "description": "ID of the organization.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} }, "description": "Information about an Auth0 Organization.", "x-release-lifecycle": "EA", "x-auth0-owner": "authn-b2b-organizations" }, "connection": { "type": "object", "properties": { "id": { "description": "The ID of the connection.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} } }, "assign_membership_on_login": { "type": "boolean", "description": "When true, all users that log in with this connection will be automatically granted membership\nin the organization. When false, users must be granted membership in the organization before\nlogging in with this connection." }, "show_as_button": { "type": "boolean", "description": "Determines whether a connection should be displayed on this organization’s login prompt.\nOnly applicable for enterprise connections." }, "is_signup_enabled": { "type": "boolean", "description": "Determines whether organization signup should be enabled for this organization connection.\nOnly applicable for database connections." }, "is_enabled": { "type": "boolean", "description": "Determines whether the connection is enabled for the organization." }, "organization_access_level": { "description": "The access level granted to the connection for an organization.", "oneOf": [ { "type": "string", "const": "none" }, { "type": "string", "const": "readonly" }, { "type": "string", "const": "limited" }, { "type": "string", "const": "full" } ] }, "organization_member_access_level": { "description": "The organization member access level granted to the connection for an organization.", "oneOf": [ { "type": "string", "const": "none" }, { "type": "string", "const": "readonly" }, { "type": "string", "const": "limited" }, { "type": "string", "const": "full" } ] } }, "required": [ "organization", "connection" ], "unevaluatedProperties": { "not": {} } }, "context": { "description": "Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.", "type": "object", "properties": { "client": { "type": "object", "properties": { "id": { "description": "The client identifier.", "type": "string", "examples": [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] }, "name": { "type": "string", "description": "The client name." }, "metadata": { "description": "Client metadata.", "type": "object", "properties": {}, "unevaluatedProperties": {} } }, "required": [ "id", "name", "metadata" ], "unevaluatedProperties": { "not": {} }, "description": "The OAuth Client requesting or presenting an access token.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "connection": { "type": "object", "properties": { "id": { "description": "The ID of the connection.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "name": { "description": "The name of the connection.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "strategy": { "type": "string", "description": "The auth strategy implemented by the connection." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "description": "The Auth0 Connection used for the authentication transaction that generated the event.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "request": { "type": "object", "properties": { "geo": { "description": "Geographic information about the request origin.", "type": "object", "properties": { "continent_code": { "type": "string", "description": "Continent code." }, "country_code": { "type": "string", "description": "Country code." }, "country_name": { "type": "string", "description": "Country name." }, "latitude": { "type": "number", "description": "Latitude coordinate." }, "longitude": { "type": "number", "description": "Longitude coordinate." }, "subdivision_code": { "type": "string", "description": "Subdivision (state/province) code." }, "subdivision_name": { "type": "string", "description": "Subdivision (state/province) name." }, "city_name": { "type": "string", "description": "City name." }, "time_zone": { "type": "string", "description": "Time zone." } }, "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "hostname": { "type": "string", "description": "The hostname the request is for." }, "custom_domain": { "type": "string", "description": "The custom domain used in the request (if any)." }, "ip": { "type": "string", "description": "The originating IP address of the request." }, "method": { "type": "string", "description": "The HTTP method used for the request." }, "user_agent": { "type": "string", "description": "The value of the `User-Agent` header." } }, "required": [ "geo", "hostname", "ip", "method", "user_agent" ], "unevaluatedProperties": { "not": {} }, "description": "An HTTP request.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "tenant": { "type": "object", "properties": { "id": { "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]", "description": "User-provided tenant identifier." } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a tenant in event context" }, "transaction": { "type": "object", "properties": { "acr_values": { "type": "array", "items": { "type": "string" }, "description": "acr_values in the request." }, "locale": { "type": "string", "description": "The locale used for this transaction." }, "login_hint": { "type": "string", "description": "Hint about the login identifier the user might use in this transaction." }, "prompt": { "type": "array", "items": { "type": "string" }, "description": "Instructions indicating whether the user may be prompted for re-authentication and consent." }, "protocol": { "description": "The protocol used for this transaction.", "type": "string", "enum": [ "oidc-basic-profile", "oidc-implicit-profile", "oauth2-device-code", "oauth2-resource-owner", "oauth2-resource-owner-jwt-bearer", "oauth2-password", "oauth2-webauthn", "oauth2-access-token", "oauth2-refresh-token", "oauth2-token-exchange", "oidc-hybrid-profile", "samlp", "wsfed", "wstrust-usernamemixed" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "redirect_uri": { "type": "string", "description": "The URL to which the client will be redirected when the transaction completes." }, "requested_scopes": { "type": "array", "items": { "type": "string" }, "description": "The scopes requested." }, "response_mode": { "description": "This transaction's method for returning parameters from the Authorization Endpoint.", "type": "string", "enum": [ "query", "fragment", "form_post", "web_message" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "response_type": { "type": "array", "items": { "type": "string", "enum": [ "code", "token", "id_token" ], "description": "OAuth/OIDC response types.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "description": "The kind of credential issued by this transaction." }, "state": { "type": "string", "description": "The OAuth state parameter for this transaction." }, "ui_locales": { "type": "array", "items": { "type": "string" }, "description": "The ui_locales requested for this transaction." } }, "required": [ "acr_values", "locale", "requested_scopes", "ui_locales" ], "unevaluatedProperties": { "not": {} }, "description": "An auth transaction.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "tenant" ], "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "object" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "platform-streaming-foundations" }, "a0tenant": { "description": "The auth0 tenant ID to which the event is associated.", "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]" }, "a0stream": { "description": "The auth0 event stream ID of the stream the event was delivered on.\nPresent when the event is delivered via an event stream; omitted when\nevents are retrieved via the Events API (GET /api/v2/events).", "type": "string", "examples": [ "est_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "est_[a-zA-Z0-9]{22}" } }, "required": [ "specversion", "type", "source", "id", "time", "data", "a0tenant" ], "unevaluatedProperties": { "not": {} }, "description": "Represents an event that occurs when a connection is added to an organization.", "x-release-lifecycle": "EA", "x-auth0-owner": "authn-b2b-organizations", "x-auth0-event-category": "organization", "example": { "specversion": "1.0", "type": "organization.connection.added", "source": "urn:auth0:example.auth0app.com", "id": "evt_vjFVP5pVdfvsfRKatshkVV", "time": "2025-02-01T12:34:56Z", "data": { "object": { "organization": { "name": "my-organization", "id": "org_1234567890abcdef" }, "connection": { "id": "con_kFOHQUeaCSC1Kjqz" }, "assign_membership_on_login": false, "show_as_button": false, "is_signup_enabled": false, "is_enabled": false, "organization_access_level": "none", "organization_member_access_level": "none" }, "previous_object": { "organization": { "name": "my-organization", "id": "org_1234567890abcdef" }, "connection": { "id": "con_kFOHQUeaCSC1Kjqz" }, "assign_membership_on_login": false, "show_as_button": false, "is_signup_enabled": false, "is_enabled": false, "organization_access_level": "none", "organization_member_access_level": "none" }, "context": { "client": { "id": "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc", "name": "sample", "metadata": {} }, "connection": { "id": "con_kFOHQUeaCSC1Kjqz", "name": "Username-Password-Authentication", "strategy": "sample" }, "request": { "geo": { "continent_code": "sample", "country_code": "sample", "country_name": "sample", "latitude": 3.14, "longitude": 3.14, "subdivision_code": "sample", "subdivision_name": "sample", "city_name": "sample", "time_zone": "sample" }, "hostname": "sample", "custom_domain": "sample", "ip": "sample", "method": "sample", "user_agent": "sample" }, "tenant": { "id": "my-tenant" }, "transaction": { "acr_values": [ "sample" ], "locale": "sample", "login_hint": "sample", "prompt": [ "sample" ], "protocol": "oidc-basic-profile", "redirect_uri": "sample", "requested_scopes": [ "sample" ], "response_mode": "query", "response_type": [ "code" ], "state": "sample", "ui_locales": [ "sample" ] } } }, "a0tenant": "my-tenant", "a0stream": "est_vjFVP5pVdfvsfRKatshkVV" } }, "organization.connection.removed": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "organization.connection.removed", "type": "object", "properties": { "specversion": { "description": "The version of the CloudEvents specification which the event uses.", "type": "string", "enum": [ "1.0" ], "x-auth0-owner": "platform-streaming-foundations" }, "type": { "type": "string", "const": "organization.connection.removed", "description": "The type of the event which has happened." }, "source": { "type": "string", "examples": [ "urn:auth0:example.auth0app.com" ], "description": "The source of the event. This will take the form 'urn:auth0:.'." }, "id": { "description": "A unique identifier for the event.", "type": "string", "examples": [ "evt_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "evt_[a-zA-Z0-9]{22}" }, "time": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "An ISO-8601 timestamp indicating when the event physically occurred." }, "data": { "description": "The event payload.", "type": "object", "properties": { "object": { "description": "The event content.", "type": "object", "properties": { "organization": { "type": "object", "properties": { "name": { "description": "The human-readable identifier for the organization that will be used by end-users to direct them to their organization in your application..", "type": "string", "examples": [ "my-organization" ], "pattern": "^(?:(?!org_))[a-z0-9]([a-z0-9-_]*[a-z0-9])?$" }, "id": { "description": "ID of the organization.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} }, "description": "Information about an Auth0 Organization.", "x-release-lifecycle": "EA", "x-auth0-owner": "authn-b2b-organizations" }, "connection": { "type": "object", "properties": { "id": { "description": "The ID of the connection.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} } } }, "required": [ "organization", "connection" ], "unevaluatedProperties": { "not": {} } }, "previous_object": { "description": "The event content as it was prior to the change described by this event, when applicable.", "type": "object", "properties": { "organization": { "type": "object", "properties": { "name": { "description": "The human-readable identifier for the organization that will be used by end-users to direct them to their organization in your application..", "type": "string", "examples": [ "my-organization" ], "pattern": "^(?:(?!org_))[a-z0-9]([a-z0-9-_]*[a-z0-9])?$" }, "id": { "description": "ID of the organization.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} }, "description": "Information about an Auth0 Organization.", "x-release-lifecycle": "EA", "x-auth0-owner": "authn-b2b-organizations" }, "connection": { "type": "object", "properties": { "id": { "description": "The ID of the connection.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} } } }, "required": [ "organization", "connection" ], "unevaluatedProperties": { "not": {} } }, "context": { "description": "Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.", "type": "object", "properties": { "client": { "type": "object", "properties": { "id": { "description": "The client identifier.", "type": "string", "examples": [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] }, "name": { "type": "string", "description": "The client name." }, "metadata": { "description": "Client metadata.", "type": "object", "properties": {}, "unevaluatedProperties": {} } }, "required": [ "id", "name", "metadata" ], "unevaluatedProperties": { "not": {} }, "description": "The OAuth Client requesting or presenting an access token.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "connection": { "type": "object", "properties": { "id": { "description": "The ID of the connection.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "name": { "description": "The name of the connection.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "strategy": { "type": "string", "description": "The auth strategy implemented by the connection." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "description": "The Auth0 Connection used for the authentication transaction that generated the event.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "request": { "type": "object", "properties": { "geo": { "description": "Geographic information about the request origin.", "type": "object", "properties": { "continent_code": { "type": "string", "description": "Continent code." }, "country_code": { "type": "string", "description": "Country code." }, "country_name": { "type": "string", "description": "Country name." }, "latitude": { "type": "number", "description": "Latitude coordinate." }, "longitude": { "type": "number", "description": "Longitude coordinate." }, "subdivision_code": { "type": "string", "description": "Subdivision (state/province) code." }, "subdivision_name": { "type": "string", "description": "Subdivision (state/province) name." }, "city_name": { "type": "string", "description": "City name." }, "time_zone": { "type": "string", "description": "Time zone." } }, "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "hostname": { "type": "string", "description": "The hostname the request is for." }, "custom_domain": { "type": "string", "description": "The custom domain used in the request (if any)." }, "ip": { "type": "string", "description": "The originating IP address of the request." }, "method": { "type": "string", "description": "The HTTP method used for the request." }, "user_agent": { "type": "string", "description": "The value of the `User-Agent` header." } }, "required": [ "geo", "hostname", "ip", "method", "user_agent" ], "unevaluatedProperties": { "not": {} }, "description": "An HTTP request.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "tenant": { "type": "object", "properties": { "id": { "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]", "description": "User-provided tenant identifier." } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a tenant in event context" }, "transaction": { "type": "object", "properties": { "acr_values": { "type": "array", "items": { "type": "string" }, "description": "acr_values in the request." }, "locale": { "type": "string", "description": "The locale used for this transaction." }, "login_hint": { "type": "string", "description": "Hint about the login identifier the user might use in this transaction." }, "prompt": { "type": "array", "items": { "type": "string" }, "description": "Instructions indicating whether the user may be prompted for re-authentication and consent." }, "protocol": { "description": "The protocol used for this transaction.", "type": "string", "enum": [ "oidc-basic-profile", "oidc-implicit-profile", "oauth2-device-code", "oauth2-resource-owner", "oauth2-resource-owner-jwt-bearer", "oauth2-password", "oauth2-webauthn", "oauth2-access-token", "oauth2-refresh-token", "oauth2-token-exchange", "oidc-hybrid-profile", "samlp", "wsfed", "wstrust-usernamemixed" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "redirect_uri": { "type": "string", "description": "The URL to which the client will be redirected when the transaction completes." }, "requested_scopes": { "type": "array", "items": { "type": "string" }, "description": "The scopes requested." }, "response_mode": { "description": "This transaction's method for returning parameters from the Authorization Endpoint.", "type": "string", "enum": [ "query", "fragment", "form_post", "web_message" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "response_type": { "type": "array", "items": { "type": "string", "enum": [ "code", "token", "id_token" ], "description": "OAuth/OIDC response types.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "description": "The kind of credential issued by this transaction." }, "state": { "type": "string", "description": "The OAuth state parameter for this transaction." }, "ui_locales": { "type": "array", "items": { "type": "string" }, "description": "The ui_locales requested for this transaction." } }, "required": [ "acr_values", "locale", "requested_scopes", "ui_locales" ], "unevaluatedProperties": { "not": {} }, "description": "An auth transaction.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "tenant" ], "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "object" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "platform-streaming-foundations" }, "a0tenant": { "description": "The auth0 tenant ID to which the event is associated.", "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]" }, "a0stream": { "description": "The auth0 event stream ID of the stream the event was delivered on.\nPresent when the event is delivered via an event stream; omitted when\nevents are retrieved via the Events API (GET /api/v2/events).", "type": "string", "examples": [ "est_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "est_[a-zA-Z0-9]{22}" } }, "required": [ "specversion", "type", "source", "id", "time", "data", "a0tenant" ], "unevaluatedProperties": { "not": {} }, "description": "Represents an event that occurs when a connection is removed from an organization.", "x-release-lifecycle": "EA", "x-auth0-owner": "authn-b2b-organizations", "x-auth0-event-category": "organization", "example": { "specversion": "1.0", "type": "organization.connection.removed", "source": "urn:auth0:example.auth0app.com", "id": "evt_vjFVP5pVdfvsfRKatshkVV", "time": "2025-02-01T12:34:56Z", "data": { "object": { "organization": { "name": "my-organization", "id": "org_1234567890abcdef" }, "connection": { "id": "con_kFOHQUeaCSC1Kjqz" } }, "previous_object": { "organization": { "name": "my-organization", "id": "org_1234567890abcdef" }, "connection": { "id": "con_kFOHQUeaCSC1Kjqz" } }, "context": { "client": { "id": "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc", "name": "sample", "metadata": {} }, "connection": { "id": "con_kFOHQUeaCSC1Kjqz", "name": "Username-Password-Authentication", "strategy": "sample" }, "request": { "geo": { "continent_code": "sample", "country_code": "sample", "country_name": "sample", "latitude": 3.14, "longitude": 3.14, "subdivision_code": "sample", "subdivision_name": "sample", "city_name": "sample", "time_zone": "sample" }, "hostname": "sample", "custom_domain": "sample", "ip": "sample", "method": "sample", "user_agent": "sample" }, "tenant": { "id": "my-tenant" }, "transaction": { "acr_values": [ "sample" ], "locale": "sample", "login_hint": "sample", "prompt": [ "sample" ], "protocol": "oidc-basic-profile", "redirect_uri": "sample", "requested_scopes": [ "sample" ], "response_mode": "query", "response_type": [ "code" ], "state": "sample", "ui_locales": [ "sample" ] } } }, "a0tenant": "my-tenant", "a0stream": "est_vjFVP5pVdfvsfRKatshkVV" } }, "organization.connection.updated": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "organization.connection.updated", "type": "object", "properties": { "specversion": { "description": "The version of the CloudEvents specification which the event uses.", "type": "string", "enum": [ "1.0" ], "x-auth0-owner": "platform-streaming-foundations" }, "type": { "type": "string", "const": "organization.connection.updated", "description": "The type of the event which has happened." }, "source": { "type": "string", "examples": [ "urn:auth0:example.auth0app.com" ], "description": "The source of the event. This will take the form 'urn:auth0:.'." }, "id": { "description": "A unique identifier for the event.", "type": "string", "examples": [ "evt_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "evt_[a-zA-Z0-9]{22}" }, "time": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "An ISO-8601 timestamp indicating when the event physically occurred." }, "data": { "description": "The event payload.", "type": "object", "properties": { "object": { "description": "The event content.", "type": "object", "properties": { "organization": { "type": "object", "properties": { "name": { "description": "The human-readable identifier for the organization that will be used by end-users to direct them to their organization in your application..", "type": "string", "examples": [ "my-organization" ], "pattern": "^(?:(?!org_))[a-z0-9]([a-z0-9-_]*[a-z0-9])?$" }, "id": { "description": "ID of the organization.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} }, "description": "Information about an Auth0 Organization.", "x-release-lifecycle": "EA", "x-auth0-owner": "authn-b2b-organizations" }, "connection": { "type": "object", "properties": { "id": { "description": "The ID of the connection.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} } }, "assign_membership_on_login": { "type": "boolean", "description": "When true, all users that log in with this connection will be automatically granted membership\nin the organization. When false, users must be granted membership in the organization before\nlogging in with this connection." }, "show_as_button": { "type": "boolean", "description": "Determines whether a connection should be displayed on this organization’s login prompt.\nOnly applicable for enterprise connections." }, "is_signup_enabled": { "type": "boolean", "description": "Determines whether organization signup should be enabled for this organization connection.\nOnly applicable for database connections." }, "is_enabled": { "type": "boolean", "description": "Determines whether the connection is enabled for the organization." }, "organization_access_level": { "description": "The access level granted to the connection for an organization.", "oneOf": [ { "type": "string", "const": "none" }, { "type": "string", "const": "readonly" }, { "type": "string", "const": "limited" }, { "type": "string", "const": "full" } ] }, "organization_member_access_level": { "description": "The organization member access level granted to the connection for an organization.", "oneOf": [ { "type": "string", "const": "none" }, { "type": "string", "const": "readonly" }, { "type": "string", "const": "limited" }, { "type": "string", "const": "full" } ] } }, "required": [ "organization", "connection" ], "unevaluatedProperties": { "not": {} } }, "previous_object": { "description": "The event content as it was prior to the change described by this event, when applicable.", "type": "object", "properties": { "organization": { "type": "object", "properties": { "name": { "description": "The human-readable identifier for the organization that will be used by end-users to direct them to their organization in your application..", "type": "string", "examples": [ "my-organization" ], "pattern": "^(?:(?!org_))[a-z0-9]([a-z0-9-_]*[a-z0-9])?$" }, "id": { "description": "ID of the organization.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} }, "description": "Information about an Auth0 Organization.", "x-release-lifecycle": "EA", "x-auth0-owner": "authn-b2b-organizations" }, "connection": { "type": "object", "properties": { "id": { "description": "The ID of the connection.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} } }, "assign_membership_on_login": { "type": "boolean", "description": "When true, all users that log in with this connection will be automatically granted membership\nin the organization. When false, users must be granted membership in the organization before\nlogging in with this connection." }, "show_as_button": { "type": "boolean", "description": "Determines whether a connection should be displayed on this organization’s login prompt.\nOnly applicable for enterprise connections." }, "is_signup_enabled": { "type": "boolean", "description": "Determines whether organization signup should be enabled for this organization connection.\nOnly applicable for database connections." }, "is_enabled": { "type": "boolean", "description": "Determines whether the connection is enabled for the organization." }, "organization_access_level": { "description": "The access level granted to the connection for an organization.", "oneOf": [ { "type": "string", "const": "none" }, { "type": "string", "const": "readonly" }, { "type": "string", "const": "limited" }, { "type": "string", "const": "full" } ] }, "organization_member_access_level": { "description": "The organization member access level granted to the connection for an organization.", "oneOf": [ { "type": "string", "const": "none" }, { "type": "string", "const": "readonly" }, { "type": "string", "const": "limited" }, { "type": "string", "const": "full" } ] } }, "required": [ "organization", "connection" ], "unevaluatedProperties": { "not": {} } }, "context": { "description": "Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.", "type": "object", "properties": { "client": { "type": "object", "properties": { "id": { "description": "The client identifier.", "type": "string", "examples": [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] }, "name": { "type": "string", "description": "The client name." }, "metadata": { "description": "Client metadata.", "type": "object", "properties": {}, "unevaluatedProperties": {} } }, "required": [ "id", "name", "metadata" ], "unevaluatedProperties": { "not": {} }, "description": "The OAuth Client requesting or presenting an access token.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "connection": { "type": "object", "properties": { "id": { "description": "The ID of the connection.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "name": { "description": "The name of the connection.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "strategy": { "type": "string", "description": "The auth strategy implemented by the connection." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "description": "The Auth0 Connection used for the authentication transaction that generated the event.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "request": { "type": "object", "properties": { "geo": { "description": "Geographic information about the request origin.", "type": "object", "properties": { "continent_code": { "type": "string", "description": "Continent code." }, "country_code": { "type": "string", "description": "Country code." }, "country_name": { "type": "string", "description": "Country name." }, "latitude": { "type": "number", "description": "Latitude coordinate." }, "longitude": { "type": "number", "description": "Longitude coordinate." }, "subdivision_code": { "type": "string", "description": "Subdivision (state/province) code." }, "subdivision_name": { "type": "string", "description": "Subdivision (state/province) name." }, "city_name": { "type": "string", "description": "City name." }, "time_zone": { "type": "string", "description": "Time zone." } }, "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "hostname": { "type": "string", "description": "The hostname the request is for." }, "custom_domain": { "type": "string", "description": "The custom domain used in the request (if any)." }, "ip": { "type": "string", "description": "The originating IP address of the request." }, "method": { "type": "string", "description": "The HTTP method used for the request." }, "user_agent": { "type": "string", "description": "The value of the `User-Agent` header." } }, "required": [ "geo", "hostname", "ip", "method", "user_agent" ], "unevaluatedProperties": { "not": {} }, "description": "An HTTP request.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "tenant": { "type": "object", "properties": { "id": { "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]", "description": "User-provided tenant identifier." } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a tenant in event context" }, "transaction": { "type": "object", "properties": { "acr_values": { "type": "array", "items": { "type": "string" }, "description": "acr_values in the request." }, "locale": { "type": "string", "description": "The locale used for this transaction." }, "login_hint": { "type": "string", "description": "Hint about the login identifier the user might use in this transaction." }, "prompt": { "type": "array", "items": { "type": "string" }, "description": "Instructions indicating whether the user may be prompted for re-authentication and consent." }, "protocol": { "description": "The protocol used for this transaction.", "type": "string", "enum": [ "oidc-basic-profile", "oidc-implicit-profile", "oauth2-device-code", "oauth2-resource-owner", "oauth2-resource-owner-jwt-bearer", "oauth2-password", "oauth2-webauthn", "oauth2-access-token", "oauth2-refresh-token", "oauth2-token-exchange", "oidc-hybrid-profile", "samlp", "wsfed", "wstrust-usernamemixed" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "redirect_uri": { "type": "string", "description": "The URL to which the client will be redirected when the transaction completes." }, "requested_scopes": { "type": "array", "items": { "type": "string" }, "description": "The scopes requested." }, "response_mode": { "description": "This transaction's method for returning parameters from the Authorization Endpoint.", "type": "string", "enum": [ "query", "fragment", "form_post", "web_message" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "response_type": { "type": "array", "items": { "type": "string", "enum": [ "code", "token", "id_token" ], "description": "OAuth/OIDC response types.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "description": "The kind of credential issued by this transaction." }, "state": { "type": "string", "description": "The OAuth state parameter for this transaction." }, "ui_locales": { "type": "array", "items": { "type": "string" }, "description": "The ui_locales requested for this transaction." } }, "required": [ "acr_values", "locale", "requested_scopes", "ui_locales" ], "unevaluatedProperties": { "not": {} }, "description": "An auth transaction.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "tenant" ], "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "object" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "platform-streaming-foundations" }, "a0tenant": { "description": "The auth0 tenant ID to which the event is associated.", "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]" }, "a0stream": { "description": "The auth0 event stream ID of the stream the event was delivered on.\nPresent when the event is delivered via an event stream; omitted when\nevents are retrieved via the Events API (GET /api/v2/events).", "type": "string", "examples": [ "est_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "est_[a-zA-Z0-9]{22}" } }, "required": [ "specversion", "type", "source", "id", "time", "data", "a0tenant" ], "unevaluatedProperties": { "not": {} }, "description": "Represents an event that occurs when a organization connection is updated.", "x-release-lifecycle": "EA", "x-auth0-owner": "authn-b2b-organizations", "x-auth0-event-category": "organization", "example": { "specversion": "1.0", "type": "organization.connection.updated", "source": "urn:auth0:example.auth0app.com", "id": "evt_vjFVP5pVdfvsfRKatshkVV", "time": "2025-02-01T12:34:56Z", "data": { "object": { "organization": { "name": "my-organization", "id": "org_1234567890abcdef" }, "connection": { "id": "con_kFOHQUeaCSC1Kjqz" }, "assign_membership_on_login": false, "show_as_button": false, "is_signup_enabled": false, "is_enabled": false, "organization_access_level": "none", "organization_member_access_level": "none" }, "previous_object": { "organization": { "name": "my-organization", "id": "org_1234567890abcdef" }, "connection": { "id": "con_kFOHQUeaCSC1Kjqz" }, "assign_membership_on_login": false, "show_as_button": false, "is_signup_enabled": false, "is_enabled": false, "organization_access_level": "none", "organization_member_access_level": "none" }, "context": { "client": { "id": "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc", "name": "sample", "metadata": {} }, "connection": { "id": "con_kFOHQUeaCSC1Kjqz", "name": "Username-Password-Authentication", "strategy": "sample" }, "request": { "geo": { "continent_code": "sample", "country_code": "sample", "country_name": "sample", "latitude": 3.14, "longitude": 3.14, "subdivision_code": "sample", "subdivision_name": "sample", "city_name": "sample", "time_zone": "sample" }, "hostname": "sample", "custom_domain": "sample", "ip": "sample", "method": "sample", "user_agent": "sample" }, "tenant": { "id": "my-tenant" }, "transaction": { "acr_values": [ "sample" ], "locale": "sample", "login_hint": "sample", "prompt": [ "sample" ], "protocol": "oidc-basic-profile", "redirect_uri": "sample", "requested_scopes": [ "sample" ], "response_mode": "query", "response_type": [ "code" ], "state": "sample", "ui_locales": [ "sample" ] } } }, "a0tenant": "my-tenant", "a0stream": "est_vjFVP5pVdfvsfRKatshkVV" } }, "organization.created": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "organization.created", "type": "object", "properties": { "specversion": { "description": "The version of the CloudEvents specification which the event uses.", "type": "string", "enum": [ "1.0" ], "x-auth0-owner": "platform-streaming-foundations" }, "type": { "type": "string", "const": "organization.created", "description": "The type of the event which has happened." }, "source": { "type": "string", "examples": [ "urn:auth0:example.auth0app.com" ], "description": "The source of the event. This will take the form 'urn:auth0:.'." }, "id": { "description": "A unique identifier for the event.", "type": "string", "examples": [ "evt_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "evt_[a-zA-Z0-9]{22}" }, "time": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "An ISO-8601 timestamp indicating when the event physically occurred." }, "data": { "description": "The event payload.", "type": "object", "properties": { "object": { "description": "The event content.", "type": "object", "properties": { "name": { "description": "The human-readable identifier for the organization that will be used by end-users to direct them to their organization in your application..", "type": "string", "examples": [ "my-organization" ], "pattern": "^(?:(?!org_))[a-z0-9]([a-z0-9-_]*[a-z0-9])?$" }, "id": { "description": "ID of the organization.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" }, "display_name": { "type": "string", "examples": [ "My Organization" ], "description": "If set, the name that will be displayed to end-users for this organization in any interaction with them." }, "metadata": { "description": "The metadata associated with the organization.", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "branding": { "description": "The branding associated with the organization.", "type": "object", "properties": { "logo_url": { "type": "string", "format": "uri", "description": "URL of logo to display on login page." }, "colors": { "description": "Color scheme used to customize the login pages.", "type": "object", "properties": { "primary": { "type": "string", "examples": [ "#0059d6" ], "description": "HEX Color for primary elements." }, "page_background": { "type": "string", "examples": [ "#000000" ], "description": "HEX Color for background." } }, "unevaluatedProperties": { "not": {} } } }, "unevaluatedProperties": { "not": {} } } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} } }, "previous_object": { "description": "The event content as it was prior to the change described by this event, when applicable.", "type": "object", "properties": { "name": { "description": "The human-readable identifier for the organization that will be used by end-users to direct them to their organization in your application..", "type": "string", "examples": [ "my-organization" ], "pattern": "^(?:(?!org_))[a-z0-9]([a-z0-9-_]*[a-z0-9])?$" }, "id": { "description": "ID of the organization.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" }, "display_name": { "type": "string", "examples": [ "My Organization" ], "description": "If set, the name that will be displayed to end-users for this organization in any interaction with them." }, "metadata": { "description": "The metadata associated with the organization.", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "branding": { "description": "The branding associated with the organization.", "type": "object", "properties": { "logo_url": { "type": "string", "format": "uri", "description": "URL of logo to display on login page." }, "colors": { "description": "Color scheme used to customize the login pages.", "type": "object", "properties": { "primary": { "type": "string", "examples": [ "#0059d6" ], "description": "HEX Color for primary elements." }, "page_background": { "type": "string", "examples": [ "#000000" ], "description": "HEX Color for background." } }, "unevaluatedProperties": { "not": {} } } }, "unevaluatedProperties": { "not": {} } } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} } }, "context": { "description": "Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.", "type": "object", "properties": { "client": { "type": "object", "properties": { "id": { "description": "The client identifier.", "type": "string", "examples": [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] }, "name": { "type": "string", "description": "The client name." }, "metadata": { "description": "Client metadata.", "type": "object", "properties": {}, "unevaluatedProperties": {} } }, "required": [ "id", "name", "metadata" ], "unevaluatedProperties": { "not": {} }, "description": "The OAuth Client requesting or presenting an access token.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "connection": { "type": "object", "properties": { "id": { "description": "The ID of the connection.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "name": { "description": "The name of the connection.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "strategy": { "type": "string", "description": "The auth strategy implemented by the connection." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "description": "The Auth0 Connection used for the authentication transaction that generated the event.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "request": { "type": "object", "properties": { "geo": { "description": "Geographic information about the request origin.", "type": "object", "properties": { "continent_code": { "type": "string", "description": "Continent code." }, "country_code": { "type": "string", "description": "Country code." }, "country_name": { "type": "string", "description": "Country name." }, "latitude": { "type": "number", "description": "Latitude coordinate." }, "longitude": { "type": "number", "description": "Longitude coordinate." }, "subdivision_code": { "type": "string", "description": "Subdivision (state/province) code." }, "subdivision_name": { "type": "string", "description": "Subdivision (state/province) name." }, "city_name": { "type": "string", "description": "City name." }, "time_zone": { "type": "string", "description": "Time zone." } }, "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "hostname": { "type": "string", "description": "The hostname the request is for." }, "custom_domain": { "type": "string", "description": "The custom domain used in the request (if any)." }, "ip": { "type": "string", "description": "The originating IP address of the request." }, "method": { "type": "string", "description": "The HTTP method used for the request." }, "user_agent": { "type": "string", "description": "The value of the `User-Agent` header." } }, "required": [ "geo", "hostname", "ip", "method", "user_agent" ], "unevaluatedProperties": { "not": {} }, "description": "An HTTP request.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "tenant": { "type": "object", "properties": { "id": { "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]", "description": "User-provided tenant identifier." } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a tenant in event context" }, "transaction": { "type": "object", "properties": { "acr_values": { "type": "array", "items": { "type": "string" }, "description": "acr_values in the request." }, "locale": { "type": "string", "description": "The locale used for this transaction." }, "login_hint": { "type": "string", "description": "Hint about the login identifier the user might use in this transaction." }, "prompt": { "type": "array", "items": { "type": "string" }, "description": "Instructions indicating whether the user may be prompted for re-authentication and consent." }, "protocol": { "description": "The protocol used for this transaction.", "type": "string", "enum": [ "oidc-basic-profile", "oidc-implicit-profile", "oauth2-device-code", "oauth2-resource-owner", "oauth2-resource-owner-jwt-bearer", "oauth2-password", "oauth2-webauthn", "oauth2-access-token", "oauth2-refresh-token", "oauth2-token-exchange", "oidc-hybrid-profile", "samlp", "wsfed", "wstrust-usernamemixed" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "redirect_uri": { "type": "string", "description": "The URL to which the client will be redirected when the transaction completes." }, "requested_scopes": { "type": "array", "items": { "type": "string" }, "description": "The scopes requested." }, "response_mode": { "description": "This transaction's method for returning parameters from the Authorization Endpoint.", "type": "string", "enum": [ "query", "fragment", "form_post", "web_message" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "response_type": { "type": "array", "items": { "type": "string", "enum": [ "code", "token", "id_token" ], "description": "OAuth/OIDC response types.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "description": "The kind of credential issued by this transaction." }, "state": { "type": "string", "description": "The OAuth state parameter for this transaction." }, "ui_locales": { "type": "array", "items": { "type": "string" }, "description": "The ui_locales requested for this transaction." } }, "required": [ "acr_values", "locale", "requested_scopes", "ui_locales" ], "unevaluatedProperties": { "not": {} }, "description": "An auth transaction.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "tenant" ], "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "object" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "platform-streaming-foundations" }, "a0tenant": { "description": "The auth0 tenant ID to which the event is associated.", "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]" }, "a0stream": { "description": "The auth0 event stream ID of the stream the event was delivered on.\nPresent when the event is delivered via an event stream; omitted when\nevents are retrieved via the Events API (GET /api/v2/events).", "type": "string", "examples": [ "est_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "est_[a-zA-Z0-9]{22}" } }, "required": [ "specversion", "type", "source", "id", "time", "data", "a0tenant" ], "unevaluatedProperties": { "not": {} }, "description": "Represents an event that occurs when an organization is created.", "x-release-lifecycle": "GA", "x-auth0-owner": "authn-b2b-organizations", "x-auth0-event-category": "organization", "example": { "specversion": "1.0", "type": "organization.created", "source": "urn:auth0:example.auth0app.com", "id": "evt_vjFVP5pVdfvsfRKatshkVV", "time": "2025-02-01T12:34:56Z", "data": { "object": { "name": "my-organization", "id": "org_1234567890abcdef", "display_name": "My Organization", "metadata": {}, "branding": { "logo_url": "https://example.com", "colors": { "primary": "#0059d6", "page_background": "#000000" } } }, "previous_object": { "name": "my-organization", "id": "org_1234567890abcdef", "display_name": "My Organization", "metadata": {}, "branding": { "logo_url": "https://example.com", "colors": { "primary": "#0059d6", "page_background": "#000000" } } }, "context": { "client": { "id": "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc", "name": "sample", "metadata": {} }, "connection": { "id": "con_kFOHQUeaCSC1Kjqz", "name": "Username-Password-Authentication", "strategy": "sample" }, "request": { "geo": { "continent_code": "sample", "country_code": "sample", "country_name": "sample", "latitude": 3.14, "longitude": 3.14, "subdivision_code": "sample", "subdivision_name": "sample", "city_name": "sample", "time_zone": "sample" }, "hostname": "sample", "custom_domain": "sample", "ip": "sample", "method": "sample", "user_agent": "sample" }, "tenant": { "id": "my-tenant" }, "transaction": { "acr_values": [ "sample" ], "locale": "sample", "login_hint": "sample", "prompt": [ "sample" ], "protocol": "oidc-basic-profile", "redirect_uri": "sample", "requested_scopes": [ "sample" ], "response_mode": "query", "response_type": [ "code" ], "state": "sample", "ui_locales": [ "sample" ] } } }, "a0tenant": "my-tenant", "a0stream": "est_vjFVP5pVdfvsfRKatshkVV" } }, "organization.deleted": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "organization.deleted", "type": "object", "properties": { "specversion": { "description": "The version of the CloudEvents specification which the event uses.", "type": "string", "enum": [ "1.0" ], "x-auth0-owner": "platform-streaming-foundations" }, "type": { "type": "string", "const": "organization.deleted", "description": "The type of the event which has happened." }, "source": { "type": "string", "examples": [ "urn:auth0:example.auth0app.com" ], "description": "The source of the event. This will take the form 'urn:auth0:.'." }, "id": { "description": "A unique identifier for the event.", "type": "string", "examples": [ "evt_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "evt_[a-zA-Z0-9]{22}" }, "time": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "An ISO-8601 timestamp indicating when the event physically occurred." }, "data": { "description": "The event payload.", "type": "object", "properties": { "object": { "description": "The event content.", "type": "object", "properties": { "name": { "description": "The human-readable identifier for the organization that will be used by end-users to direct them to their organization in your application..", "type": "string", "examples": [ "my-organization" ], "pattern": "^(?:(?!org_))[a-z0-9]([a-z0-9-_]*[a-z0-9])?$" }, "id": { "description": "ID of the organization.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" }, "display_name": { "type": "string", "examples": [ "My Organization" ], "description": "If set, the name that will be displayed to end-users for this organization in any interaction with them." }, "metadata": { "description": "The metadata associated with the organization.", "type": "object", "properties": {}, "unevaluatedProperties": {} } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} } }, "previous_object": { "description": "The event content as it was prior to the change described by this event, when applicable.", "type": "object", "properties": { "name": { "description": "The human-readable identifier for the organization that will be used by end-users to direct them to their organization in your application..", "type": "string", "examples": [ "my-organization" ], "pattern": "^(?:(?!org_))[a-z0-9]([a-z0-9-_]*[a-z0-9])?$" }, "id": { "description": "ID of the organization.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" }, "display_name": { "type": "string", "examples": [ "My Organization" ], "description": "If set, the name that will be displayed to end-users for this organization in any interaction with them." }, "metadata": { "description": "The metadata associated with the organization.", "type": "object", "properties": {}, "unevaluatedProperties": {} } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} } }, "context": { "description": "Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.", "type": "object", "properties": { "client": { "type": "object", "properties": { "id": { "description": "The client identifier.", "type": "string", "examples": [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] }, "name": { "type": "string", "description": "The client name." }, "metadata": { "description": "Client metadata.", "type": "object", "properties": {}, "unevaluatedProperties": {} } }, "required": [ "id", "name", "metadata" ], "unevaluatedProperties": { "not": {} }, "description": "The OAuth Client requesting or presenting an access token.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "connection": { "type": "object", "properties": { "id": { "description": "The ID of the connection.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "name": { "description": "The name of the connection.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "strategy": { "type": "string", "description": "The auth strategy implemented by the connection." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "description": "The Auth0 Connection used for the authentication transaction that generated the event.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "request": { "type": "object", "properties": { "geo": { "description": "Geographic information about the request origin.", "type": "object", "properties": { "continent_code": { "type": "string", "description": "Continent code." }, "country_code": { "type": "string", "description": "Country code." }, "country_name": { "type": "string", "description": "Country name." }, "latitude": { "type": "number", "description": "Latitude coordinate." }, "longitude": { "type": "number", "description": "Longitude coordinate." }, "subdivision_code": { "type": "string", "description": "Subdivision (state/province) code." }, "subdivision_name": { "type": "string", "description": "Subdivision (state/province) name." }, "city_name": { "type": "string", "description": "City name." }, "time_zone": { "type": "string", "description": "Time zone." } }, "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "hostname": { "type": "string", "description": "The hostname the request is for." }, "custom_domain": { "type": "string", "description": "The custom domain used in the request (if any)." }, "ip": { "type": "string", "description": "The originating IP address of the request." }, "method": { "type": "string", "description": "The HTTP method used for the request." }, "user_agent": { "type": "string", "description": "The value of the `User-Agent` header." } }, "required": [ "geo", "hostname", "ip", "method", "user_agent" ], "unevaluatedProperties": { "not": {} }, "description": "An HTTP request.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "tenant": { "type": "object", "properties": { "id": { "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]", "description": "User-provided tenant identifier." } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a tenant in event context" }, "transaction": { "type": "object", "properties": { "acr_values": { "type": "array", "items": { "type": "string" }, "description": "acr_values in the request." }, "locale": { "type": "string", "description": "The locale used for this transaction." }, "login_hint": { "type": "string", "description": "Hint about the login identifier the user might use in this transaction." }, "prompt": { "type": "array", "items": { "type": "string" }, "description": "Instructions indicating whether the user may be prompted for re-authentication and consent." }, "protocol": { "description": "The protocol used for this transaction.", "type": "string", "enum": [ "oidc-basic-profile", "oidc-implicit-profile", "oauth2-device-code", "oauth2-resource-owner", "oauth2-resource-owner-jwt-bearer", "oauth2-password", "oauth2-webauthn", "oauth2-access-token", "oauth2-refresh-token", "oauth2-token-exchange", "oidc-hybrid-profile", "samlp", "wsfed", "wstrust-usernamemixed" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "redirect_uri": { "type": "string", "description": "The URL to which the client will be redirected when the transaction completes." }, "requested_scopes": { "type": "array", "items": { "type": "string" }, "description": "The scopes requested." }, "response_mode": { "description": "This transaction's method for returning parameters from the Authorization Endpoint.", "type": "string", "enum": [ "query", "fragment", "form_post", "web_message" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "response_type": { "type": "array", "items": { "type": "string", "enum": [ "code", "token", "id_token" ], "description": "OAuth/OIDC response types.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "description": "The kind of credential issued by this transaction." }, "state": { "type": "string", "description": "The OAuth state parameter for this transaction." }, "ui_locales": { "type": "array", "items": { "type": "string" }, "description": "The ui_locales requested for this transaction." } }, "required": [ "acr_values", "locale", "requested_scopes", "ui_locales" ], "unevaluatedProperties": { "not": {} }, "description": "An auth transaction.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "tenant" ], "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "object" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "platform-streaming-foundations" }, "a0tenant": { "description": "The auth0 tenant ID to which the event is associated.", "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]" }, "a0stream": { "description": "The auth0 event stream ID of the stream the event was delivered on.\nPresent when the event is delivered via an event stream; omitted when\nevents are retrieved via the Events API (GET /api/v2/events).", "type": "string", "examples": [ "est_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "est_[a-zA-Z0-9]{22}" } }, "required": [ "specversion", "type", "source", "id", "time", "data", "a0tenant" ], "unevaluatedProperties": { "not": {} }, "description": "Represents an event that occurs when an organization is deleted.", "x-release-lifecycle": "GA", "x-auth0-owner": "authn-b2b-organizations", "x-auth0-event-category": "organization", "example": { "specversion": "1.0", "type": "organization.deleted", "source": "urn:auth0:example.auth0app.com", "id": "evt_vjFVP5pVdfvsfRKatshkVV", "time": "2025-02-01T12:34:56Z", "data": { "object": { "name": "my-organization", "id": "org_1234567890abcdef", "display_name": "My Organization", "metadata": {} }, "previous_object": { "name": "my-organization", "id": "org_1234567890abcdef", "display_name": "My Organization", "metadata": {} }, "context": { "client": { "id": "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc", "name": "sample", "metadata": {} }, "connection": { "id": "con_kFOHQUeaCSC1Kjqz", "name": "Username-Password-Authentication", "strategy": "sample" }, "request": { "geo": { "continent_code": "sample", "country_code": "sample", "country_name": "sample", "latitude": 3.14, "longitude": 3.14, "subdivision_code": "sample", "subdivision_name": "sample", "city_name": "sample", "time_zone": "sample" }, "hostname": "sample", "custom_domain": "sample", "ip": "sample", "method": "sample", "user_agent": "sample" }, "tenant": { "id": "my-tenant" }, "transaction": { "acr_values": [ "sample" ], "locale": "sample", "login_hint": "sample", "prompt": [ "sample" ], "protocol": "oidc-basic-profile", "redirect_uri": "sample", "requested_scopes": [ "sample" ], "response_mode": "query", "response_type": [ "code" ], "state": "sample", "ui_locales": [ "sample" ] } } }, "a0tenant": "my-tenant", "a0stream": "est_vjFVP5pVdfvsfRKatshkVV" } }, "organization.group.role.assigned": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "organization.group.role.assigned", "type": "object", "properties": { "specversion": { "description": "The version of the CloudEvents specification which the event uses.", "type": "string", "enum": [ "1.0" ], "x-auth0-owner": "platform-streaming-foundations" }, "type": { "type": "string", "const": "organization.group.role.assigned", "description": "The type of the event which has happened." }, "source": { "type": "string", "examples": [ "urn:auth0:example.auth0app.com" ], "description": "The source of the event. This will take the form 'urn:auth0:.'." }, "id": { "description": "A unique identifier for the event.", "type": "string", "examples": [ "evt_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "evt_[a-zA-Z0-9]{22}" }, "time": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "An ISO-8601 timestamp indicating when the event physically occurred." }, "data": { "description": "The event payload.", "type": "object", "properties": { "object": { "description": "The event content.", "type": "object", "properties": { "organization": { "description": "The organization the group role is assigned in.", "type": "object", "properties": { "id": { "description": "ID of the organization.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} } }, "role": { "description": "The role assigned to the group in the organization.", "type": "object", "properties": { "id": { "description": "The ID of the role.", "type": "string", "examples": [ "rol_1234567890abcdef" ], "pattern": "rol_[a-zA-Z0-9]{16}" }, "name": { "type": "string", "examples": [ "role-name" ], "description": "The name of the role." } }, "required": [ "id", "name" ], "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "group": { "description": "The group the role is assigned to.", "oneOf": [ { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "type": { "type": "string", "const": "connection", "description": "The type of the group." }, "connection_id": { "description": "The connection ID associated with the group.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" } }, "required": [ "id", "type", "connection_id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a connection group" }, { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "type": { "type": "string", "const": "organization", "description": "The type of the group." }, "organization_id": { "description": "The organization ID associated with the group.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" } }, "required": [ "id", "type", "organization_id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to an organization group" }, { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "type": { "type": "string", "const": "tenant", "description": "The type of the group." } }, "required": [ "id", "type" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a tenant group" } ] }, "created_at": { "type": "string", "format": "date-time", "description": "The time at which the role was assigned to the group in the organization." } }, "required": [ "organization", "role", "group", "created_at" ], "unevaluatedProperties": { "not": {} } }, "previous_object": { "description": "The event content as it was prior to the change described by this event, when applicable.", "type": "object", "properties": { "organization": { "description": "The organization the group role is assigned in.", "type": "object", "properties": { "id": { "description": "ID of the organization.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} } }, "role": { "description": "The role assigned to the group in the organization.", "type": "object", "properties": { "id": { "description": "The ID of the role.", "type": "string", "examples": [ "rol_1234567890abcdef" ], "pattern": "rol_[a-zA-Z0-9]{16}" }, "name": { "type": "string", "examples": [ "role-name" ], "description": "The name of the role." } }, "required": [ "id", "name" ], "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "group": { "description": "The group the role is assigned to.", "oneOf": [ { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "type": { "type": "string", "const": "connection", "description": "The type of the group." }, "connection_id": { "description": "The connection ID associated with the group.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" } }, "required": [ "id", "type", "connection_id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a connection group" }, { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "type": { "type": "string", "const": "organization", "description": "The type of the group." }, "organization_id": { "description": "The organization ID associated with the group.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" } }, "required": [ "id", "type", "organization_id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to an organization group" }, { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "type": { "type": "string", "const": "tenant", "description": "The type of the group." } }, "required": [ "id", "type" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a tenant group" } ] }, "created_at": { "type": "string", "format": "date-time", "description": "The time at which the role was assigned to the group in the organization." } }, "required": [ "organization", "role", "group", "created_at" ], "unevaluatedProperties": { "not": {} } }, "context": { "description": "Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.", "type": "object", "properties": { "client": { "type": "object", "properties": { "id": { "description": "The client identifier.", "type": "string", "examples": [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] }, "name": { "type": "string", "description": "The client name." }, "metadata": { "description": "Client metadata.", "type": "object", "properties": {}, "unevaluatedProperties": {} } }, "required": [ "id", "name", "metadata" ], "unevaluatedProperties": { "not": {} }, "description": "The OAuth Client requesting or presenting an access token.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "connection": { "type": "object", "properties": { "id": { "description": "The ID of the connection.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "name": { "description": "The name of the connection.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "strategy": { "type": "string", "description": "The auth strategy implemented by the connection." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "description": "The Auth0 Connection used for the authentication transaction that generated the event.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "request": { "type": "object", "properties": { "geo": { "description": "Geographic information about the request origin.", "type": "object", "properties": { "continent_code": { "type": "string", "description": "Continent code." }, "country_code": { "type": "string", "description": "Country code." }, "country_name": { "type": "string", "description": "Country name." }, "latitude": { "type": "number", "description": "Latitude coordinate." }, "longitude": { "type": "number", "description": "Longitude coordinate." }, "subdivision_code": { "type": "string", "description": "Subdivision (state/province) code." }, "subdivision_name": { "type": "string", "description": "Subdivision (state/province) name." }, "city_name": { "type": "string", "description": "City name." }, "time_zone": { "type": "string", "description": "Time zone." } }, "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "hostname": { "type": "string", "description": "The hostname the request is for." }, "custom_domain": { "type": "string", "description": "The custom domain used in the request (if any)." }, "ip": { "type": "string", "description": "The originating IP address of the request." }, "method": { "type": "string", "description": "The HTTP method used for the request." }, "user_agent": { "type": "string", "description": "The value of the `User-Agent` header." } }, "required": [ "geo", "hostname", "ip", "method", "user_agent" ], "unevaluatedProperties": { "not": {} }, "description": "An HTTP request.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "tenant": { "type": "object", "properties": { "id": { "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]", "description": "User-provided tenant identifier." } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a tenant in event context" }, "transaction": { "type": "object", "properties": { "acr_values": { "type": "array", "items": { "type": "string" }, "description": "acr_values in the request." }, "locale": { "type": "string", "description": "The locale used for this transaction." }, "login_hint": { "type": "string", "description": "Hint about the login identifier the user might use in this transaction." }, "prompt": { "type": "array", "items": { "type": "string" }, "description": "Instructions indicating whether the user may be prompted for re-authentication and consent." }, "protocol": { "description": "The protocol used for this transaction.", "type": "string", "enum": [ "oidc-basic-profile", "oidc-implicit-profile", "oauth2-device-code", "oauth2-resource-owner", "oauth2-resource-owner-jwt-bearer", "oauth2-password", "oauth2-webauthn", "oauth2-access-token", "oauth2-refresh-token", "oauth2-token-exchange", "oidc-hybrid-profile", "samlp", "wsfed", "wstrust-usernamemixed" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "redirect_uri": { "type": "string", "description": "The URL to which the client will be redirected when the transaction completes." }, "requested_scopes": { "type": "array", "items": { "type": "string" }, "description": "The scopes requested." }, "response_mode": { "description": "This transaction's method for returning parameters from the Authorization Endpoint.", "type": "string", "enum": [ "query", "fragment", "form_post", "web_message" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "response_type": { "type": "array", "items": { "type": "string", "enum": [ "code", "token", "id_token" ], "description": "OAuth/OIDC response types.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "description": "The kind of credential issued by this transaction." }, "state": { "type": "string", "description": "The OAuth state parameter for this transaction." }, "ui_locales": { "type": "array", "items": { "type": "string" }, "description": "The ui_locales requested for this transaction." } }, "required": [ "acr_values", "locale", "requested_scopes", "ui_locales" ], "unevaluatedProperties": { "not": {} }, "description": "An auth transaction.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "tenant" ], "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "object" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "platform-streaming-foundations" }, "a0tenant": { "description": "The auth0 tenant ID to which the event is associated.", "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]" }, "a0stream": { "description": "The auth0 event stream ID of the stream the event was delivered on.\nPresent when the event is delivered via an event stream; omitted when\nevents are retrieved via the Events API (GET /api/v2/events).", "type": "string", "examples": [ "est_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "est_[a-zA-Z0-9]{22}" } }, "required": [ "specversion", "type", "source", "id", "time", "data", "a0tenant" ], "unevaluatedProperties": { "not": {} }, "description": "Represents an event that occurs when a role is assigned to an organization group.", "x-release-lifecycle": "GA", "x-auth0-owner": "authn-b2b-acceleration", "x-auth0-event-category": "organization", "example": { "specversion": "1.0", "type": "organization.group.role.assigned", "source": "urn:auth0:example.auth0app.com", "id": "evt_vjFVP5pVdfvsfRKatshkVV", "time": "2025-02-01T12:34:56Z", "data": { "object": { "organization": { "id": "org_1234567890abcdef" }, "role": { "id": "rol_1234567890abcdef", "name": "role-name" }, "group": { "id": "grp_01949dad80fc7d56", "external_id": "my-external-id", "type": "connection", "connection_id": "con_kFOHQUeaCSC1Kjqz" }, "created_at": "2023-04-01T13:45:30Z" }, "previous_object": { "organization": { "id": "org_1234567890abcdef" }, "role": { "id": "rol_1234567890abcdef", "name": "role-name" }, "group": { "id": "grp_01949dad80fc7d56", "external_id": "my-external-id", "type": "connection", "connection_id": "con_kFOHQUeaCSC1Kjqz" }, "created_at": "2023-04-01T13:45:30Z" }, "context": { "client": { "id": "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc", "name": "sample", "metadata": {} }, "connection": { "id": "con_kFOHQUeaCSC1Kjqz", "name": "Username-Password-Authentication", "strategy": "sample" }, "request": { "geo": { "continent_code": "sample", "country_code": "sample", "country_name": "sample", "latitude": 3.14, "longitude": 3.14, "subdivision_code": "sample", "subdivision_name": "sample", "city_name": "sample", "time_zone": "sample" }, "hostname": "sample", "custom_domain": "sample", "ip": "sample", "method": "sample", "user_agent": "sample" }, "tenant": { "id": "my-tenant" }, "transaction": { "acr_values": [ "sample" ], "locale": "sample", "login_hint": "sample", "prompt": [ "sample" ], "protocol": "oidc-basic-profile", "redirect_uri": "sample", "requested_scopes": [ "sample" ], "response_mode": "query", "response_type": [ "code" ], "state": "sample", "ui_locales": [ "sample" ] } } }, "a0tenant": "my-tenant", "a0stream": "est_vjFVP5pVdfvsfRKatshkVV" } }, "organization.group.role.deleted": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "organization.group.role.deleted", "type": "object", "properties": { "specversion": { "description": "The version of the CloudEvents specification which the event uses.", "type": "string", "enum": [ "1.0" ], "x-auth0-owner": "platform-streaming-foundations" }, "type": { "type": "string", "const": "organization.group.role.deleted", "description": "The type of the event which has happened." }, "source": { "type": "string", "examples": [ "urn:auth0:example.auth0app.com" ], "description": "The source of the event. This will take the form 'urn:auth0:.'." }, "id": { "description": "A unique identifier for the event.", "type": "string", "examples": [ "evt_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "evt_[a-zA-Z0-9]{22}" }, "time": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "An ISO-8601 timestamp indicating when the event physically occurred." }, "data": { "description": "The event payload.", "type": "object", "properties": { "object": { "description": "The event content.", "type": "object", "properties": { "organization": { "description": "The organization the group role is removed from.", "type": "object", "properties": { "id": { "description": "ID of the organization.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} } }, "role": { "description": "The role removed from the group.", "type": "object", "properties": { "id": { "description": "The ID of the role.", "type": "string", "examples": [ "rol_1234567890abcdef" ], "pattern": "rol_[a-zA-Z0-9]{16}" } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} } }, "group": { "description": "The group the role is removed from.", "oneOf": [ { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "type": { "type": "string", "const": "connection", "description": "The type of the group." }, "connection_id": { "description": "The connection ID associated with the group.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" } }, "required": [ "id", "type", "connection_id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a connection group" }, { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "type": { "type": "string", "const": "organization", "description": "The type of the group." }, "organization_id": { "description": "The organization ID associated with the group.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" } }, "required": [ "id", "type", "organization_id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to an organization group" }, { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "type": { "type": "string", "const": "tenant", "description": "The type of the group." } }, "required": [ "id", "type" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a tenant group" } ] }, "deleted_at": { "type": "string", "format": "date-time", "description": "The time at which the role was removed from the group in the organization." } }, "required": [ "organization", "role", "group", "deleted_at" ], "unevaluatedProperties": { "not": {} } }, "previous_object": { "description": "The event content as it was prior to the change described by this event, when applicable.", "type": "object", "properties": { "organization": { "description": "The organization the group role is assigned in.", "type": "object", "properties": { "id": { "description": "ID of the organization.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} } }, "role": { "description": "The role assigned to the group in the organization.", "type": "object", "properties": { "id": { "description": "The ID of the role.", "type": "string", "examples": [ "rol_1234567890abcdef" ], "pattern": "rol_[a-zA-Z0-9]{16}" }, "name": { "type": "string", "examples": [ "role-name" ], "description": "The name of the role." } }, "required": [ "id", "name" ], "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "group": { "description": "The group the role is assigned to.", "oneOf": [ { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "type": { "type": "string", "const": "connection", "description": "The type of the group." }, "connection_id": { "description": "The connection ID associated with the group.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" } }, "required": [ "id", "type", "connection_id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a connection group" }, { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "type": { "type": "string", "const": "organization", "description": "The type of the group." }, "organization_id": { "description": "The organization ID associated with the group.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" } }, "required": [ "id", "type", "organization_id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to an organization group" }, { "type": "object", "properties": { "id": { "description": "The unique identifier for the group.", "type": "string", "examples": [ "grp_01949dad80fc7d56" ], "pattern": "grp_[1-9a-km-zA-HJ-NP-Z]{14,22}" }, "external_id": { "type": "string", "examples": [ "my-external-id" ], "description": "The external identifier for the group." }, "type": { "type": "string", "const": "tenant", "description": "The type of the group." } }, "required": [ "id", "type" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a tenant group" } ] }, "created_at": { "type": "string", "format": "date-time", "description": "The time at which the role was assigned to the group in the organization." } }, "required": [ "organization", "role", "group", "created_at" ], "unevaluatedProperties": { "not": {} } }, "context": { "description": "Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.", "type": "object", "properties": { "client": { "type": "object", "properties": { "id": { "description": "The client identifier.", "type": "string", "examples": [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] }, "name": { "type": "string", "description": "The client name." }, "metadata": { "description": "Client metadata.", "type": "object", "properties": {}, "unevaluatedProperties": {} } }, "required": [ "id", "name", "metadata" ], "unevaluatedProperties": { "not": {} }, "description": "The OAuth Client requesting or presenting an access token.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "connection": { "type": "object", "properties": { "id": { "description": "The ID of the connection.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "name": { "description": "The name of the connection.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "strategy": { "type": "string", "description": "The auth strategy implemented by the connection." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "description": "The Auth0 Connection used for the authentication transaction that generated the event.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "request": { "type": "object", "properties": { "geo": { "description": "Geographic information about the request origin.", "type": "object", "properties": { "continent_code": { "type": "string", "description": "Continent code." }, "country_code": { "type": "string", "description": "Country code." }, "country_name": { "type": "string", "description": "Country name." }, "latitude": { "type": "number", "description": "Latitude coordinate." }, "longitude": { "type": "number", "description": "Longitude coordinate." }, "subdivision_code": { "type": "string", "description": "Subdivision (state/province) code." }, "subdivision_name": { "type": "string", "description": "Subdivision (state/province) name." }, "city_name": { "type": "string", "description": "City name." }, "time_zone": { "type": "string", "description": "Time zone." } }, "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "hostname": { "type": "string", "description": "The hostname the request is for." }, "custom_domain": { "type": "string", "description": "The custom domain used in the request (if any)." }, "ip": { "type": "string", "description": "The originating IP address of the request." }, "method": { "type": "string", "description": "The HTTP method used for the request." }, "user_agent": { "type": "string", "description": "The value of the `User-Agent` header." } }, "required": [ "geo", "hostname", "ip", "method", "user_agent" ], "unevaluatedProperties": { "not": {} }, "description": "An HTTP request.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "tenant": { "type": "object", "properties": { "id": { "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]", "description": "User-provided tenant identifier." } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a tenant in event context" }, "transaction": { "type": "object", "properties": { "acr_values": { "type": "array", "items": { "type": "string" }, "description": "acr_values in the request." }, "locale": { "type": "string", "description": "The locale used for this transaction." }, "login_hint": { "type": "string", "description": "Hint about the login identifier the user might use in this transaction." }, "prompt": { "type": "array", "items": { "type": "string" }, "description": "Instructions indicating whether the user may be prompted for re-authentication and consent." }, "protocol": { "description": "The protocol used for this transaction.", "type": "string", "enum": [ "oidc-basic-profile", "oidc-implicit-profile", "oauth2-device-code", "oauth2-resource-owner", "oauth2-resource-owner-jwt-bearer", "oauth2-password", "oauth2-webauthn", "oauth2-access-token", "oauth2-refresh-token", "oauth2-token-exchange", "oidc-hybrid-profile", "samlp", "wsfed", "wstrust-usernamemixed" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "redirect_uri": { "type": "string", "description": "The URL to which the client will be redirected when the transaction completes." }, "requested_scopes": { "type": "array", "items": { "type": "string" }, "description": "The scopes requested." }, "response_mode": { "description": "This transaction's method for returning parameters from the Authorization Endpoint.", "type": "string", "enum": [ "query", "fragment", "form_post", "web_message" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "response_type": { "type": "array", "items": { "type": "string", "enum": [ "code", "token", "id_token" ], "description": "OAuth/OIDC response types.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "description": "The kind of credential issued by this transaction." }, "state": { "type": "string", "description": "The OAuth state parameter for this transaction." }, "ui_locales": { "type": "array", "items": { "type": "string" }, "description": "The ui_locales requested for this transaction." } }, "required": [ "acr_values", "locale", "requested_scopes", "ui_locales" ], "unevaluatedProperties": { "not": {} }, "description": "An auth transaction.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "tenant" ], "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "object" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "platform-streaming-foundations" }, "a0tenant": { "description": "The auth0 tenant ID to which the event is associated.", "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]" }, "a0stream": { "description": "The auth0 event stream ID of the stream the event was delivered on.\nPresent when the event is delivered via an event stream; omitted when\nevents are retrieved via the Events API (GET /api/v2/events).", "type": "string", "examples": [ "est_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "est_[a-zA-Z0-9]{22}" } }, "required": [ "specversion", "type", "source", "id", "time", "data", "a0tenant" ], "unevaluatedProperties": { "not": {} }, "description": "Represents an event that occurs when a role is removed from an organization group.", "x-release-lifecycle": "GA", "x-auth0-owner": "authn-b2b-acceleration", "x-auth0-event-category": "organization", "example": { "specversion": "1.0", "type": "organization.group.role.deleted", "source": "urn:auth0:example.auth0app.com", "id": "evt_vjFVP5pVdfvsfRKatshkVV", "time": "2025-02-01T12:34:56Z", "data": { "object": { "organization": { "id": "org_1234567890abcdef" }, "role": { "id": "rol_1234567890abcdef" }, "group": { "id": "grp_01949dad80fc7d56", "external_id": "my-external-id", "type": "connection", "connection_id": "con_kFOHQUeaCSC1Kjqz" }, "deleted_at": "2023-04-01T13:45:30Z" }, "previous_object": { "organization": { "id": "org_1234567890abcdef" }, "role": { "id": "rol_1234567890abcdef", "name": "role-name" }, "group": { "id": "grp_01949dad80fc7d56", "external_id": "my-external-id", "type": "connection", "connection_id": "con_kFOHQUeaCSC1Kjqz" }, "created_at": "2023-04-01T13:45:30Z" }, "context": { "client": { "id": "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc", "name": "sample", "metadata": {} }, "connection": { "id": "con_kFOHQUeaCSC1Kjqz", "name": "Username-Password-Authentication", "strategy": "sample" }, "request": { "geo": { "continent_code": "sample", "country_code": "sample", "country_name": "sample", "latitude": 3.14, "longitude": 3.14, "subdivision_code": "sample", "subdivision_name": "sample", "city_name": "sample", "time_zone": "sample" }, "hostname": "sample", "custom_domain": "sample", "ip": "sample", "method": "sample", "user_agent": "sample" }, "tenant": { "id": "my-tenant" }, "transaction": { "acr_values": [ "sample" ], "locale": "sample", "login_hint": "sample", "prompt": [ "sample" ], "protocol": "oidc-basic-profile", "redirect_uri": "sample", "requested_scopes": [ "sample" ], "response_mode": "query", "response_type": [ "code" ], "state": "sample", "ui_locales": [ "sample" ] } } }, "a0tenant": "my-tenant", "a0stream": "est_vjFVP5pVdfvsfRKatshkVV" } }, "organization.member.added": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "organization.member.added", "type": "object", "properties": { "specversion": { "description": "The version of the CloudEvents specification which the event uses.", "type": "string", "enum": [ "1.0" ], "x-auth0-owner": "platform-streaming-foundations" }, "type": { "type": "string", "const": "organization.member.added", "description": "The type of the event which has happened." }, "source": { "type": "string", "examples": [ "urn:auth0:example.auth0app.com" ], "description": "The source of the event. This will take the form 'urn:auth0:.'." }, "id": { "description": "A unique identifier for the event.", "type": "string", "examples": [ "evt_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "evt_[a-zA-Z0-9]{22}" }, "time": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "An ISO-8601 timestamp indicating when the event physically occurred." }, "data": { "description": "The event payload.", "type": "object", "properties": { "object": { "description": "The event content.", "type": "object", "properties": { "organization": { "description": "The organization the member belongs to.", "type": "object", "properties": { "name": { "description": "The human-readable identifier for the organization that will be used by end-users to direct them to their organization in your application..", "type": "string", "examples": [ "my-organization" ], "pattern": "^(?:(?!org_))[a-z0-9]([a-z0-9-_]*[a-z0-9])?$" }, "id": { "description": "ID of the organization.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "authn-b2b-organizations" }, "user": { "description": "The user that is a member of the organization.", "type": "object", "properties": { "user_id": { "description": "ID of the user which can be used when interacting with other APIs.", "type": "string", "examples": [ "auth0|507f1f77bcf86cd799439020" ] } }, "required": [ "user_id" ], "unevaluatedProperties": {} } }, "required": [ "organization", "user" ], "unevaluatedProperties": { "not": {} } }, "previous_object": { "description": "The event content as it was prior to the change described by this event, when applicable.", "type": "object", "properties": { "organization": { "description": "The organization the member belongs to.", "type": "object", "properties": { "name": { "description": "The human-readable identifier for the organization that will be used by end-users to direct them to their organization in your application..", "type": "string", "examples": [ "my-organization" ], "pattern": "^(?:(?!org_))[a-z0-9]([a-z0-9-_]*[a-z0-9])?$" }, "id": { "description": "ID of the organization.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "authn-b2b-organizations" }, "user": { "description": "The user that is a member of the organization.", "type": "object", "properties": { "user_id": { "description": "ID of the user which can be used when interacting with other APIs.", "type": "string", "examples": [ "auth0|507f1f77bcf86cd799439020" ] } }, "required": [ "user_id" ], "unevaluatedProperties": {} } }, "required": [ "organization", "user" ], "unevaluatedProperties": { "not": {} } }, "context": { "description": "Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.", "type": "object", "properties": { "client": { "type": "object", "properties": { "id": { "description": "The client identifier.", "type": "string", "examples": [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] }, "name": { "type": "string", "description": "The client name." }, "metadata": { "description": "Client metadata.", "type": "object", "properties": {}, "unevaluatedProperties": {} } }, "required": [ "id", "name", "metadata" ], "unevaluatedProperties": { "not": {} }, "description": "The OAuth Client requesting or presenting an access token.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "connection": { "type": "object", "properties": { "id": { "description": "The ID of the connection.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "name": { "description": "The name of the connection.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "strategy": { "type": "string", "description": "The auth strategy implemented by the connection." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "description": "The Auth0 Connection used for the authentication transaction that generated the event.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "request": { "type": "object", "properties": { "geo": { "description": "Geographic information about the request origin.", "type": "object", "properties": { "continent_code": { "type": "string", "description": "Continent code." }, "country_code": { "type": "string", "description": "Country code." }, "country_name": { "type": "string", "description": "Country name." }, "latitude": { "type": "number", "description": "Latitude coordinate." }, "longitude": { "type": "number", "description": "Longitude coordinate." }, "subdivision_code": { "type": "string", "description": "Subdivision (state/province) code." }, "subdivision_name": { "type": "string", "description": "Subdivision (state/province) name." }, "city_name": { "type": "string", "description": "City name." }, "time_zone": { "type": "string", "description": "Time zone." } }, "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "hostname": { "type": "string", "description": "The hostname the request is for." }, "custom_domain": { "type": "string", "description": "The custom domain used in the request (if any)." }, "ip": { "type": "string", "description": "The originating IP address of the request." }, "method": { "type": "string", "description": "The HTTP method used for the request." }, "user_agent": { "type": "string", "description": "The value of the `User-Agent` header." } }, "required": [ "geo", "hostname", "ip", "method", "user_agent" ], "unevaluatedProperties": { "not": {} }, "description": "An HTTP request.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "tenant": { "type": "object", "properties": { "id": { "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]", "description": "User-provided tenant identifier." } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a tenant in event context" }, "transaction": { "type": "object", "properties": { "acr_values": { "type": "array", "items": { "type": "string" }, "description": "acr_values in the request." }, "locale": { "type": "string", "description": "The locale used for this transaction." }, "login_hint": { "type": "string", "description": "Hint about the login identifier the user might use in this transaction." }, "prompt": { "type": "array", "items": { "type": "string" }, "description": "Instructions indicating whether the user may be prompted for re-authentication and consent." }, "protocol": { "description": "The protocol used for this transaction.", "type": "string", "enum": [ "oidc-basic-profile", "oidc-implicit-profile", "oauth2-device-code", "oauth2-resource-owner", "oauth2-resource-owner-jwt-bearer", "oauth2-password", "oauth2-webauthn", "oauth2-access-token", "oauth2-refresh-token", "oauth2-token-exchange", "oidc-hybrid-profile", "samlp", "wsfed", "wstrust-usernamemixed" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "redirect_uri": { "type": "string", "description": "The URL to which the client will be redirected when the transaction completes." }, "requested_scopes": { "type": "array", "items": { "type": "string" }, "description": "The scopes requested." }, "response_mode": { "description": "This transaction's method for returning parameters from the Authorization Endpoint.", "type": "string", "enum": [ "query", "fragment", "form_post", "web_message" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "response_type": { "type": "array", "items": { "type": "string", "enum": [ "code", "token", "id_token" ], "description": "OAuth/OIDC response types.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "description": "The kind of credential issued by this transaction." }, "state": { "type": "string", "description": "The OAuth state parameter for this transaction." }, "ui_locales": { "type": "array", "items": { "type": "string" }, "description": "The ui_locales requested for this transaction." } }, "required": [ "acr_values", "locale", "requested_scopes", "ui_locales" ], "unevaluatedProperties": { "not": {} }, "description": "An auth transaction.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "tenant" ], "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "object" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "platform-streaming-foundations" }, "a0tenant": { "description": "The auth0 tenant ID to which the event is associated.", "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]" }, "a0stream": { "description": "The auth0 event stream ID of the stream the event was delivered on.\nPresent when the event is delivered via an event stream; omitted when\nevents are retrieved via the Events API (GET /api/v2/events).", "type": "string", "examples": [ "est_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "est_[a-zA-Z0-9]{22}" } }, "required": [ "specversion", "type", "source", "id", "time", "data", "a0tenant" ], "unevaluatedProperties": { "not": {} }, "description": "Represents an event that occurs when a member is added to an organization.", "x-release-lifecycle": "GA", "x-auth0-owner": "authn-b2b-organizations", "x-auth0-event-category": "organization", "example": { "specversion": "1.0", "type": "organization.member.added", "source": "urn:auth0:example.auth0app.com", "id": "evt_vjFVP5pVdfvsfRKatshkVV", "time": "2025-02-01T12:34:56Z", "data": { "object": { "organization": { "name": "my-organization", "id": "org_1234567890abcdef" }, "user": { "user_id": "auth0|507f1f77bcf86cd799439020" } }, "previous_object": { "organization": { "name": "my-organization", "id": "org_1234567890abcdef" }, "user": { "user_id": "auth0|507f1f77bcf86cd799439020" } }, "context": { "client": { "id": "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc", "name": "sample", "metadata": {} }, "connection": { "id": "con_kFOHQUeaCSC1Kjqz", "name": "Username-Password-Authentication", "strategy": "sample" }, "request": { "geo": { "continent_code": "sample", "country_code": "sample", "country_name": "sample", "latitude": 3.14, "longitude": 3.14, "subdivision_code": "sample", "subdivision_name": "sample", "city_name": "sample", "time_zone": "sample" }, "hostname": "sample", "custom_domain": "sample", "ip": "sample", "method": "sample", "user_agent": "sample" }, "tenant": { "id": "my-tenant" }, "transaction": { "acr_values": [ "sample" ], "locale": "sample", "login_hint": "sample", "prompt": [ "sample" ], "protocol": "oidc-basic-profile", "redirect_uri": "sample", "requested_scopes": [ "sample" ], "response_mode": "query", "response_type": [ "code" ], "state": "sample", "ui_locales": [ "sample" ] } } }, "a0tenant": "my-tenant", "a0stream": "est_vjFVP5pVdfvsfRKatshkVV" } }, "organization.member.deleted": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "organization.member.deleted", "type": "object", "properties": { "specversion": { "description": "The version of the CloudEvents specification which the event uses.", "type": "string", "enum": [ "1.0" ], "x-auth0-owner": "platform-streaming-foundations" }, "type": { "type": "string", "const": "organization.member.deleted", "description": "The type of the event which has happened." }, "source": { "type": "string", "examples": [ "urn:auth0:example.auth0app.com" ], "description": "The source of the event. This will take the form 'urn:auth0:.'." }, "id": { "description": "A unique identifier for the event.", "type": "string", "examples": [ "evt_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "evt_[a-zA-Z0-9]{22}" }, "time": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "An ISO-8601 timestamp indicating when the event physically occurred." }, "data": { "description": "The event payload.", "type": "object", "properties": { "object": { "description": "The event content.", "type": "object", "properties": { "organization": { "description": "The organization the member belongs to.", "type": "object", "properties": { "name": { "description": "The human-readable identifier for the organization that will be used by end-users to direct them to their organization in your application..", "type": "string", "examples": [ "my-organization" ], "pattern": "^(?:(?!org_))[a-z0-9]([a-z0-9-_]*[a-z0-9])?$" }, "id": { "description": "ID of the organization.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "authn-b2b-organizations" }, "user": { "description": "The user that is a member of the organization.", "type": "object", "properties": { "user_id": { "description": "ID of the user which can be used when interacting with other APIs.", "type": "string", "examples": [ "auth0|507f1f77bcf86cd799439020" ] } }, "required": [ "user_id" ], "unevaluatedProperties": {} } }, "required": [ "organization", "user" ], "unevaluatedProperties": { "not": {} } }, "previous_object": { "description": "The event content as it was prior to the change described by this event, when applicable.", "type": "object", "properties": { "organization": { "description": "The organization the member belongs to.", "type": "object", "properties": { "name": { "description": "The human-readable identifier for the organization that will be used by end-users to direct them to their organization in your application..", "type": "string", "examples": [ "my-organization" ], "pattern": "^(?:(?!org_))[a-z0-9]([a-z0-9-_]*[a-z0-9])?$" }, "id": { "description": "ID of the organization.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "authn-b2b-organizations" }, "user": { "description": "The user that is a member of the organization.", "type": "object", "properties": { "user_id": { "description": "ID of the user which can be used when interacting with other APIs.", "type": "string", "examples": [ "auth0|507f1f77bcf86cd799439020" ] } }, "required": [ "user_id" ], "unevaluatedProperties": {} } }, "required": [ "organization", "user" ], "unevaluatedProperties": { "not": {} } }, "context": { "description": "Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.", "type": "object", "properties": { "client": { "type": "object", "properties": { "id": { "description": "The client identifier.", "type": "string", "examples": [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] }, "name": { "type": "string", "description": "The client name." }, "metadata": { "description": "Client metadata.", "type": "object", "properties": {}, "unevaluatedProperties": {} } }, "required": [ "id", "name", "metadata" ], "unevaluatedProperties": { "not": {} }, "description": "The OAuth Client requesting or presenting an access token.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "connection": { "type": "object", "properties": { "id": { "description": "The ID of the connection.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "name": { "description": "The name of the connection.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "strategy": { "type": "string", "description": "The auth strategy implemented by the connection." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "description": "The Auth0 Connection used for the authentication transaction that generated the event.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "request": { "type": "object", "properties": { "geo": { "description": "Geographic information about the request origin.", "type": "object", "properties": { "continent_code": { "type": "string", "description": "Continent code." }, "country_code": { "type": "string", "description": "Country code." }, "country_name": { "type": "string", "description": "Country name." }, "latitude": { "type": "number", "description": "Latitude coordinate." }, "longitude": { "type": "number", "description": "Longitude coordinate." }, "subdivision_code": { "type": "string", "description": "Subdivision (state/province) code." }, "subdivision_name": { "type": "string", "description": "Subdivision (state/province) name." }, "city_name": { "type": "string", "description": "City name." }, "time_zone": { "type": "string", "description": "Time zone." } }, "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "hostname": { "type": "string", "description": "The hostname the request is for." }, "custom_domain": { "type": "string", "description": "The custom domain used in the request (if any)." }, "ip": { "type": "string", "description": "The originating IP address of the request." }, "method": { "type": "string", "description": "The HTTP method used for the request." }, "user_agent": { "type": "string", "description": "The value of the `User-Agent` header." } }, "required": [ "geo", "hostname", "ip", "method", "user_agent" ], "unevaluatedProperties": { "not": {} }, "description": "An HTTP request.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "tenant": { "type": "object", "properties": { "id": { "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]", "description": "User-provided tenant identifier." } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a tenant in event context" }, "transaction": { "type": "object", "properties": { "acr_values": { "type": "array", "items": { "type": "string" }, "description": "acr_values in the request." }, "locale": { "type": "string", "description": "The locale used for this transaction." }, "login_hint": { "type": "string", "description": "Hint about the login identifier the user might use in this transaction." }, "prompt": { "type": "array", "items": { "type": "string" }, "description": "Instructions indicating whether the user may be prompted for re-authentication and consent." }, "protocol": { "description": "The protocol used for this transaction.", "type": "string", "enum": [ "oidc-basic-profile", "oidc-implicit-profile", "oauth2-device-code", "oauth2-resource-owner", "oauth2-resource-owner-jwt-bearer", "oauth2-password", "oauth2-webauthn", "oauth2-access-token", "oauth2-refresh-token", "oauth2-token-exchange", "oidc-hybrid-profile", "samlp", "wsfed", "wstrust-usernamemixed" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "redirect_uri": { "type": "string", "description": "The URL to which the client will be redirected when the transaction completes." }, "requested_scopes": { "type": "array", "items": { "type": "string" }, "description": "The scopes requested." }, "response_mode": { "description": "This transaction's method for returning parameters from the Authorization Endpoint.", "type": "string", "enum": [ "query", "fragment", "form_post", "web_message" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "response_type": { "type": "array", "items": { "type": "string", "enum": [ "code", "token", "id_token" ], "description": "OAuth/OIDC response types.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "description": "The kind of credential issued by this transaction." }, "state": { "type": "string", "description": "The OAuth state parameter for this transaction." }, "ui_locales": { "type": "array", "items": { "type": "string" }, "description": "The ui_locales requested for this transaction." } }, "required": [ "acr_values", "locale", "requested_scopes", "ui_locales" ], "unevaluatedProperties": { "not": {} }, "description": "An auth transaction.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "tenant" ], "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "object" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "platform-streaming-foundations" }, "a0tenant": { "description": "The auth0 tenant ID to which the event is associated.", "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]" }, "a0stream": { "description": "The auth0 event stream ID of the stream the event was delivered on.\nPresent when the event is delivered via an event stream; omitted when\nevents are retrieved via the Events API (GET /api/v2/events).", "type": "string", "examples": [ "est_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "est_[a-zA-Z0-9]{22}" } }, "required": [ "specversion", "type", "source", "id", "time", "data", "a0tenant" ], "unevaluatedProperties": { "not": {} }, "description": "Represents an event that occurs when a member is removed from an organization.", "x-release-lifecycle": "GA", "x-auth0-owner": "authn-b2b-organizations", "x-auth0-event-category": "organization", "example": { "specversion": "1.0", "type": "organization.member.deleted", "source": "urn:auth0:example.auth0app.com", "id": "evt_vjFVP5pVdfvsfRKatshkVV", "time": "2025-02-01T12:34:56Z", "data": { "object": { "organization": { "name": "my-organization", "id": "org_1234567890abcdef" }, "user": { "user_id": "auth0|507f1f77bcf86cd799439020" } }, "previous_object": { "organization": { "name": "my-organization", "id": "org_1234567890abcdef" }, "user": { "user_id": "auth0|507f1f77bcf86cd799439020" } }, "context": { "client": { "id": "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc", "name": "sample", "metadata": {} }, "connection": { "id": "con_kFOHQUeaCSC1Kjqz", "name": "Username-Password-Authentication", "strategy": "sample" }, "request": { "geo": { "continent_code": "sample", "country_code": "sample", "country_name": "sample", "latitude": 3.14, "longitude": 3.14, "subdivision_code": "sample", "subdivision_name": "sample", "city_name": "sample", "time_zone": "sample" }, "hostname": "sample", "custom_domain": "sample", "ip": "sample", "method": "sample", "user_agent": "sample" }, "tenant": { "id": "my-tenant" }, "transaction": { "acr_values": [ "sample" ], "locale": "sample", "login_hint": "sample", "prompt": [ "sample" ], "protocol": "oidc-basic-profile", "redirect_uri": "sample", "requested_scopes": [ "sample" ], "response_mode": "query", "response_type": [ "code" ], "state": "sample", "ui_locales": [ "sample" ] } } }, "a0tenant": "my-tenant", "a0stream": "est_vjFVP5pVdfvsfRKatshkVV" } }, "organization.member.role.assigned": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "organization.member.role.assigned", "type": "object", "properties": { "specversion": { "description": "The version of the CloudEvents specification which the event uses.", "type": "string", "enum": [ "1.0" ], "x-auth0-owner": "platform-streaming-foundations" }, "type": { "type": "string", "const": "organization.member.role.assigned", "description": "The type of the event which has happened." }, "source": { "type": "string", "examples": [ "urn:auth0:example.auth0app.com" ], "description": "The source of the event. This will take the form 'urn:auth0:.'." }, "id": { "description": "A unique identifier for the event.", "type": "string", "examples": [ "evt_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "evt_[a-zA-Z0-9]{22}" }, "time": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "An ISO-8601 timestamp indicating when the event physically occurred." }, "data": { "description": "The event payload.", "type": "object", "properties": { "object": { "description": "The event content.", "type": "object", "properties": { "organization": { "description": "The organization the member belongs to.", "type": "object", "properties": { "id": { "description": "ID of the organization.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} } }, "user": { "description": "The user that is a member of the organization.", "type": "object", "properties": { "user_id": { "description": "ID of the user which can be used when interacting with other APIs.", "type": "string", "examples": [ "auth0|507f1f77bcf86cd799439020" ] } }, "required": [ "user_id" ], "unevaluatedProperties": {} }, "role": { "description": "The role assigned to the user in the organization.", "type": "object", "properties": { "id": { "description": "The ID of the role.", "type": "string", "examples": [ "rol_1234567890abcdef" ], "pattern": "rol_[a-zA-Z0-9]{16}" }, "name": { "type": "string", "examples": [ "role-name" ], "description": "The name of the role." } }, "required": [ "id", "name" ], "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "organization", "user", "role" ], "unevaluatedProperties": { "not": {} } }, "previous_object": { "description": "The event content as it was prior to the change described by this event, when applicable.", "type": "object", "properties": { "organization": { "description": "The organization the member belongs to.", "type": "object", "properties": { "id": { "description": "ID of the organization.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} } }, "user": { "description": "The user that is a member of the organization.", "type": "object", "properties": { "user_id": { "description": "ID of the user which can be used when interacting with other APIs.", "type": "string", "examples": [ "auth0|507f1f77bcf86cd799439020" ] } }, "required": [ "user_id" ], "unevaluatedProperties": {} }, "role": { "description": "The role assigned to the user in the organization.", "type": "object", "properties": { "id": { "description": "The ID of the role.", "type": "string", "examples": [ "rol_1234567890abcdef" ], "pattern": "rol_[a-zA-Z0-9]{16}" }, "name": { "type": "string", "examples": [ "role-name" ], "description": "The name of the role." } }, "required": [ "id", "name" ], "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "organization", "user", "role" ], "unevaluatedProperties": { "not": {} } }, "context": { "description": "Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.", "type": "object", "properties": { "client": { "type": "object", "properties": { "id": { "description": "The client identifier.", "type": "string", "examples": [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] }, "name": { "type": "string", "description": "The client name." }, "metadata": { "description": "Client metadata.", "type": "object", "properties": {}, "unevaluatedProperties": {} } }, "required": [ "id", "name", "metadata" ], "unevaluatedProperties": { "not": {} }, "description": "The OAuth Client requesting or presenting an access token.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "connection": { "type": "object", "properties": { "id": { "description": "The ID of the connection.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "name": { "description": "The name of the connection.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "strategy": { "type": "string", "description": "The auth strategy implemented by the connection." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "description": "The Auth0 Connection used for the authentication transaction that generated the event.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "request": { "type": "object", "properties": { "geo": { "description": "Geographic information about the request origin.", "type": "object", "properties": { "continent_code": { "type": "string", "description": "Continent code." }, "country_code": { "type": "string", "description": "Country code." }, "country_name": { "type": "string", "description": "Country name." }, "latitude": { "type": "number", "description": "Latitude coordinate." }, "longitude": { "type": "number", "description": "Longitude coordinate." }, "subdivision_code": { "type": "string", "description": "Subdivision (state/province) code." }, "subdivision_name": { "type": "string", "description": "Subdivision (state/province) name." }, "city_name": { "type": "string", "description": "City name." }, "time_zone": { "type": "string", "description": "Time zone." } }, "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "hostname": { "type": "string", "description": "The hostname the request is for." }, "custom_domain": { "type": "string", "description": "The custom domain used in the request (if any)." }, "ip": { "type": "string", "description": "The originating IP address of the request." }, "method": { "type": "string", "description": "The HTTP method used for the request." }, "user_agent": { "type": "string", "description": "The value of the `User-Agent` header." } }, "required": [ "geo", "hostname", "ip", "method", "user_agent" ], "unevaluatedProperties": { "not": {} }, "description": "An HTTP request.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "tenant": { "type": "object", "properties": { "id": { "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]", "description": "User-provided tenant identifier." } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a tenant in event context" }, "transaction": { "type": "object", "properties": { "acr_values": { "type": "array", "items": { "type": "string" }, "description": "acr_values in the request." }, "locale": { "type": "string", "description": "The locale used for this transaction." }, "login_hint": { "type": "string", "description": "Hint about the login identifier the user might use in this transaction." }, "prompt": { "type": "array", "items": { "type": "string" }, "description": "Instructions indicating whether the user may be prompted for re-authentication and consent." }, "protocol": { "description": "The protocol used for this transaction.", "type": "string", "enum": [ "oidc-basic-profile", "oidc-implicit-profile", "oauth2-device-code", "oauth2-resource-owner", "oauth2-resource-owner-jwt-bearer", "oauth2-password", "oauth2-webauthn", "oauth2-access-token", "oauth2-refresh-token", "oauth2-token-exchange", "oidc-hybrid-profile", "samlp", "wsfed", "wstrust-usernamemixed" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "redirect_uri": { "type": "string", "description": "The URL to which the client will be redirected when the transaction completes." }, "requested_scopes": { "type": "array", "items": { "type": "string" }, "description": "The scopes requested." }, "response_mode": { "description": "This transaction's method for returning parameters from the Authorization Endpoint.", "type": "string", "enum": [ "query", "fragment", "form_post", "web_message" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "response_type": { "type": "array", "items": { "type": "string", "enum": [ "code", "token", "id_token" ], "description": "OAuth/OIDC response types.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "description": "The kind of credential issued by this transaction." }, "state": { "type": "string", "description": "The OAuth state parameter for this transaction." }, "ui_locales": { "type": "array", "items": { "type": "string" }, "description": "The ui_locales requested for this transaction." } }, "required": [ "acr_values", "locale", "requested_scopes", "ui_locales" ], "unevaluatedProperties": { "not": {} }, "description": "An auth transaction.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "tenant" ], "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "object" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "platform-streaming-foundations" }, "a0tenant": { "description": "The auth0 tenant ID to which the event is associated.", "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]" }, "a0stream": { "description": "The auth0 event stream ID of the stream the event was delivered on.\nPresent when the event is delivered via an event stream; omitted when\nevents are retrieved via the Events API (GET /api/v2/events).", "type": "string", "examples": [ "est_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "est_[a-zA-Z0-9]{22}" } }, "required": [ "specversion", "type", "source", "id", "time", "data", "a0tenant" ], "unevaluatedProperties": { "not": {} }, "description": "Represents an event that occurs when a member is added to an organization.", "x-release-lifecycle": "GA", "x-auth0-owner": "authn-b2b-organizations", "x-auth0-event-category": "organization", "example": { "specversion": "1.0", "type": "organization.member.role.assigned", "source": "urn:auth0:example.auth0app.com", "id": "evt_vjFVP5pVdfvsfRKatshkVV", "time": "2025-02-01T12:34:56Z", "data": { "object": { "organization": { "id": "org_1234567890abcdef" }, "user": { "user_id": "auth0|507f1f77bcf86cd799439020" }, "role": { "id": "rol_1234567890abcdef", "name": "role-name" } }, "previous_object": { "organization": { "id": "org_1234567890abcdef" }, "user": { "user_id": "auth0|507f1f77bcf86cd799439020" }, "role": { "id": "rol_1234567890abcdef", "name": "role-name" } }, "context": { "client": { "id": "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc", "name": "sample", "metadata": {} }, "connection": { "id": "con_kFOHQUeaCSC1Kjqz", "name": "Username-Password-Authentication", "strategy": "sample" }, "request": { "geo": { "continent_code": "sample", "country_code": "sample", "country_name": "sample", "latitude": 3.14, "longitude": 3.14, "subdivision_code": "sample", "subdivision_name": "sample", "city_name": "sample", "time_zone": "sample" }, "hostname": "sample", "custom_domain": "sample", "ip": "sample", "method": "sample", "user_agent": "sample" }, "tenant": { "id": "my-tenant" }, "transaction": { "acr_values": [ "sample" ], "locale": "sample", "login_hint": "sample", "prompt": [ "sample" ], "protocol": "oidc-basic-profile", "redirect_uri": "sample", "requested_scopes": [ "sample" ], "response_mode": "query", "response_type": [ "code" ], "state": "sample", "ui_locales": [ "sample" ] } } }, "a0tenant": "my-tenant", "a0stream": "est_vjFVP5pVdfvsfRKatshkVV" } }, "organization.member.role.deleted": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "organization.member.role.deleted", "type": "object", "properties": { "specversion": { "description": "The version of the CloudEvents specification which the event uses.", "type": "string", "enum": [ "1.0" ], "x-auth0-owner": "platform-streaming-foundations" }, "type": { "type": "string", "const": "organization.member.role.deleted", "description": "The type of the event which has happened." }, "source": { "type": "string", "examples": [ "urn:auth0:example.auth0app.com" ], "description": "The source of the event. This will take the form 'urn:auth0:.'." }, "id": { "description": "A unique identifier for the event.", "type": "string", "examples": [ "evt_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "evt_[a-zA-Z0-9]{22}" }, "time": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "An ISO-8601 timestamp indicating when the event physically occurred." }, "data": { "description": "The event payload.", "type": "object", "properties": { "object": { "description": "The event content.", "type": "object", "properties": { "organization": { "description": "The organization the member belongs to.", "type": "object", "properties": { "id": { "description": "ID of the organization.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} } }, "user": { "description": "The user that is a member of the organization.", "type": "object", "properties": { "user_id": { "description": "ID of the user which can be used when interacting with other APIs.", "type": "string", "examples": [ "auth0|507f1f77bcf86cd799439020" ] } }, "required": [ "user_id" ], "unevaluatedProperties": {} }, "role": { "description": "The role assigned to the user in the organization.", "type": "object", "properties": { "id": { "description": "The ID of the role.", "type": "string", "examples": [ "rol_1234567890abcdef" ], "pattern": "rol_[a-zA-Z0-9]{16}" }, "name": { "type": "string", "examples": [ "role-name" ], "description": "The name of the role." } }, "required": [ "id", "name" ], "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "organization", "user", "role" ], "unevaluatedProperties": { "not": {} } }, "previous_object": { "description": "The event content as it was prior to the change described by this event, when applicable.", "type": "object", "properties": { "organization": { "description": "The organization the member belongs to.", "type": "object", "properties": { "id": { "description": "ID of the organization.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} } }, "user": { "description": "The user that is a member of the organization.", "type": "object", "properties": { "user_id": { "description": "ID of the user which can be used when interacting with other APIs.", "type": "string", "examples": [ "auth0|507f1f77bcf86cd799439020" ] } }, "required": [ "user_id" ], "unevaluatedProperties": {} }, "role": { "description": "The role assigned to the user in the organization.", "type": "object", "properties": { "id": { "description": "The ID of the role.", "type": "string", "examples": [ "rol_1234567890abcdef" ], "pattern": "rol_[a-zA-Z0-9]{16}" }, "name": { "type": "string", "examples": [ "role-name" ], "description": "The name of the role." } }, "required": [ "id", "name" ], "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "organization", "user", "role" ], "unevaluatedProperties": { "not": {} } }, "context": { "description": "Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.", "type": "object", "properties": { "client": { "type": "object", "properties": { "id": { "description": "The client identifier.", "type": "string", "examples": [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] }, "name": { "type": "string", "description": "The client name." }, "metadata": { "description": "Client metadata.", "type": "object", "properties": {}, "unevaluatedProperties": {} } }, "required": [ "id", "name", "metadata" ], "unevaluatedProperties": { "not": {} }, "description": "The OAuth Client requesting or presenting an access token.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "connection": { "type": "object", "properties": { "id": { "description": "The ID of the connection.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "name": { "description": "The name of the connection.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "strategy": { "type": "string", "description": "The auth strategy implemented by the connection." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "description": "The Auth0 Connection used for the authentication transaction that generated the event.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "request": { "type": "object", "properties": { "geo": { "description": "Geographic information about the request origin.", "type": "object", "properties": { "continent_code": { "type": "string", "description": "Continent code." }, "country_code": { "type": "string", "description": "Country code." }, "country_name": { "type": "string", "description": "Country name." }, "latitude": { "type": "number", "description": "Latitude coordinate." }, "longitude": { "type": "number", "description": "Longitude coordinate." }, "subdivision_code": { "type": "string", "description": "Subdivision (state/province) code." }, "subdivision_name": { "type": "string", "description": "Subdivision (state/province) name." }, "city_name": { "type": "string", "description": "City name." }, "time_zone": { "type": "string", "description": "Time zone." } }, "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "hostname": { "type": "string", "description": "The hostname the request is for." }, "custom_domain": { "type": "string", "description": "The custom domain used in the request (if any)." }, "ip": { "type": "string", "description": "The originating IP address of the request." }, "method": { "type": "string", "description": "The HTTP method used for the request." }, "user_agent": { "type": "string", "description": "The value of the `User-Agent` header." } }, "required": [ "geo", "hostname", "ip", "method", "user_agent" ], "unevaluatedProperties": { "not": {} }, "description": "An HTTP request.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "tenant": { "type": "object", "properties": { "id": { "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]", "description": "User-provided tenant identifier." } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a tenant in event context" }, "transaction": { "type": "object", "properties": { "acr_values": { "type": "array", "items": { "type": "string" }, "description": "acr_values in the request." }, "locale": { "type": "string", "description": "The locale used for this transaction." }, "login_hint": { "type": "string", "description": "Hint about the login identifier the user might use in this transaction." }, "prompt": { "type": "array", "items": { "type": "string" }, "description": "Instructions indicating whether the user may be prompted for re-authentication and consent." }, "protocol": { "description": "The protocol used for this transaction.", "type": "string", "enum": [ "oidc-basic-profile", "oidc-implicit-profile", "oauth2-device-code", "oauth2-resource-owner", "oauth2-resource-owner-jwt-bearer", "oauth2-password", "oauth2-webauthn", "oauth2-access-token", "oauth2-refresh-token", "oauth2-token-exchange", "oidc-hybrid-profile", "samlp", "wsfed", "wstrust-usernamemixed" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "redirect_uri": { "type": "string", "description": "The URL to which the client will be redirected when the transaction completes." }, "requested_scopes": { "type": "array", "items": { "type": "string" }, "description": "The scopes requested." }, "response_mode": { "description": "This transaction's method for returning parameters from the Authorization Endpoint.", "type": "string", "enum": [ "query", "fragment", "form_post", "web_message" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "response_type": { "type": "array", "items": { "type": "string", "enum": [ "code", "token", "id_token" ], "description": "OAuth/OIDC response types.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "description": "The kind of credential issued by this transaction." }, "state": { "type": "string", "description": "The OAuth state parameter for this transaction." }, "ui_locales": { "type": "array", "items": { "type": "string" }, "description": "The ui_locales requested for this transaction." } }, "required": [ "acr_values", "locale", "requested_scopes", "ui_locales" ], "unevaluatedProperties": { "not": {} }, "description": "An auth transaction.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "tenant" ], "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "object" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "platform-streaming-foundations" }, "a0tenant": { "description": "The auth0 tenant ID to which the event is associated.", "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]" }, "a0stream": { "description": "The auth0 event stream ID of the stream the event was delivered on.\nPresent when the event is delivered via an event stream; omitted when\nevents are retrieved via the Events API (GET /api/v2/events).", "type": "string", "examples": [ "est_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "est_[a-zA-Z0-9]{22}" } }, "required": [ "specversion", "type", "source", "id", "time", "data", "a0tenant" ], "unevaluatedProperties": { "not": {} }, "description": "Represents an event that occurs when a member is removed from an organization.", "x-release-lifecycle": "GA", "x-auth0-owner": "authn-b2b-organizations", "x-auth0-event-category": "organization", "example": { "specversion": "1.0", "type": "organization.member.role.deleted", "source": "urn:auth0:example.auth0app.com", "id": "evt_vjFVP5pVdfvsfRKatshkVV", "time": "2025-02-01T12:34:56Z", "data": { "object": { "organization": { "id": "org_1234567890abcdef" }, "user": { "user_id": "auth0|507f1f77bcf86cd799439020" }, "role": { "id": "rol_1234567890abcdef", "name": "role-name" } }, "previous_object": { "organization": { "id": "org_1234567890abcdef" }, "user": { "user_id": "auth0|507f1f77bcf86cd799439020" }, "role": { "id": "rol_1234567890abcdef", "name": "role-name" } }, "context": { "client": { "id": "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc", "name": "sample", "metadata": {} }, "connection": { "id": "con_kFOHQUeaCSC1Kjqz", "name": "Username-Password-Authentication", "strategy": "sample" }, "request": { "geo": { "continent_code": "sample", "country_code": "sample", "country_name": "sample", "latitude": 3.14, "longitude": 3.14, "subdivision_code": "sample", "subdivision_name": "sample", "city_name": "sample", "time_zone": "sample" }, "hostname": "sample", "custom_domain": "sample", "ip": "sample", "method": "sample", "user_agent": "sample" }, "tenant": { "id": "my-tenant" }, "transaction": { "acr_values": [ "sample" ], "locale": "sample", "login_hint": "sample", "prompt": [ "sample" ], "protocol": "oidc-basic-profile", "redirect_uri": "sample", "requested_scopes": [ "sample" ], "response_mode": "query", "response_type": [ "code" ], "state": "sample", "ui_locales": [ "sample" ] } } }, "a0tenant": "my-tenant", "a0stream": "est_vjFVP5pVdfvsfRKatshkVV" } }, "organization.updated": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "organization.updated", "type": "object", "properties": { "specversion": { "description": "The version of the CloudEvents specification which the event uses.", "type": "string", "enum": [ "1.0" ], "x-auth0-owner": "platform-streaming-foundations" }, "type": { "type": "string", "const": "organization.updated", "description": "The type of the event which has happened." }, "source": { "type": "string", "examples": [ "urn:auth0:example.auth0app.com" ], "description": "The source of the event. This will take the form 'urn:auth0:.'." }, "id": { "description": "A unique identifier for the event.", "type": "string", "examples": [ "evt_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "evt_[a-zA-Z0-9]{22}" }, "time": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "An ISO-8601 timestamp indicating when the event physically occurred." }, "data": { "description": "The event payload.", "type": "object", "properties": { "object": { "description": "The event content.", "type": "object", "properties": { "name": { "description": "The human-readable identifier for the organization that will be used by end-users to direct them to their organization in your application..", "type": "string", "examples": [ "my-organization" ], "pattern": "^(?:(?!org_))[a-z0-9]([a-z0-9-_]*[a-z0-9])?$" }, "id": { "description": "ID of the organization.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" }, "display_name": { "type": "string", "examples": [ "My Organization" ], "description": "If set, the name that will be displayed to end-users for this organization in any interaction with them." }, "metadata": { "description": "The metadata associated with the organization.", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "branding": { "description": "The branding associated with the organization.", "type": "object", "properties": { "logo_url": { "type": "string", "format": "uri", "description": "URL of logo to display on login page." }, "colors": { "description": "Color scheme used to customize the login pages.", "type": "object", "properties": { "primary": { "type": "string", "examples": [ "#0059d6" ], "description": "HEX Color for primary elements." }, "page_background": { "type": "string", "examples": [ "#000000" ], "description": "HEX Color for background." } }, "unevaluatedProperties": { "not": {} } } }, "unevaluatedProperties": { "not": {} } } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} } }, "previous_object": { "description": "The event content as it was prior to the change described by this event, when applicable.", "type": "object", "properties": { "name": { "description": "The human-readable identifier for the organization that will be used by end-users to direct them to their organization in your application..", "type": "string", "examples": [ "my-organization" ], "pattern": "^(?:(?!org_))[a-z0-9]([a-z0-9-_]*[a-z0-9])?$" }, "id": { "description": "ID of the organization.", "type": "string", "examples": [ "org_1234567890abcdef" ], "pattern": "org_[a-zA-Z0-9]{16}" }, "display_name": { "type": "string", "examples": [ "My Organization" ], "description": "If set, the name that will be displayed to end-users for this organization in any interaction with them." }, "metadata": { "description": "The metadata associated with the organization.", "type": "object", "properties": {}, "unevaluatedProperties": {} }, "branding": { "description": "The branding associated with the organization.", "type": "object", "properties": { "logo_url": { "type": "string", "format": "uri", "description": "URL of logo to display on login page." }, "colors": { "description": "Color scheme used to customize the login pages.", "type": "object", "properties": { "primary": { "type": "string", "examples": [ "#0059d6" ], "description": "HEX Color for primary elements." }, "page_background": { "type": "string", "examples": [ "#000000" ], "description": "HEX Color for background." } }, "unevaluatedProperties": { "not": {} } } }, "unevaluatedProperties": { "not": {} } } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} } }, "context": { "description": "Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.", "type": "object", "properties": { "client": { "type": "object", "properties": { "id": { "description": "The client identifier.", "type": "string", "examples": [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] }, "name": { "type": "string", "description": "The client name." }, "metadata": { "description": "Client metadata.", "type": "object", "properties": {}, "unevaluatedProperties": {} } }, "required": [ "id", "name", "metadata" ], "unevaluatedProperties": { "not": {} }, "description": "The OAuth Client requesting or presenting an access token.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "connection": { "type": "object", "properties": { "id": { "description": "The ID of the connection.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "name": { "description": "The name of the connection.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "strategy": { "type": "string", "description": "The auth strategy implemented by the connection." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "description": "The Auth0 Connection used for the authentication transaction that generated the event.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "request": { "type": "object", "properties": { "geo": { "description": "Geographic information about the request origin.", "type": "object", "properties": { "continent_code": { "type": "string", "description": "Continent code." }, "country_code": { "type": "string", "description": "Country code." }, "country_name": { "type": "string", "description": "Country name." }, "latitude": { "type": "number", "description": "Latitude coordinate." }, "longitude": { "type": "number", "description": "Longitude coordinate." }, "subdivision_code": { "type": "string", "description": "Subdivision (state/province) code." }, "subdivision_name": { "type": "string", "description": "Subdivision (state/province) name." }, "city_name": { "type": "string", "description": "City name." }, "time_zone": { "type": "string", "description": "Time zone." } }, "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "hostname": { "type": "string", "description": "The hostname the request is for." }, "custom_domain": { "type": "string", "description": "The custom domain used in the request (if any)." }, "ip": { "type": "string", "description": "The originating IP address of the request." }, "method": { "type": "string", "description": "The HTTP method used for the request." }, "user_agent": { "type": "string", "description": "The value of the `User-Agent` header." } }, "required": [ "geo", "hostname", "ip", "method", "user_agent" ], "unevaluatedProperties": { "not": {} }, "description": "An HTTP request.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "tenant": { "type": "object", "properties": { "id": { "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]", "description": "User-provided tenant identifier." } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a tenant in event context" }, "transaction": { "type": "object", "properties": { "acr_values": { "type": "array", "items": { "type": "string" }, "description": "acr_values in the request." }, "locale": { "type": "string", "description": "The locale used for this transaction." }, "login_hint": { "type": "string", "description": "Hint about the login identifier the user might use in this transaction." }, "prompt": { "type": "array", "items": { "type": "string" }, "description": "Instructions indicating whether the user may be prompted for re-authentication and consent." }, "protocol": { "description": "The protocol used for this transaction.", "type": "string", "enum": [ "oidc-basic-profile", "oidc-implicit-profile", "oauth2-device-code", "oauth2-resource-owner", "oauth2-resource-owner-jwt-bearer", "oauth2-password", "oauth2-webauthn", "oauth2-access-token", "oauth2-refresh-token", "oauth2-token-exchange", "oidc-hybrid-profile", "samlp", "wsfed", "wstrust-usernamemixed" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "redirect_uri": { "type": "string", "description": "The URL to which the client will be redirected when the transaction completes." }, "requested_scopes": { "type": "array", "items": { "type": "string" }, "description": "The scopes requested." }, "response_mode": { "description": "This transaction's method for returning parameters from the Authorization Endpoint.", "type": "string", "enum": [ "query", "fragment", "form_post", "web_message" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "response_type": { "type": "array", "items": { "type": "string", "enum": [ "code", "token", "id_token" ], "description": "OAuth/OIDC response types.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "description": "The kind of credential issued by this transaction." }, "state": { "type": "string", "description": "The OAuth state parameter for this transaction." }, "ui_locales": { "type": "array", "items": { "type": "string" }, "description": "The ui_locales requested for this transaction." } }, "required": [ "acr_values", "locale", "requested_scopes", "ui_locales" ], "unevaluatedProperties": { "not": {} }, "description": "An auth transaction.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "tenant" ], "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "object" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "platform-streaming-foundations" }, "a0tenant": { "description": "The auth0 tenant ID to which the event is associated.", "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]" }, "a0stream": { "description": "The auth0 event stream ID of the stream the event was delivered on.\nPresent when the event is delivered via an event stream; omitted when\nevents are retrieved via the Events API (GET /api/v2/events).", "type": "string", "examples": [ "est_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "est_[a-zA-Z0-9]{22}" } }, "required": [ "specversion", "type", "source", "id", "time", "data", "a0tenant" ], "unevaluatedProperties": { "not": {} }, "description": "Represents an event that occurs when an organization is updated.", "x-release-lifecycle": "GA", "x-auth0-owner": "authn-b2b-organizations", "x-auth0-event-category": "organization", "example": { "specversion": "1.0", "type": "organization.updated", "source": "urn:auth0:example.auth0app.com", "id": "evt_vjFVP5pVdfvsfRKatshkVV", "time": "2025-02-01T12:34:56Z", "data": { "object": { "name": "my-organization", "id": "org_1234567890abcdef", "display_name": "My Organization", "metadata": {}, "branding": { "logo_url": "https://example.com", "colors": { "primary": "#0059d6", "page_background": "#000000" } } }, "previous_object": { "name": "my-organization", "id": "org_1234567890abcdef", "display_name": "My Organization", "metadata": {}, "branding": { "logo_url": "https://example.com", "colors": { "primary": "#0059d6", "page_background": "#000000" } } }, "context": { "client": { "id": "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc", "name": "sample", "metadata": {} }, "connection": { "id": "con_kFOHQUeaCSC1Kjqz", "name": "Username-Password-Authentication", "strategy": "sample" }, "request": { "geo": { "continent_code": "sample", "country_code": "sample", "country_name": "sample", "latitude": 3.14, "longitude": 3.14, "subdivision_code": "sample", "subdivision_name": "sample", "city_name": "sample", "time_zone": "sample" }, "hostname": "sample", "custom_domain": "sample", "ip": "sample", "method": "sample", "user_agent": "sample" }, "tenant": { "id": "my-tenant" }, "transaction": { "acr_values": [ "sample" ], "locale": "sample", "login_hint": "sample", "prompt": [ "sample" ], "protocol": "oidc-basic-profile", "redirect_uri": "sample", "requested_scopes": [ "sample" ], "response_mode": "query", "response_type": [ "code" ], "state": "sample", "ui_locales": [ "sample" ] } } }, "a0tenant": "my-tenant", "a0stream": "est_vjFVP5pVdfvsfRKatshkVV" } }, "user.created": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "user.created", "type": "object", "properties": { "specversion": { "description": "The version of the CloudEvents specification which the event uses.", "type": "string", "enum": [ "1.0" ], "x-auth0-owner": "platform-streaming-foundations" }, "type": { "type": "string", "const": "user.created", "description": "The type of the event which has happened." }, "source": { "type": "string", "examples": [ "urn:auth0:example.auth0app.com" ], "description": "The source of the event. This will take the form 'urn:auth0:.'." }, "id": { "description": "A unique identifier for the event.", "type": "string", "examples": [ "evt_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "evt_[a-zA-Z0-9]{22}" }, "time": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "An ISO-8601 timestamp indicating when the event physically occurred." }, "data": { "description": "The event payload.", "type": "object", "properties": { "object": { "description": "The event content.", "type": "object", "properties": { "user_id": { "description": "ID of the user which can be used when interacting with other APIs.", "type": "string", "examples": [ "auth0|507f1f77bcf86cd799439020" ] }, "email": { "description": "Email address of this user.", "type": "string", "examples": [ "john.doe@gmail.com" ], "format": "idn-email" }, "email_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this email address is verified (true) or unverified (false)." }, "username": { "description": "Username of this user.", "type": "string", "examples": [ "johndoe" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$" }, "phone_number": { "description": "Phone number of this user.", "type": "string", "examples": [ "+15555555555" ], "pattern": "^\\+[0-9]{1,15}$" }, "phone_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this phone number has been verified (true) or not (false)." }, "created_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was created (ISO_8601 format)." }, "updated_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was last updated/modified (ISO_8601 format)." }, "identities": { "type": "array", "items": { "oneOf": [ { "type": "object", "properties": { "connection": { "description": "Name of the connection containing this identity.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "user_id": { "anyOf": [ { "type": "string" }, { "type": "integer" } ], "examples": [ "507f1f77bcf86cd799439020", 1234567890 ], "description": "The IDP-specific identifer for the user." }, "profileData": { "description": "Profile data for the user.", "type": "object", "properties": { "email": { "description": "Email address of this user.", "type": "string", "examples": [ "john.doe@gmail.com" ], "format": "idn-email" }, "email_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this email address is verified (true) or unverified (false)." }, "name": { "description": "Name of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "username": { "description": "Username of this user.", "type": "string", "examples": [ "johndoe" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$" }, "given_name": { "description": "Given name/first name/forename of this user.", "type": "string", "examples": [ "John" ], "minLength": 1, "maxLength": 150 }, "family_name": { "description": "Family name/last name/surname of this user.", "type": "string", "examples": [ "Doe" ], "minLength": 1, "maxLength": 150 }, "phone_number": { "description": "Phone number of this user.", "type": "string", "examples": [ "+15555555555" ], "pattern": "^\\+[0-9]{1,15}$" }, "phone_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this phone number has been verified (true) or not (false)." } }, "unevaluatedProperties": {} }, "provider": { "type": "string", "enum": [ "custom" ], "description": "List of custom identity providers.", "x-auth0-owner": "iam-user-management" }, "isSocial": { "type": "boolean", "const": false } }, "required": [ "connection", "user_id", "provider", "isSocial" ], "unevaluatedProperties": { "not": {} }, "description": "The identity object for custom identity providers.", "title": "Custom", "x-auth0-owner": "iam-user-management" }, { "type": "object", "properties": { "connection": { "description": "Name of the connection containing this identity.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "user_id": { "anyOf": [ { "type": "string" }, { "type": "integer" } ], "examples": [ "507f1f77bcf86cd799439020", 1234567890 ], "description": "The IDP-specific identifer for the user." }, "profileData": { "description": "Profile data for the user.", "type": "object", "properties": { "email": { "description": "Email address of this user.", "type": "string", "examples": [ "john.doe@gmail.com" ], "format": "idn-email" }, "email_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this email address is verified (true) or unverified (false)." }, "name": { "description": "Name of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "username": { "description": "Username of this user.", "type": "string", "examples": [ "johndoe" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$" }, "given_name": { "description": "Given name/first name/forename of this user.", "type": "string", "examples": [ "John" ], "minLength": 1, "maxLength": 150 }, "family_name": { "description": "Family name/last name/surname of this user.", "type": "string", "examples": [ "Doe" ], "minLength": 1, "maxLength": 150 }, "phone_number": { "description": "Phone number of this user.", "type": "string", "examples": [ "+15555555555" ], "pattern": "^\\+[0-9]{1,15}$" }, "phone_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this phone number has been verified (true) or not (false)." } }, "unevaluatedProperties": {} }, "provider": { "type": "string", "enum": [ "auth0" ], "description": "List of database identity providers.", "x-auth0-owner": "iam-user-management" }, "isSocial": { "type": "boolean", "const": false } }, "required": [ "connection", "user_id", "provider", "isSocial" ], "unevaluatedProperties": { "not": {} }, "description": "The identity object for database identity providers.", "title": "Database", "x-auth0-owner": "iam-user-management" }, { "type": "object", "properties": { "connection": { "description": "Name of the connection containing this identity.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "user_id": { "anyOf": [ { "type": "string" }, { "type": "integer" } ], "examples": [ "507f1f77bcf86cd799439020", 1234567890 ], "description": "The IDP-specific identifer for the user." }, "profileData": { "description": "Profile data for the user.", "type": "object", "properties": { "email": { "description": "Email address of this user.", "type": "string", "examples": [ "john.doe@gmail.com" ], "format": "idn-email" }, "email_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this email address is verified (true) or unverified (false)." }, "name": { "description": "Name of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "username": { "description": "Username of this user.", "type": "string", "examples": [ "johndoe" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$" }, "given_name": { "description": "Given name/first name/forename of this user.", "type": "string", "examples": [ "John" ], "minLength": 1, "maxLength": 150 }, "family_name": { "description": "Family name/last name/surname of this user.", "type": "string", "examples": [ "Doe" ], "minLength": 1, "maxLength": 150 }, "phone_number": { "description": "Phone number of this user.", "type": "string", "examples": [ "+15555555555" ], "pattern": "^\\+[0-9]{1,15}$" }, "phone_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this phone number has been verified (true) or not (false)." } }, "unevaluatedProperties": {} }, "provider": { "type": "string", "enum": [ "ad", "adfs", "google-apps", "ip", "office365", "oidc", "okta", "pingfederate", "samlp", "sharepoint", "waad" ], "description": "List of enterprise identity providers.", "x-auth0-owner": "iam-user-management" }, "isSocial": { "type": "boolean", "const": false } }, "required": [ "connection", "user_id", "provider", "isSocial" ], "unevaluatedProperties": { "not": {} }, "description": "The identity object for enterprise identity providers.", "title": "Enterprise", "x-auth0-owner": "iam-user-management" }, { "type": "object", "properties": { "connection": { "description": "Name of the connection containing this identity.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "user_id": { "anyOf": [ { "type": "string" }, { "type": "integer" } ], "examples": [ "507f1f77bcf86cd799439020", 1234567890 ], "description": "The IDP-specific identifer for the user." }, "profileData": { "description": "Profile data for the user.", "type": "object", "properties": { "email": { "description": "Email address of this user.", "type": "string", "examples": [ "john.doe@gmail.com" ], "format": "idn-email" }, "email_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this email address is verified (true) or unverified (false)." }, "name": { "description": "Name of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "username": { "description": "Username of this user.", "type": "string", "examples": [ "johndoe" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$" }, "given_name": { "description": "Given name/first name/forename of this user.", "type": "string", "examples": [ "John" ], "minLength": 1, "maxLength": 150 }, "family_name": { "description": "Family name/last name/surname of this user.", "type": "string", "examples": [ "Doe" ], "minLength": 1, "maxLength": 150 }, "phone_number": { "description": "Phone number of this user.", "type": "string", "examples": [ "+15555555555" ], "pattern": "^\\+[0-9]{1,15}$" }, "phone_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this phone number has been verified (true) or not (false)." } }, "unevaluatedProperties": {} }, "provider": { "type": "string", "enum": [ "email", "sms" ], "description": "List of passwordless identity providers.", "x-auth0-owner": "iam-user-management" }, "isSocial": { "type": "boolean", "const": false } }, "required": [ "connection", "user_id", "provider", "isSocial" ], "unevaluatedProperties": { "not": {} }, "description": "The identity object for passwordless identity providers.", "title": "Passwordless", "x-auth0-owner": "iam-user-management" }, { "type": "object", "properties": { "connection": { "description": "Name of the connection containing this identity.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "user_id": { "anyOf": [ { "type": "string" }, { "type": "integer" } ], "examples": [ "507f1f77bcf86cd799439020", 1234567890 ], "description": "The IDP-specific identifer for the user." }, "profileData": { "description": "Profile data for the user.", "type": "object", "properties": { "email": { "description": "Email address of this user.", "type": "string", "examples": [ "john.doe@gmail.com" ], "format": "idn-email" }, "email_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this email address is verified (true) or unverified (false)." }, "name": { "description": "Name of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "username": { "description": "Username of this user.", "type": "string", "examples": [ "johndoe" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$" }, "given_name": { "description": "Given name/first name/forename of this user.", "type": "string", "examples": [ "John" ], "minLength": 1, "maxLength": 150 }, "family_name": { "description": "Family name/last name/surname of this user.", "type": "string", "examples": [ "Doe" ], "minLength": 1, "maxLength": 150 }, "phone_number": { "description": "Phone number of this user.", "type": "string", "examples": [ "+15555555555" ], "pattern": "^\\+[0-9]{1,15}$" }, "phone_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this phone number has been verified (true) or not (false)." } }, "unevaluatedProperties": {} }, "provider": { "type": "string", "enum": [ "amazon", "apple", "dropbox", "bitbucket", "auth0-oidc", "baidu", "bitly", "box", "daccount", "dwolla", "evernote-sandbox", "evernote", "exact", "facebook", "fitbit", "github", "google-oauth2", "instagram", "line", "linkedin", "oauth1", "oauth2", "paypal", "paypal-sandbox", "planningcenter", "salesforce-community", "salesforce-sandbox", "salesforce", "shopify", "soundcloud", "thirtysevensignals", "twitter", "untapped", "vkontakte", "weibo", "windowslive", "wordpress", "yahoo", "yandex" ], "description": "List of social identity providers.", "x-auth0-owner": "iam-user-management" }, "isSocial": { "type": "boolean", "const": true } }, "required": [ "connection", "user_id", "provider", "isSocial" ], "unevaluatedProperties": { "not": {} }, "description": "The identity object for social identity providers.", "title": "Social", "x-auth0-owner": "iam-user-management" } ], "description": "Identity object when accounts are linked.", "title": "Identity", "x-auth0-owner": "iam-user-management" }, "description": "Array of user identity objects when accounts are linked." }, "app_metadata": { "description": "User metadata to which this user has read-only access.", "type": "object", "properties": {}, "unevaluatedProperties": {}, "examples": [ { "plan": "pro" } ], "x-auth0-owner": "iam-user-management" }, "user_metadata": { "description": "User metadata to which this user has read/write access.", "type": "object", "properties": {}, "unevaluatedProperties": {}, "examples": [ { "hobby": "skydiving" } ], "x-auth0-owner": "iam-user-management" }, "picture": { "type": "string", "format": "uri", "examples": [ "https://secure.gravatar.com/avatar/15626c5e0c749cb912f9d1ad48dba440?s=480&r=pg&d=https%3A%2F%2Fssl.gstatic.com%2Fs2%2Fprofiles%2Fimages%2Fsilhouette80.png" ], "description": "URL to picture, photo, or avatar of this user." }, "name": { "description": "Name of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "nickname": { "description": "Preferred nickname or alias of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "multifactor": { "type": "array", "items": { "type": "string" }, "description": "List of multi-factor authentication providers with which this user has enrolled." }, "last_ip": { "description": "Last IP address from which this user logged in.", "type": "string", "examples": [ "10.0.0.1" ] }, "last_login": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Last date and time this user logged in (ISO_8601 format)." }, "logins_count": { "type": "integer", "examples": [ 42 ], "description": "Total number of logins this user has performed." }, "blocked": { "type": "boolean", "examples": [ false ], "description": "Whether this user was blocked by an administrator (true) or is not (false)." }, "given_name": { "description": "Given name/first name/forename of this user.", "type": "string", "examples": [ "John" ], "minLength": 1, "maxLength": 150 }, "family_name": { "description": "Family name/last name/surname of this user.", "type": "string", "examples": [ "Doe" ], "minLength": 1, "maxLength": 150 } }, "required": [ "user_id", "created_at", "updated_at", "identities" ], "unevaluatedProperties": {}, "title": "Auth0 User", "x-release-lifecycle": "EA", "x-auth0-owner": "iam-user-management" }, "previous_object": { "description": "The event content as it was prior to the change described by this event, when applicable.", "type": "object", "properties": { "user_id": { "description": "ID of the user which can be used when interacting with other APIs.", "type": "string", "examples": [ "auth0|507f1f77bcf86cd799439020" ] }, "email": { "description": "Email address of this user.", "type": "string", "examples": [ "john.doe@gmail.com" ], "format": "idn-email" }, "email_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this email address is verified (true) or unverified (false)." }, "username": { "description": "Username of this user.", "type": "string", "examples": [ "johndoe" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$" }, "phone_number": { "description": "Phone number of this user.", "type": "string", "examples": [ "+15555555555" ], "pattern": "^\\+[0-9]{1,15}$" }, "phone_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this phone number has been verified (true) or not (false)." }, "created_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was created (ISO_8601 format)." }, "updated_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was last updated/modified (ISO_8601 format)." }, "identities": { "type": "array", "items": { "oneOf": [ { "type": "object", "properties": { "connection": { "description": "Name of the connection containing this identity.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "user_id": { "anyOf": [ { "type": "string" }, { "type": "integer" } ], "examples": [ "507f1f77bcf86cd799439020", 1234567890 ], "description": "The IDP-specific identifer for the user." }, "profileData": { "description": "Profile data for the user.", "type": "object", "properties": { "email": { "description": "Email address of this user.", "type": "string", "examples": [ "john.doe@gmail.com" ], "format": "idn-email" }, "email_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this email address is verified (true) or unverified (false)." }, "name": { "description": "Name of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "username": { "description": "Username of this user.", "type": "string", "examples": [ "johndoe" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$" }, "given_name": { "description": "Given name/first name/forename of this user.", "type": "string", "examples": [ "John" ], "minLength": 1, "maxLength": 150 }, "family_name": { "description": "Family name/last name/surname of this user.", "type": "string", "examples": [ "Doe" ], "minLength": 1, "maxLength": 150 }, "phone_number": { "description": "Phone number of this user.", "type": "string", "examples": [ "+15555555555" ], "pattern": "^\\+[0-9]{1,15}$" }, "phone_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this phone number has been verified (true) or not (false)." } }, "unevaluatedProperties": {} }, "provider": { "type": "string", "enum": [ "custom" ], "description": "List of custom identity providers.", "x-auth0-owner": "iam-user-management" }, "isSocial": { "type": "boolean", "const": false } }, "required": [ "connection", "user_id", "provider", "isSocial" ], "unevaluatedProperties": { "not": {} }, "description": "The identity object for custom identity providers.", "title": "Custom", "x-auth0-owner": "iam-user-management" }, { "type": "object", "properties": { "connection": { "description": "Name of the connection containing this identity.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "user_id": { "anyOf": [ { "type": "string" }, { "type": "integer" } ], "examples": [ "507f1f77bcf86cd799439020", 1234567890 ], "description": "The IDP-specific identifer for the user." }, "profileData": { "description": "Profile data for the user.", "type": "object", "properties": { "email": { "description": "Email address of this user.", "type": "string", "examples": [ "john.doe@gmail.com" ], "format": "idn-email" }, "email_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this email address is verified (true) or unverified (false)." }, "name": { "description": "Name of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "username": { "description": "Username of this user.", "type": "string", "examples": [ "johndoe" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$" }, "given_name": { "description": "Given name/first name/forename of this user.", "type": "string", "examples": [ "John" ], "minLength": 1, "maxLength": 150 }, "family_name": { "description": "Family name/last name/surname of this user.", "type": "string", "examples": [ "Doe" ], "minLength": 1, "maxLength": 150 }, "phone_number": { "description": "Phone number of this user.", "type": "string", "examples": [ "+15555555555" ], "pattern": "^\\+[0-9]{1,15}$" }, "phone_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this phone number has been verified (true) or not (false)." } }, "unevaluatedProperties": {} }, "provider": { "type": "string", "enum": [ "auth0" ], "description": "List of database identity providers.", "x-auth0-owner": "iam-user-management" }, "isSocial": { "type": "boolean", "const": false } }, "required": [ "connection", "user_id", "provider", "isSocial" ], "unevaluatedProperties": { "not": {} }, "description": "The identity object for database identity providers.", "title": "Database", "x-auth0-owner": "iam-user-management" }, { "type": "object", "properties": { "connection": { "description": "Name of the connection containing this identity.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "user_id": { "anyOf": [ { "type": "string" }, { "type": "integer" } ], "examples": [ "507f1f77bcf86cd799439020", 1234567890 ], "description": "The IDP-specific identifer for the user." }, "profileData": { "description": "Profile data for the user.", "type": "object", "properties": { "email": { "description": "Email address of this user.", "type": "string", "examples": [ "john.doe@gmail.com" ], "format": "idn-email" }, "email_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this email address is verified (true) or unverified (false)." }, "name": { "description": "Name of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "username": { "description": "Username of this user.", "type": "string", "examples": [ "johndoe" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$" }, "given_name": { "description": "Given name/first name/forename of this user.", "type": "string", "examples": [ "John" ], "minLength": 1, "maxLength": 150 }, "family_name": { "description": "Family name/last name/surname of this user.", "type": "string", "examples": [ "Doe" ], "minLength": 1, "maxLength": 150 }, "phone_number": { "description": "Phone number of this user.", "type": "string", "examples": [ "+15555555555" ], "pattern": "^\\+[0-9]{1,15}$" }, "phone_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this phone number has been verified (true) or not (false)." } }, "unevaluatedProperties": {} }, "provider": { "type": "string", "enum": [ "ad", "adfs", "google-apps", "ip", "office365", "oidc", "okta", "pingfederate", "samlp", "sharepoint", "waad" ], "description": "List of enterprise identity providers.", "x-auth0-owner": "iam-user-management" }, "isSocial": { "type": "boolean", "const": false } }, "required": [ "connection", "user_id", "provider", "isSocial" ], "unevaluatedProperties": { "not": {} }, "description": "The identity object for enterprise identity providers.", "title": "Enterprise", "x-auth0-owner": "iam-user-management" }, { "type": "object", "properties": { "connection": { "description": "Name of the connection containing this identity.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "user_id": { "anyOf": [ { "type": "string" }, { "type": "integer" } ], "examples": [ "507f1f77bcf86cd799439020", 1234567890 ], "description": "The IDP-specific identifer for the user." }, "profileData": { "description": "Profile data for the user.", "type": "object", "properties": { "email": { "description": "Email address of this user.", "type": "string", "examples": [ "john.doe@gmail.com" ], "format": "idn-email" }, "email_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this email address is verified (true) or unverified (false)." }, "name": { "description": "Name of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "username": { "description": "Username of this user.", "type": "string", "examples": [ "johndoe" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$" }, "given_name": { "description": "Given name/first name/forename of this user.", "type": "string", "examples": [ "John" ], "minLength": 1, "maxLength": 150 }, "family_name": { "description": "Family name/last name/surname of this user.", "type": "string", "examples": [ "Doe" ], "minLength": 1, "maxLength": 150 }, "phone_number": { "description": "Phone number of this user.", "type": "string", "examples": [ "+15555555555" ], "pattern": "^\\+[0-9]{1,15}$" }, "phone_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this phone number has been verified (true) or not (false)." } }, "unevaluatedProperties": {} }, "provider": { "type": "string", "enum": [ "email", "sms" ], "description": "List of passwordless identity providers.", "x-auth0-owner": "iam-user-management" }, "isSocial": { "type": "boolean", "const": false } }, "required": [ "connection", "user_id", "provider", "isSocial" ], "unevaluatedProperties": { "not": {} }, "description": "The identity object for passwordless identity providers.", "title": "Passwordless", "x-auth0-owner": "iam-user-management" }, { "type": "object", "properties": { "connection": { "description": "Name of the connection containing this identity.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "user_id": { "anyOf": [ { "type": "string" }, { "type": "integer" } ], "examples": [ "507f1f77bcf86cd799439020", 1234567890 ], "description": "The IDP-specific identifer for the user." }, "profileData": { "description": "Profile data for the user.", "type": "object", "properties": { "email": { "description": "Email address of this user.", "type": "string", "examples": [ "john.doe@gmail.com" ], "format": "idn-email" }, "email_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this email address is verified (true) or unverified (false)." }, "name": { "description": "Name of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "username": { "description": "Username of this user.", "type": "string", "examples": [ "johndoe" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$" }, "given_name": { "description": "Given name/first name/forename of this user.", "type": "string", "examples": [ "John" ], "minLength": 1, "maxLength": 150 }, "family_name": { "description": "Family name/last name/surname of this user.", "type": "string", "examples": [ "Doe" ], "minLength": 1, "maxLength": 150 }, "phone_number": { "description": "Phone number of this user.", "type": "string", "examples": [ "+15555555555" ], "pattern": "^\\+[0-9]{1,15}$" }, "phone_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this phone number has been verified (true) or not (false)." } }, "unevaluatedProperties": {} }, "provider": { "type": "string", "enum": [ "amazon", "apple", "dropbox", "bitbucket", "auth0-oidc", "baidu", "bitly", "box", "daccount", "dwolla", "evernote-sandbox", "evernote", "exact", "facebook", "fitbit", "github", "google-oauth2", "instagram", "line", "linkedin", "oauth1", "oauth2", "paypal", "paypal-sandbox", "planningcenter", "salesforce-community", "salesforce-sandbox", "salesforce", "shopify", "soundcloud", "thirtysevensignals", "twitter", "untapped", "vkontakte", "weibo", "windowslive", "wordpress", "yahoo", "yandex" ], "description": "List of social identity providers.", "x-auth0-owner": "iam-user-management" }, "isSocial": { "type": "boolean", "const": true } }, "required": [ "connection", "user_id", "provider", "isSocial" ], "unevaluatedProperties": { "not": {} }, "description": "The identity object for social identity providers.", "title": "Social", "x-auth0-owner": "iam-user-management" } ], "description": "Identity object when accounts are linked.", "title": "Identity", "x-auth0-owner": "iam-user-management" }, "description": "Array of user identity objects when accounts are linked." }, "app_metadata": { "description": "User metadata to which this user has read-only access.", "type": "object", "properties": {}, "unevaluatedProperties": {}, "examples": [ { "plan": "pro" } ], "x-auth0-owner": "iam-user-management" }, "user_metadata": { "description": "User metadata to which this user has read/write access.", "type": "object", "properties": {}, "unevaluatedProperties": {}, "examples": [ { "hobby": "skydiving" } ], "x-auth0-owner": "iam-user-management" }, "picture": { "type": "string", "format": "uri", "examples": [ "https://secure.gravatar.com/avatar/15626c5e0c749cb912f9d1ad48dba440?s=480&r=pg&d=https%3A%2F%2Fssl.gstatic.com%2Fs2%2Fprofiles%2Fimages%2Fsilhouette80.png" ], "description": "URL to picture, photo, or avatar of this user." }, "name": { "description": "Name of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "nickname": { "description": "Preferred nickname or alias of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "multifactor": { "type": "array", "items": { "type": "string" }, "description": "List of multi-factor authentication providers with which this user has enrolled." }, "last_ip": { "description": "Last IP address from which this user logged in.", "type": "string", "examples": [ "10.0.0.1" ] }, "last_login": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Last date and time this user logged in (ISO_8601 format)." }, "logins_count": { "type": "integer", "examples": [ 42 ], "description": "Total number of logins this user has performed." }, "blocked": { "type": "boolean", "examples": [ false ], "description": "Whether this user was blocked by an administrator (true) or is not (false)." }, "given_name": { "description": "Given name/first name/forename of this user.", "type": "string", "examples": [ "John" ], "minLength": 1, "maxLength": 150 }, "family_name": { "description": "Family name/last name/surname of this user.", "type": "string", "examples": [ "Doe" ], "minLength": 1, "maxLength": 150 } }, "required": [ "user_id", "created_at", "updated_at", "identities" ], "unevaluatedProperties": {}, "title": "Auth0 User", "x-release-lifecycle": "EA", "x-auth0-owner": "iam-user-management" }, "context": { "description": "Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.", "type": "object", "properties": { "client": { "type": "object", "properties": { "id": { "description": "The client identifier.", "type": "string", "examples": [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] }, "name": { "type": "string", "description": "The client name." }, "metadata": { "description": "Client metadata.", "type": "object", "properties": {}, "unevaluatedProperties": {} } }, "required": [ "id", "name", "metadata" ], "unevaluatedProperties": { "not": {} }, "description": "The OAuth Client requesting or presenting an access token.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "connection": { "type": "object", "properties": { "id": { "description": "The ID of the connection.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "name": { "description": "The name of the connection.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "strategy": { "type": "string", "description": "The auth strategy implemented by the connection." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "description": "The Auth0 Connection used for the authentication transaction that generated the event.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "request": { "type": "object", "properties": { "geo": { "description": "Geographic information about the request origin.", "type": "object", "properties": { "continent_code": { "type": "string", "description": "Continent code." }, "country_code": { "type": "string", "description": "Country code." }, "country_name": { "type": "string", "description": "Country name." }, "latitude": { "type": "number", "description": "Latitude coordinate." }, "longitude": { "type": "number", "description": "Longitude coordinate." }, "subdivision_code": { "type": "string", "description": "Subdivision (state/province) code." }, "subdivision_name": { "type": "string", "description": "Subdivision (state/province) name." }, "city_name": { "type": "string", "description": "City name." }, "time_zone": { "type": "string", "description": "Time zone." } }, "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "hostname": { "type": "string", "description": "The hostname the request is for." }, "custom_domain": { "type": "string", "description": "The custom domain used in the request (if any)." }, "ip": { "type": "string", "description": "The originating IP address of the request." }, "method": { "type": "string", "description": "The HTTP method used for the request." }, "user_agent": { "type": "string", "description": "The value of the `User-Agent` header." } }, "required": [ "geo", "hostname", "ip", "method", "user_agent" ], "unevaluatedProperties": { "not": {} }, "description": "An HTTP request.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "tenant": { "type": "object", "properties": { "id": { "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]", "description": "User-provided tenant identifier." } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a tenant in event context" }, "transaction": { "type": "object", "properties": { "acr_values": { "type": "array", "items": { "type": "string" }, "description": "acr_values in the request." }, "locale": { "type": "string", "description": "The locale used for this transaction." }, "login_hint": { "type": "string", "description": "Hint about the login identifier the user might use in this transaction." }, "prompt": { "type": "array", "items": { "type": "string" }, "description": "Instructions indicating whether the user may be prompted for re-authentication and consent." }, "protocol": { "description": "The protocol used for this transaction.", "type": "string", "enum": [ "oidc-basic-profile", "oidc-implicit-profile", "oauth2-device-code", "oauth2-resource-owner", "oauth2-resource-owner-jwt-bearer", "oauth2-password", "oauth2-webauthn", "oauth2-access-token", "oauth2-refresh-token", "oauth2-token-exchange", "oidc-hybrid-profile", "samlp", "wsfed", "wstrust-usernamemixed" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "redirect_uri": { "type": "string", "description": "The URL to which the client will be redirected when the transaction completes." }, "requested_scopes": { "type": "array", "items": { "type": "string" }, "description": "The scopes requested." }, "response_mode": { "description": "This transaction's method for returning parameters from the Authorization Endpoint.", "type": "string", "enum": [ "query", "fragment", "form_post", "web_message" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "response_type": { "type": "array", "items": { "type": "string", "enum": [ "code", "token", "id_token" ], "description": "OAuth/OIDC response types.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "description": "The kind of credential issued by this transaction." }, "state": { "type": "string", "description": "The OAuth state parameter for this transaction." }, "ui_locales": { "type": "array", "items": { "type": "string" }, "description": "The ui_locales requested for this transaction." } }, "required": [ "acr_values", "locale", "requested_scopes", "ui_locales" ], "unevaluatedProperties": { "not": {} }, "description": "An auth transaction.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "tenant" ], "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "object" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "platform-streaming-foundations" }, "a0tenant": { "description": "The auth0 tenant ID to which the event is associated.", "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]" }, "a0stream": { "description": "The auth0 event stream ID of the stream the event was delivered on.\nPresent when the event is delivered via an event stream; omitted when\nevents are retrieved via the Events API (GET /api/v2/events).", "type": "string", "examples": [ "est_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "est_[a-zA-Z0-9]{22}" } }, "required": [ "specversion", "type", "source", "id", "time", "data", "a0tenant" ], "unevaluatedProperties": { "not": {} }, "description": "Represents an event that occurs when a user is created.", "x-release-lifecycle": "GA", "x-auth0-owner": "iam-user-management", "x-auth0-event-category": "user", "example": { "specversion": "1.0", "type": "user.created", "source": "urn:auth0:example.auth0app.com", "id": "evt_vjFVP5pVdfvsfRKatshkVV", "time": "2025-02-01T12:34:56Z", "data": { "object": { "user_id": "auth0|507f1f77bcf86cd799439020", "email": "john.doe@gmail.com", "email_verified": false, "username": "johndoe", "phone_number": "+15555555555", "phone_verified": false, "created_at": "2025-02-01T12:34:56Z", "updated_at": "2025-02-01T12:34:56Z", "identities": [ { "connection": "Username-Password-Authentication", "user_id": "507f1f77bcf86cd799439020", "profileData": { "email": "john.doe@gmail.com", "email_verified": false, "name": "John Doe", "username": "johndoe", "given_name": "John", "family_name": "Doe", "phone_number": "+15555555555", "phone_verified": false }, "provider": "custom", "isSocial": false } ], "app_metadata": { "plan": "pro" }, "user_metadata": { "hobby": "skydiving" }, "picture": "https://secure.gravatar.com/avatar/15626c5e0c749cb912f9d1ad48dba440?s=480&r=pg&d=https%3A%2F%2Fssl.gstatic.com%2Fs2%2Fprofiles%2Fimages%2Fsilhouette80.png", "name": "John Doe", "nickname": "John Doe", "multifactor": [ "sample" ], "last_ip": "10.0.0.1", "last_login": "2025-02-01T12:34:56Z", "logins_count": 42, "blocked": false, "given_name": "John", "family_name": "Doe" }, "previous_object": { "user_id": "auth0|507f1f77bcf86cd799439020", "email": "john.doe@gmail.com", "email_verified": false, "username": "johndoe", "phone_number": "+15555555555", "phone_verified": false, "created_at": "2025-02-01T12:34:56Z", "updated_at": "2025-02-01T12:34:56Z", "identities": [ { "connection": "Username-Password-Authentication", "user_id": "507f1f77bcf86cd799439020", "profileData": { "email": "john.doe@gmail.com", "email_verified": false, "name": "John Doe", "username": "johndoe", "given_name": "John", "family_name": "Doe", "phone_number": "+15555555555", "phone_verified": false }, "provider": "custom", "isSocial": false } ], "app_metadata": { "plan": "pro" }, "user_metadata": { "hobby": "skydiving" }, "picture": "https://secure.gravatar.com/avatar/15626c5e0c749cb912f9d1ad48dba440?s=480&r=pg&d=https%3A%2F%2Fssl.gstatic.com%2Fs2%2Fprofiles%2Fimages%2Fsilhouette80.png", "name": "John Doe", "nickname": "John Doe", "multifactor": [ "sample" ], "last_ip": "10.0.0.1", "last_login": "2025-02-01T12:34:56Z", "logins_count": 42, "blocked": false, "given_name": "John", "family_name": "Doe" }, "context": { "client": { "id": "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc", "name": "sample", "metadata": {} }, "connection": { "id": "con_kFOHQUeaCSC1Kjqz", "name": "Username-Password-Authentication", "strategy": "sample" }, "request": { "geo": { "continent_code": "sample", "country_code": "sample", "country_name": "sample", "latitude": 3.14, "longitude": 3.14, "subdivision_code": "sample", "subdivision_name": "sample", "city_name": "sample", "time_zone": "sample" }, "hostname": "sample", "custom_domain": "sample", "ip": "sample", "method": "sample", "user_agent": "sample" }, "tenant": { "id": "my-tenant" }, "transaction": { "acr_values": [ "sample" ], "locale": "sample", "login_hint": "sample", "prompt": [ "sample" ], "protocol": "oidc-basic-profile", "redirect_uri": "sample", "requested_scopes": [ "sample" ], "response_mode": "query", "response_type": [ "code" ], "state": "sample", "ui_locales": [ "sample" ] } } }, "a0tenant": "my-tenant", "a0stream": "est_vjFVP5pVdfvsfRKatshkVV" } }, "user.deleted": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "user.deleted", "type": "object", "properties": { "specversion": { "description": "The version of the CloudEvents specification which the event uses.", "type": "string", "enum": [ "1.0" ], "x-auth0-owner": "platform-streaming-foundations" }, "type": { "type": "string", "const": "user.deleted", "description": "The type of the event which has happened." }, "source": { "type": "string", "examples": [ "urn:auth0:example.auth0app.com" ], "description": "The source of the event. This will take the form 'urn:auth0:.'." }, "id": { "description": "A unique identifier for the event.", "type": "string", "examples": [ "evt_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "evt_[a-zA-Z0-9]{22}" }, "time": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "An ISO-8601 timestamp indicating when the event physically occurred." }, "data": { "description": "The event payload.", "type": "object", "properties": { "object": { "description": "The event content.", "type": "object", "properties": { "user_id": { "description": "ID of the user which can be used when interacting with other APIs.", "type": "string", "examples": [ "auth0|507f1f77bcf86cd799439020" ] }, "email": { "description": "Email address of this user.", "type": "string", "examples": [ "john.doe@gmail.com" ], "format": "idn-email" }, "email_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this email address is verified (true) or unverified (false)." }, "username": { "description": "Username of this user.", "type": "string", "examples": [ "johndoe" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$" }, "phone_number": { "description": "Phone number of this user.", "type": "string", "examples": [ "+15555555555" ], "pattern": "^\\+[0-9]{1,15}$" }, "phone_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this phone number has been verified (true) or not (false)." }, "created_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was created (ISO_8601 format)." }, "updated_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was last updated/modified (ISO_8601 format)." }, "identities": { "type": "array", "items": { "oneOf": [ { "type": "object", "properties": { "connection": { "description": "Name of the connection containing this identity.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "user_id": { "anyOf": [ { "type": "string" }, { "type": "integer" } ], "examples": [ "507f1f77bcf86cd799439020", 1234567890 ], "description": "The IDP-specific identifer for the user." }, "profileData": { "description": "Profile data for the user.", "type": "object", "properties": { "email": { "description": "Email address of this user.", "type": "string", "examples": [ "john.doe@gmail.com" ], "format": "idn-email" }, "email_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this email address is verified (true) or unverified (false)." }, "name": { "description": "Name of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "username": { "description": "Username of this user.", "type": "string", "examples": [ "johndoe" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$" }, "given_name": { "description": "Given name/first name/forename of this user.", "type": "string", "examples": [ "John" ], "minLength": 1, "maxLength": 150 }, "family_name": { "description": "Family name/last name/surname of this user.", "type": "string", "examples": [ "Doe" ], "minLength": 1, "maxLength": 150 }, "phone_number": { "description": "Phone number of this user.", "type": "string", "examples": [ "+15555555555" ], "pattern": "^\\+[0-9]{1,15}$" }, "phone_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this phone number has been verified (true) or not (false)." } }, "unevaluatedProperties": {} }, "provider": { "type": "string", "enum": [ "custom" ], "description": "List of custom identity providers.", "x-auth0-owner": "iam-user-management" }, "isSocial": { "type": "boolean", "const": false } }, "required": [ "connection", "user_id", "provider", "isSocial" ], "unevaluatedProperties": { "not": {} }, "description": "The identity object for custom identity providers.", "title": "Custom", "x-auth0-owner": "iam-user-management" }, { "type": "object", "properties": { "connection": { "description": "Name of the connection containing this identity.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "user_id": { "anyOf": [ { "type": "string" }, { "type": "integer" } ], "examples": [ "507f1f77bcf86cd799439020", 1234567890 ], "description": "The IDP-specific identifer for the user." }, "profileData": { "description": "Profile data for the user.", "type": "object", "properties": { "email": { "description": "Email address of this user.", "type": "string", "examples": [ "john.doe@gmail.com" ], "format": "idn-email" }, "email_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this email address is verified (true) or unverified (false)." }, "name": { "description": "Name of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "username": { "description": "Username of this user.", "type": "string", "examples": [ "johndoe" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$" }, "given_name": { "description": "Given name/first name/forename of this user.", "type": "string", "examples": [ "John" ], "minLength": 1, "maxLength": 150 }, "family_name": { "description": "Family name/last name/surname of this user.", "type": "string", "examples": [ "Doe" ], "minLength": 1, "maxLength": 150 }, "phone_number": { "description": "Phone number of this user.", "type": "string", "examples": [ "+15555555555" ], "pattern": "^\\+[0-9]{1,15}$" }, "phone_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this phone number has been verified (true) or not (false)." } }, "unevaluatedProperties": {} }, "provider": { "type": "string", "enum": [ "auth0" ], "description": "List of database identity providers.", "x-auth0-owner": "iam-user-management" }, "isSocial": { "type": "boolean", "const": false } }, "required": [ "connection", "user_id", "provider", "isSocial" ], "unevaluatedProperties": { "not": {} }, "description": "The identity object for database identity providers.", "title": "Database", "x-auth0-owner": "iam-user-management" }, { "type": "object", "properties": { "connection": { "description": "Name of the connection containing this identity.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "user_id": { "anyOf": [ { "type": "string" }, { "type": "integer" } ], "examples": [ "507f1f77bcf86cd799439020", 1234567890 ], "description": "The IDP-specific identifer for the user." }, "profileData": { "description": "Profile data for the user.", "type": "object", "properties": { "email": { "description": "Email address of this user.", "type": "string", "examples": [ "john.doe@gmail.com" ], "format": "idn-email" }, "email_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this email address is verified (true) or unverified (false)." }, "name": { "description": "Name of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "username": { "description": "Username of this user.", "type": "string", "examples": [ "johndoe" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$" }, "given_name": { "description": "Given name/first name/forename of this user.", "type": "string", "examples": [ "John" ], "minLength": 1, "maxLength": 150 }, "family_name": { "description": "Family name/last name/surname of this user.", "type": "string", "examples": [ "Doe" ], "minLength": 1, "maxLength": 150 }, "phone_number": { "description": "Phone number of this user.", "type": "string", "examples": [ "+15555555555" ], "pattern": "^\\+[0-9]{1,15}$" }, "phone_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this phone number has been verified (true) or not (false)." } }, "unevaluatedProperties": {} }, "provider": { "type": "string", "enum": [ "ad", "adfs", "google-apps", "ip", "office365", "oidc", "okta", "pingfederate", "samlp", "sharepoint", "waad" ], "description": "List of enterprise identity providers.", "x-auth0-owner": "iam-user-management" }, "isSocial": { "type": "boolean", "const": false } }, "required": [ "connection", "user_id", "provider", "isSocial" ], "unevaluatedProperties": { "not": {} }, "description": "The identity object for enterprise identity providers.", "title": "Enterprise", "x-auth0-owner": "iam-user-management" }, { "type": "object", "properties": { "connection": { "description": "Name of the connection containing this identity.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "user_id": { "anyOf": [ { "type": "string" }, { "type": "integer" } ], "examples": [ "507f1f77bcf86cd799439020", 1234567890 ], "description": "The IDP-specific identifer for the user." }, "profileData": { "description": "Profile data for the user.", "type": "object", "properties": { "email": { "description": "Email address of this user.", "type": "string", "examples": [ "john.doe@gmail.com" ], "format": "idn-email" }, "email_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this email address is verified (true) or unverified (false)." }, "name": { "description": "Name of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "username": { "description": "Username of this user.", "type": "string", "examples": [ "johndoe" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$" }, "given_name": { "description": "Given name/first name/forename of this user.", "type": "string", "examples": [ "John" ], "minLength": 1, "maxLength": 150 }, "family_name": { "description": "Family name/last name/surname of this user.", "type": "string", "examples": [ "Doe" ], "minLength": 1, "maxLength": 150 }, "phone_number": { "description": "Phone number of this user.", "type": "string", "examples": [ "+15555555555" ], "pattern": "^\\+[0-9]{1,15}$" }, "phone_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this phone number has been verified (true) or not (false)." } }, "unevaluatedProperties": {} }, "provider": { "type": "string", "enum": [ "email", "sms" ], "description": "List of passwordless identity providers.", "x-auth0-owner": "iam-user-management" }, "isSocial": { "type": "boolean", "const": false } }, "required": [ "connection", "user_id", "provider", "isSocial" ], "unevaluatedProperties": { "not": {} }, "description": "The identity object for passwordless identity providers.", "title": "Passwordless", "x-auth0-owner": "iam-user-management" }, { "type": "object", "properties": { "connection": { "description": "Name of the connection containing this identity.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "user_id": { "anyOf": [ { "type": "string" }, { "type": "integer" } ], "examples": [ "507f1f77bcf86cd799439020", 1234567890 ], "description": "The IDP-specific identifer for the user." }, "profileData": { "description": "Profile data for the user.", "type": "object", "properties": { "email": { "description": "Email address of this user.", "type": "string", "examples": [ "john.doe@gmail.com" ], "format": "idn-email" }, "email_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this email address is verified (true) or unverified (false)." }, "name": { "description": "Name of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "username": { "description": "Username of this user.", "type": "string", "examples": [ "johndoe" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$" }, "given_name": { "description": "Given name/first name/forename of this user.", "type": "string", "examples": [ "John" ], "minLength": 1, "maxLength": 150 }, "family_name": { "description": "Family name/last name/surname of this user.", "type": "string", "examples": [ "Doe" ], "minLength": 1, "maxLength": 150 }, "phone_number": { "description": "Phone number of this user.", "type": "string", "examples": [ "+15555555555" ], "pattern": "^\\+[0-9]{1,15}$" }, "phone_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this phone number has been verified (true) or not (false)." } }, "unevaluatedProperties": {} }, "provider": { "type": "string", "enum": [ "amazon", "apple", "dropbox", "bitbucket", "auth0-oidc", "baidu", "bitly", "box", "daccount", "dwolla", "evernote-sandbox", "evernote", "exact", "facebook", "fitbit", "github", "google-oauth2", "instagram", "line", "linkedin", "oauth1", "oauth2", "paypal", "paypal-sandbox", "planningcenter", "salesforce-community", "salesforce-sandbox", "salesforce", "shopify", "soundcloud", "thirtysevensignals", "twitter", "untapped", "vkontakte", "weibo", "windowslive", "wordpress", "yahoo", "yandex" ], "description": "List of social identity providers.", "x-auth0-owner": "iam-user-management" }, "isSocial": { "type": "boolean", "const": true } }, "required": [ "connection", "user_id", "provider", "isSocial" ], "unevaluatedProperties": { "not": {} }, "description": "The identity object for social identity providers.", "title": "Social", "x-auth0-owner": "iam-user-management" } ], "description": "Identity object when accounts are linked.", "title": "Identity", "x-auth0-owner": "iam-user-management" }, "description": "Array of user identity objects when accounts are linked." }, "app_metadata": { "description": "User metadata to which this user has read-only access.", "type": "object", "properties": {}, "unevaluatedProperties": {}, "examples": [ { "plan": "pro" } ], "x-auth0-owner": "iam-user-management" }, "user_metadata": { "description": "User metadata to which this user has read/write access.", "type": "object", "properties": {}, "unevaluatedProperties": {}, "examples": [ { "hobby": "skydiving" } ], "x-auth0-owner": "iam-user-management" }, "picture": { "type": "string", "format": "uri", "examples": [ "https://secure.gravatar.com/avatar/15626c5e0c749cb912f9d1ad48dba440?s=480&r=pg&d=https%3A%2F%2Fssl.gstatic.com%2Fs2%2Fprofiles%2Fimages%2Fsilhouette80.png" ], "description": "URL to picture, photo, or avatar of this user." }, "name": { "description": "Name of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "nickname": { "description": "Preferred nickname or alias of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "multifactor": { "type": "array", "items": { "type": "string" }, "description": "List of multi-factor authentication providers with which this user has enrolled." }, "last_ip": { "description": "Last IP address from which this user logged in.", "type": "string", "examples": [ "10.0.0.1" ] }, "last_login": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Last date and time this user logged in (ISO_8601 format)." }, "logins_count": { "type": "integer", "examples": [ 42 ], "description": "Total number of logins this user has performed." }, "blocked": { "type": "boolean", "examples": [ false ], "description": "Whether this user was blocked by an administrator (true) or is not (false)." }, "given_name": { "description": "Given name/first name/forename of this user.", "type": "string", "examples": [ "John" ], "minLength": 1, "maxLength": 150 }, "family_name": { "description": "Family name/last name/surname of this user.", "type": "string", "examples": [ "Doe" ], "minLength": 1, "maxLength": 150 }, "deleted_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was deleted (ISO_8601 format)." } }, "required": [ "user_id", "created_at", "updated_at", "identities", "deleted_at" ], "unevaluatedProperties": {}, "title": "Auth0 User", "x-release-lifecycle": "EA", "x-auth0-owner": "iam-user-management" }, "previous_object": { "description": "The event content as it was prior to the change described by this event, when applicable.", "type": "object", "properties": { "user_id": { "description": "ID of the user which can be used when interacting with other APIs.", "type": "string", "examples": [ "auth0|507f1f77bcf86cd799439020" ] }, "email": { "description": "Email address of this user.", "type": "string", "examples": [ "john.doe@gmail.com" ], "format": "idn-email" }, "email_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this email address is verified (true) or unverified (false)." }, "username": { "description": "Username of this user.", "type": "string", "examples": [ "johndoe" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$" }, "phone_number": { "description": "Phone number of this user.", "type": "string", "examples": [ "+15555555555" ], "pattern": "^\\+[0-9]{1,15}$" }, "phone_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this phone number has been verified (true) or not (false)." }, "created_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was created (ISO_8601 format)." }, "updated_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was last updated/modified (ISO_8601 format)." }, "identities": { "type": "array", "items": { "oneOf": [ { "type": "object", "properties": { "connection": { "description": "Name of the connection containing this identity.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "user_id": { "anyOf": [ { "type": "string" }, { "type": "integer" } ], "examples": [ "507f1f77bcf86cd799439020", 1234567890 ], "description": "The IDP-specific identifer for the user." }, "profileData": { "description": "Profile data for the user.", "type": "object", "properties": { "email": { "description": "Email address of this user.", "type": "string", "examples": [ "john.doe@gmail.com" ], "format": "idn-email" }, "email_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this email address is verified (true) or unverified (false)." }, "name": { "description": "Name of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "username": { "description": "Username of this user.", "type": "string", "examples": [ "johndoe" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$" }, "given_name": { "description": "Given name/first name/forename of this user.", "type": "string", "examples": [ "John" ], "minLength": 1, "maxLength": 150 }, "family_name": { "description": "Family name/last name/surname of this user.", "type": "string", "examples": [ "Doe" ], "minLength": 1, "maxLength": 150 }, "phone_number": { "description": "Phone number of this user.", "type": "string", "examples": [ "+15555555555" ], "pattern": "^\\+[0-9]{1,15}$" }, "phone_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this phone number has been verified (true) or not (false)." } }, "unevaluatedProperties": {} }, "provider": { "type": "string", "enum": [ "custom" ], "description": "List of custom identity providers.", "x-auth0-owner": "iam-user-management" }, "isSocial": { "type": "boolean", "const": false } }, "required": [ "connection", "user_id", "provider", "isSocial" ], "unevaluatedProperties": { "not": {} }, "description": "The identity object for custom identity providers.", "title": "Custom", "x-auth0-owner": "iam-user-management" }, { "type": "object", "properties": { "connection": { "description": "Name of the connection containing this identity.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "user_id": { "anyOf": [ { "type": "string" }, { "type": "integer" } ], "examples": [ "507f1f77bcf86cd799439020", 1234567890 ], "description": "The IDP-specific identifer for the user." }, "profileData": { "description": "Profile data for the user.", "type": "object", "properties": { "email": { "description": "Email address of this user.", "type": "string", "examples": [ "john.doe@gmail.com" ], "format": "idn-email" }, "email_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this email address is verified (true) or unverified (false)." }, "name": { "description": "Name of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "username": { "description": "Username of this user.", "type": "string", "examples": [ "johndoe" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$" }, "given_name": { "description": "Given name/first name/forename of this user.", "type": "string", "examples": [ "John" ], "minLength": 1, "maxLength": 150 }, "family_name": { "description": "Family name/last name/surname of this user.", "type": "string", "examples": [ "Doe" ], "minLength": 1, "maxLength": 150 }, "phone_number": { "description": "Phone number of this user.", "type": "string", "examples": [ "+15555555555" ], "pattern": "^\\+[0-9]{1,15}$" }, "phone_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this phone number has been verified (true) or not (false)." } }, "unevaluatedProperties": {} }, "provider": { "type": "string", "enum": [ "auth0" ], "description": "List of database identity providers.", "x-auth0-owner": "iam-user-management" }, "isSocial": { "type": "boolean", "const": false } }, "required": [ "connection", "user_id", "provider", "isSocial" ], "unevaluatedProperties": { "not": {} }, "description": "The identity object for database identity providers.", "title": "Database", "x-auth0-owner": "iam-user-management" }, { "type": "object", "properties": { "connection": { "description": "Name of the connection containing this identity.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "user_id": { "anyOf": [ { "type": "string" }, { "type": "integer" } ], "examples": [ "507f1f77bcf86cd799439020", 1234567890 ], "description": "The IDP-specific identifer for the user." }, "profileData": { "description": "Profile data for the user.", "type": "object", "properties": { "email": { "description": "Email address of this user.", "type": "string", "examples": [ "john.doe@gmail.com" ], "format": "idn-email" }, "email_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this email address is verified (true) or unverified (false)." }, "name": { "description": "Name of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "username": { "description": "Username of this user.", "type": "string", "examples": [ "johndoe" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$" }, "given_name": { "description": "Given name/first name/forename of this user.", "type": "string", "examples": [ "John" ], "minLength": 1, "maxLength": 150 }, "family_name": { "description": "Family name/last name/surname of this user.", "type": "string", "examples": [ "Doe" ], "minLength": 1, "maxLength": 150 }, "phone_number": { "description": "Phone number of this user.", "type": "string", "examples": [ "+15555555555" ], "pattern": "^\\+[0-9]{1,15}$" }, "phone_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this phone number has been verified (true) or not (false)." } }, "unevaluatedProperties": {} }, "provider": { "type": "string", "enum": [ "ad", "adfs", "google-apps", "ip", "office365", "oidc", "okta", "pingfederate", "samlp", "sharepoint", "waad" ], "description": "List of enterprise identity providers.", "x-auth0-owner": "iam-user-management" }, "isSocial": { "type": "boolean", "const": false } }, "required": [ "connection", "user_id", "provider", "isSocial" ], "unevaluatedProperties": { "not": {} }, "description": "The identity object for enterprise identity providers.", "title": "Enterprise", "x-auth0-owner": "iam-user-management" }, { "type": "object", "properties": { "connection": { "description": "Name of the connection containing this identity.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "user_id": { "anyOf": [ { "type": "string" }, { "type": "integer" } ], "examples": [ "507f1f77bcf86cd799439020", 1234567890 ], "description": "The IDP-specific identifer for the user." }, "profileData": { "description": "Profile data for the user.", "type": "object", "properties": { "email": { "description": "Email address of this user.", "type": "string", "examples": [ "john.doe@gmail.com" ], "format": "idn-email" }, "email_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this email address is verified (true) or unverified (false)." }, "name": { "description": "Name of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "username": { "description": "Username of this user.", "type": "string", "examples": [ "johndoe" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$" }, "given_name": { "description": "Given name/first name/forename of this user.", "type": "string", "examples": [ "John" ], "minLength": 1, "maxLength": 150 }, "family_name": { "description": "Family name/last name/surname of this user.", "type": "string", "examples": [ "Doe" ], "minLength": 1, "maxLength": 150 }, "phone_number": { "description": "Phone number of this user.", "type": "string", "examples": [ "+15555555555" ], "pattern": "^\\+[0-9]{1,15}$" }, "phone_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this phone number has been verified (true) or not (false)." } }, "unevaluatedProperties": {} }, "provider": { "type": "string", "enum": [ "email", "sms" ], "description": "List of passwordless identity providers.", "x-auth0-owner": "iam-user-management" }, "isSocial": { "type": "boolean", "const": false } }, "required": [ "connection", "user_id", "provider", "isSocial" ], "unevaluatedProperties": { "not": {} }, "description": "The identity object for passwordless identity providers.", "title": "Passwordless", "x-auth0-owner": "iam-user-management" }, { "type": "object", "properties": { "connection": { "description": "Name of the connection containing this identity.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "user_id": { "anyOf": [ { "type": "string" }, { "type": "integer" } ], "examples": [ "507f1f77bcf86cd799439020", 1234567890 ], "description": "The IDP-specific identifer for the user." }, "profileData": { "description": "Profile data for the user.", "type": "object", "properties": { "email": { "description": "Email address of this user.", "type": "string", "examples": [ "john.doe@gmail.com" ], "format": "idn-email" }, "email_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this email address is verified (true) or unverified (false)." }, "name": { "description": "Name of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "username": { "description": "Username of this user.", "type": "string", "examples": [ "johndoe" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$" }, "given_name": { "description": "Given name/first name/forename of this user.", "type": "string", "examples": [ "John" ], "minLength": 1, "maxLength": 150 }, "family_name": { "description": "Family name/last name/surname of this user.", "type": "string", "examples": [ "Doe" ], "minLength": 1, "maxLength": 150 }, "phone_number": { "description": "Phone number of this user.", "type": "string", "examples": [ "+15555555555" ], "pattern": "^\\+[0-9]{1,15}$" }, "phone_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this phone number has been verified (true) or not (false)." } }, "unevaluatedProperties": {} }, "provider": { "type": "string", "enum": [ "amazon", "apple", "dropbox", "bitbucket", "auth0-oidc", "baidu", "bitly", "box", "daccount", "dwolla", "evernote-sandbox", "evernote", "exact", "facebook", "fitbit", "github", "google-oauth2", "instagram", "line", "linkedin", "oauth1", "oauth2", "paypal", "paypal-sandbox", "planningcenter", "salesforce-community", "salesforce-sandbox", "salesforce", "shopify", "soundcloud", "thirtysevensignals", "twitter", "untapped", "vkontakte", "weibo", "windowslive", "wordpress", "yahoo", "yandex" ], "description": "List of social identity providers.", "x-auth0-owner": "iam-user-management" }, "isSocial": { "type": "boolean", "const": true } }, "required": [ "connection", "user_id", "provider", "isSocial" ], "unevaluatedProperties": { "not": {} }, "description": "The identity object for social identity providers.", "title": "Social", "x-auth0-owner": "iam-user-management" } ], "description": "Identity object when accounts are linked.", "title": "Identity", "x-auth0-owner": "iam-user-management" }, "description": "Array of user identity objects when accounts are linked." }, "app_metadata": { "description": "User metadata to which this user has read-only access.", "type": "object", "properties": {}, "unevaluatedProperties": {}, "examples": [ { "plan": "pro" } ], "x-auth0-owner": "iam-user-management" }, "user_metadata": { "description": "User metadata to which this user has read/write access.", "type": "object", "properties": {}, "unevaluatedProperties": {}, "examples": [ { "hobby": "skydiving" } ], "x-auth0-owner": "iam-user-management" }, "picture": { "type": "string", "format": "uri", "examples": [ "https://secure.gravatar.com/avatar/15626c5e0c749cb912f9d1ad48dba440?s=480&r=pg&d=https%3A%2F%2Fssl.gstatic.com%2Fs2%2Fprofiles%2Fimages%2Fsilhouette80.png" ], "description": "URL to picture, photo, or avatar of this user." }, "name": { "description": "Name of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "nickname": { "description": "Preferred nickname or alias of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "multifactor": { "type": "array", "items": { "type": "string" }, "description": "List of multi-factor authentication providers with which this user has enrolled." }, "last_ip": { "description": "Last IP address from which this user logged in.", "type": "string", "examples": [ "10.0.0.1" ] }, "last_login": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Last date and time this user logged in (ISO_8601 format)." }, "logins_count": { "type": "integer", "examples": [ 42 ], "description": "Total number of logins this user has performed." }, "blocked": { "type": "boolean", "examples": [ false ], "description": "Whether this user was blocked by an administrator (true) or is not (false)." }, "given_name": { "description": "Given name/first name/forename of this user.", "type": "string", "examples": [ "John" ], "minLength": 1, "maxLength": 150 }, "family_name": { "description": "Family name/last name/surname of this user.", "type": "string", "examples": [ "Doe" ], "minLength": 1, "maxLength": 150 } }, "required": [ "user_id", "created_at", "updated_at", "identities" ], "unevaluatedProperties": {}, "title": "Auth0 User", "x-release-lifecycle": "EA", "x-auth0-owner": "iam-user-management" }, "context": { "description": "Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.", "type": "object", "properties": { "client": { "type": "object", "properties": { "id": { "description": "The client identifier.", "type": "string", "examples": [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] }, "name": { "type": "string", "description": "The client name." }, "metadata": { "description": "Client metadata.", "type": "object", "properties": {}, "unevaluatedProperties": {} } }, "required": [ "id", "name", "metadata" ], "unevaluatedProperties": { "not": {} }, "description": "The OAuth Client requesting or presenting an access token.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "connection": { "type": "object", "properties": { "id": { "description": "The ID of the connection.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "name": { "description": "The name of the connection.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "strategy": { "type": "string", "description": "The auth strategy implemented by the connection." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "description": "The Auth0 Connection used for the authentication transaction that generated the event.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "request": { "type": "object", "properties": { "geo": { "description": "Geographic information about the request origin.", "type": "object", "properties": { "continent_code": { "type": "string", "description": "Continent code." }, "country_code": { "type": "string", "description": "Country code." }, "country_name": { "type": "string", "description": "Country name." }, "latitude": { "type": "number", "description": "Latitude coordinate." }, "longitude": { "type": "number", "description": "Longitude coordinate." }, "subdivision_code": { "type": "string", "description": "Subdivision (state/province) code." }, "subdivision_name": { "type": "string", "description": "Subdivision (state/province) name." }, "city_name": { "type": "string", "description": "City name." }, "time_zone": { "type": "string", "description": "Time zone." } }, "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "hostname": { "type": "string", "description": "The hostname the request is for." }, "custom_domain": { "type": "string", "description": "The custom domain used in the request (if any)." }, "ip": { "type": "string", "description": "The originating IP address of the request." }, "method": { "type": "string", "description": "The HTTP method used for the request." }, "user_agent": { "type": "string", "description": "The value of the `User-Agent` header." } }, "required": [ "geo", "hostname", "ip", "method", "user_agent" ], "unevaluatedProperties": { "not": {} }, "description": "An HTTP request.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "tenant": { "type": "object", "properties": { "id": { "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]", "description": "User-provided tenant identifier." } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a tenant in event context" }, "transaction": { "type": "object", "properties": { "acr_values": { "type": "array", "items": { "type": "string" }, "description": "acr_values in the request." }, "locale": { "type": "string", "description": "The locale used for this transaction." }, "login_hint": { "type": "string", "description": "Hint about the login identifier the user might use in this transaction." }, "prompt": { "type": "array", "items": { "type": "string" }, "description": "Instructions indicating whether the user may be prompted for re-authentication and consent." }, "protocol": { "description": "The protocol used for this transaction.", "type": "string", "enum": [ "oidc-basic-profile", "oidc-implicit-profile", "oauth2-device-code", "oauth2-resource-owner", "oauth2-resource-owner-jwt-bearer", "oauth2-password", "oauth2-webauthn", "oauth2-access-token", "oauth2-refresh-token", "oauth2-token-exchange", "oidc-hybrid-profile", "samlp", "wsfed", "wstrust-usernamemixed" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "redirect_uri": { "type": "string", "description": "The URL to which the client will be redirected when the transaction completes." }, "requested_scopes": { "type": "array", "items": { "type": "string" }, "description": "The scopes requested." }, "response_mode": { "description": "This transaction's method for returning parameters from the Authorization Endpoint.", "type": "string", "enum": [ "query", "fragment", "form_post", "web_message" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "response_type": { "type": "array", "items": { "type": "string", "enum": [ "code", "token", "id_token" ], "description": "OAuth/OIDC response types.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "description": "The kind of credential issued by this transaction." }, "state": { "type": "string", "description": "The OAuth state parameter for this transaction." }, "ui_locales": { "type": "array", "items": { "type": "string" }, "description": "The ui_locales requested for this transaction." } }, "required": [ "acr_values", "locale", "requested_scopes", "ui_locales" ], "unevaluatedProperties": { "not": {} }, "description": "An auth transaction.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "tenant" ], "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "object" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "platform-streaming-foundations" }, "a0tenant": { "description": "The auth0 tenant ID to which the event is associated.", "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]" }, "a0stream": { "description": "The auth0 event stream ID of the stream the event was delivered on.\nPresent when the event is delivered via an event stream; omitted when\nevents are retrieved via the Events API (GET /api/v2/events).", "type": "string", "examples": [ "est_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "est_[a-zA-Z0-9]{22}" } }, "required": [ "specversion", "type", "source", "id", "time", "data", "a0tenant" ], "unevaluatedProperties": { "not": {} }, "description": "Represents an event that occurs when a user is deleted.", "x-release-lifecycle": "GA", "x-auth0-owner": "iam-user-management", "x-auth0-event-category": "user", "example": { "specversion": "1.0", "type": "user.deleted", "source": "urn:auth0:example.auth0app.com", "id": "evt_vjFVP5pVdfvsfRKatshkVV", "time": "2025-02-01T12:34:56Z", "data": { "object": { "user_id": "auth0|507f1f77bcf86cd799439020", "email": "john.doe@gmail.com", "email_verified": false, "username": "johndoe", "phone_number": "+15555555555", "phone_verified": false, "created_at": "2025-02-01T12:34:56Z", "updated_at": "2025-02-01T12:34:56Z", "identities": [ { "connection": "Username-Password-Authentication", "user_id": "507f1f77bcf86cd799439020", "profileData": { "email": "john.doe@gmail.com", "email_verified": false, "name": "John Doe", "username": "johndoe", "given_name": "John", "family_name": "Doe", "phone_number": "+15555555555", "phone_verified": false }, "provider": "custom", "isSocial": false } ], "app_metadata": { "plan": "pro" }, "user_metadata": { "hobby": "skydiving" }, "picture": "https://secure.gravatar.com/avatar/15626c5e0c749cb912f9d1ad48dba440?s=480&r=pg&d=https%3A%2F%2Fssl.gstatic.com%2Fs2%2Fprofiles%2Fimages%2Fsilhouette80.png", "name": "John Doe", "nickname": "John Doe", "multifactor": [ "sample" ], "last_ip": "10.0.0.1", "last_login": "2025-02-01T12:34:56Z", "logins_count": 42, "blocked": false, "given_name": "John", "family_name": "Doe", "deleted_at": "2025-02-01T12:34:56Z" }, "previous_object": { "user_id": "auth0|507f1f77bcf86cd799439020", "email": "john.doe@gmail.com", "email_verified": false, "username": "johndoe", "phone_number": "+15555555555", "phone_verified": false, "created_at": "2025-02-01T12:34:56Z", "updated_at": "2025-02-01T12:34:56Z", "identities": [ { "connection": "Username-Password-Authentication", "user_id": "507f1f77bcf86cd799439020", "profileData": { "email": "john.doe@gmail.com", "email_verified": false, "name": "John Doe", "username": "johndoe", "given_name": "John", "family_name": "Doe", "phone_number": "+15555555555", "phone_verified": false }, "provider": "custom", "isSocial": false } ], "app_metadata": { "plan": "pro" }, "user_metadata": { "hobby": "skydiving" }, "picture": "https://secure.gravatar.com/avatar/15626c5e0c749cb912f9d1ad48dba440?s=480&r=pg&d=https%3A%2F%2Fssl.gstatic.com%2Fs2%2Fprofiles%2Fimages%2Fsilhouette80.png", "name": "John Doe", "nickname": "John Doe", "multifactor": [ "sample" ], "last_ip": "10.0.0.1", "last_login": "2025-02-01T12:34:56Z", "logins_count": 42, "blocked": false, "given_name": "John", "family_name": "Doe" }, "context": { "client": { "id": "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc", "name": "sample", "metadata": {} }, "connection": { "id": "con_kFOHQUeaCSC1Kjqz", "name": "Username-Password-Authentication", "strategy": "sample" }, "request": { "geo": { "continent_code": "sample", "country_code": "sample", "country_name": "sample", "latitude": 3.14, "longitude": 3.14, "subdivision_code": "sample", "subdivision_name": "sample", "city_name": "sample", "time_zone": "sample" }, "hostname": "sample", "custom_domain": "sample", "ip": "sample", "method": "sample", "user_agent": "sample" }, "tenant": { "id": "my-tenant" }, "transaction": { "acr_values": [ "sample" ], "locale": "sample", "login_hint": "sample", "prompt": [ "sample" ], "protocol": "oidc-basic-profile", "redirect_uri": "sample", "requested_scopes": [ "sample" ], "response_mode": "query", "response_type": [ "code" ], "state": "sample", "ui_locales": [ "sample" ] } } }, "a0tenant": "my-tenant", "a0stream": "est_vjFVP5pVdfvsfRKatshkVV" } }, "user.updated": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "user.updated", "type": "object", "properties": { "specversion": { "description": "The version of the CloudEvents specification which the event uses.", "type": "string", "enum": [ "1.0" ], "x-auth0-owner": "platform-streaming-foundations" }, "type": { "type": "string", "const": "user.updated", "description": "The type of the event which has happened." }, "source": { "type": "string", "examples": [ "urn:auth0:example.auth0app.com" ], "description": "The source of the event. This will take the form 'urn:auth0:.'." }, "id": { "description": "A unique identifier for the event.", "type": "string", "examples": [ "evt_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "evt_[a-zA-Z0-9]{22}" }, "time": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "An ISO-8601 timestamp indicating when the event physically occurred." }, "data": { "description": "The event payload.", "type": "object", "properties": { "object": { "description": "The event content.", "type": "object", "properties": { "user_id": { "description": "ID of the user which can be used when interacting with other APIs.", "type": "string", "examples": [ "auth0|507f1f77bcf86cd799439020" ] }, "email": { "description": "Email address of this user.", "type": "string", "examples": [ "john.doe@gmail.com" ], "format": "idn-email" }, "email_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this email address is verified (true) or unverified (false)." }, "username": { "description": "Username of this user.", "type": "string", "examples": [ "johndoe" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$" }, "phone_number": { "description": "Phone number of this user.", "type": "string", "examples": [ "+15555555555" ], "pattern": "^\\+[0-9]{1,15}$" }, "phone_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this phone number has been verified (true) or not (false)." }, "created_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was created (ISO_8601 format)." }, "updated_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was last updated/modified (ISO_8601 format)." }, "identities": { "type": "array", "items": { "oneOf": [ { "type": "object", "properties": { "connection": { "description": "Name of the connection containing this identity.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "user_id": { "anyOf": [ { "type": "string" }, { "type": "integer" } ], "examples": [ "507f1f77bcf86cd799439020", 1234567890 ], "description": "The IDP-specific identifer for the user." }, "profileData": { "description": "Profile data for the user.", "type": "object", "properties": { "email": { "description": "Email address of this user.", "type": "string", "examples": [ "john.doe@gmail.com" ], "format": "idn-email" }, "email_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this email address is verified (true) or unverified (false)." }, "name": { "description": "Name of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "username": { "description": "Username of this user.", "type": "string", "examples": [ "johndoe" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$" }, "given_name": { "description": "Given name/first name/forename of this user.", "type": "string", "examples": [ "John" ], "minLength": 1, "maxLength": 150 }, "family_name": { "description": "Family name/last name/surname of this user.", "type": "string", "examples": [ "Doe" ], "minLength": 1, "maxLength": 150 }, "phone_number": { "description": "Phone number of this user.", "type": "string", "examples": [ "+15555555555" ], "pattern": "^\\+[0-9]{1,15}$" }, "phone_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this phone number has been verified (true) or not (false)." } }, "unevaluatedProperties": {} }, "provider": { "type": "string", "enum": [ "custom" ], "description": "List of custom identity providers.", "x-auth0-owner": "iam-user-management" }, "isSocial": { "type": "boolean", "const": false } }, "required": [ "connection", "user_id", "provider", "isSocial" ], "unevaluatedProperties": { "not": {} }, "description": "The identity object for custom identity providers.", "title": "Custom", "x-auth0-owner": "iam-user-management" }, { "type": "object", "properties": { "connection": { "description": "Name of the connection containing this identity.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "user_id": { "anyOf": [ { "type": "string" }, { "type": "integer" } ], "examples": [ "507f1f77bcf86cd799439020", 1234567890 ], "description": "The IDP-specific identifer for the user." }, "profileData": { "description": "Profile data for the user.", "type": "object", "properties": { "email": { "description": "Email address of this user.", "type": "string", "examples": [ "john.doe@gmail.com" ], "format": "idn-email" }, "email_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this email address is verified (true) or unverified (false)." }, "name": { "description": "Name of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "username": { "description": "Username of this user.", "type": "string", "examples": [ "johndoe" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$" }, "given_name": { "description": "Given name/first name/forename of this user.", "type": "string", "examples": [ "John" ], "minLength": 1, "maxLength": 150 }, "family_name": { "description": "Family name/last name/surname of this user.", "type": "string", "examples": [ "Doe" ], "minLength": 1, "maxLength": 150 }, "phone_number": { "description": "Phone number of this user.", "type": "string", "examples": [ "+15555555555" ], "pattern": "^\\+[0-9]{1,15}$" }, "phone_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this phone number has been verified (true) or not (false)." } }, "unevaluatedProperties": {} }, "provider": { "type": "string", "enum": [ "auth0" ], "description": "List of database identity providers.", "x-auth0-owner": "iam-user-management" }, "isSocial": { "type": "boolean", "const": false } }, "required": [ "connection", "user_id", "provider", "isSocial" ], "unevaluatedProperties": { "not": {} }, "description": "The identity object for database identity providers.", "title": "Database", "x-auth0-owner": "iam-user-management" }, { "type": "object", "properties": { "connection": { "description": "Name of the connection containing this identity.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "user_id": { "anyOf": [ { "type": "string" }, { "type": "integer" } ], "examples": [ "507f1f77bcf86cd799439020", 1234567890 ], "description": "The IDP-specific identifer for the user." }, "profileData": { "description": "Profile data for the user.", "type": "object", "properties": { "email": { "description": "Email address of this user.", "type": "string", "examples": [ "john.doe@gmail.com" ], "format": "idn-email" }, "email_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this email address is verified (true) or unverified (false)." }, "name": { "description": "Name of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "username": { "description": "Username of this user.", "type": "string", "examples": [ "johndoe" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$" }, "given_name": { "description": "Given name/first name/forename of this user.", "type": "string", "examples": [ "John" ], "minLength": 1, "maxLength": 150 }, "family_name": { "description": "Family name/last name/surname of this user.", "type": "string", "examples": [ "Doe" ], "minLength": 1, "maxLength": 150 }, "phone_number": { "description": "Phone number of this user.", "type": "string", "examples": [ "+15555555555" ], "pattern": "^\\+[0-9]{1,15}$" }, "phone_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this phone number has been verified (true) or not (false)." } }, "unevaluatedProperties": {} }, "provider": { "type": "string", "enum": [ "ad", "adfs", "google-apps", "ip", "office365", "oidc", "okta", "pingfederate", "samlp", "sharepoint", "waad" ], "description": "List of enterprise identity providers.", "x-auth0-owner": "iam-user-management" }, "isSocial": { "type": "boolean", "const": false } }, "required": [ "connection", "user_id", "provider", "isSocial" ], "unevaluatedProperties": { "not": {} }, "description": "The identity object for enterprise identity providers.", "title": "Enterprise", "x-auth0-owner": "iam-user-management" }, { "type": "object", "properties": { "connection": { "description": "Name of the connection containing this identity.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "user_id": { "anyOf": [ { "type": "string" }, { "type": "integer" } ], "examples": [ "507f1f77bcf86cd799439020", 1234567890 ], "description": "The IDP-specific identifer for the user." }, "profileData": { "description": "Profile data for the user.", "type": "object", "properties": { "email": { "description": "Email address of this user.", "type": "string", "examples": [ "john.doe@gmail.com" ], "format": "idn-email" }, "email_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this email address is verified (true) or unverified (false)." }, "name": { "description": "Name of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "username": { "description": "Username of this user.", "type": "string", "examples": [ "johndoe" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$" }, "given_name": { "description": "Given name/first name/forename of this user.", "type": "string", "examples": [ "John" ], "minLength": 1, "maxLength": 150 }, "family_name": { "description": "Family name/last name/surname of this user.", "type": "string", "examples": [ "Doe" ], "minLength": 1, "maxLength": 150 }, "phone_number": { "description": "Phone number of this user.", "type": "string", "examples": [ "+15555555555" ], "pattern": "^\\+[0-9]{1,15}$" }, "phone_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this phone number has been verified (true) or not (false)." } }, "unevaluatedProperties": {} }, "provider": { "type": "string", "enum": [ "email", "sms" ], "description": "List of passwordless identity providers.", "x-auth0-owner": "iam-user-management" }, "isSocial": { "type": "boolean", "const": false } }, "required": [ "connection", "user_id", "provider", "isSocial" ], "unevaluatedProperties": { "not": {} }, "description": "The identity object for passwordless identity providers.", "title": "Passwordless", "x-auth0-owner": "iam-user-management" }, { "type": "object", "properties": { "connection": { "description": "Name of the connection containing this identity.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "user_id": { "anyOf": [ { "type": "string" }, { "type": "integer" } ], "examples": [ "507f1f77bcf86cd799439020", 1234567890 ], "description": "The IDP-specific identifer for the user." }, "profileData": { "description": "Profile data for the user.", "type": "object", "properties": { "email": { "description": "Email address of this user.", "type": "string", "examples": [ "john.doe@gmail.com" ], "format": "idn-email" }, "email_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this email address is verified (true) or unverified (false)." }, "name": { "description": "Name of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "username": { "description": "Username of this user.", "type": "string", "examples": [ "johndoe" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$" }, "given_name": { "description": "Given name/first name/forename of this user.", "type": "string", "examples": [ "John" ], "minLength": 1, "maxLength": 150 }, "family_name": { "description": "Family name/last name/surname of this user.", "type": "string", "examples": [ "Doe" ], "minLength": 1, "maxLength": 150 }, "phone_number": { "description": "Phone number of this user.", "type": "string", "examples": [ "+15555555555" ], "pattern": "^\\+[0-9]{1,15}$" }, "phone_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this phone number has been verified (true) or not (false)." } }, "unevaluatedProperties": {} }, "provider": { "type": "string", "enum": [ "amazon", "apple", "dropbox", "bitbucket", "auth0-oidc", "baidu", "bitly", "box", "daccount", "dwolla", "evernote-sandbox", "evernote", "exact", "facebook", "fitbit", "github", "google-oauth2", "instagram", "line", "linkedin", "oauth1", "oauth2", "paypal", "paypal-sandbox", "planningcenter", "salesforce-community", "salesforce-sandbox", "salesforce", "shopify", "soundcloud", "thirtysevensignals", "twitter", "untapped", "vkontakte", "weibo", "windowslive", "wordpress", "yahoo", "yandex" ], "description": "List of social identity providers.", "x-auth0-owner": "iam-user-management" }, "isSocial": { "type": "boolean", "const": true } }, "required": [ "connection", "user_id", "provider", "isSocial" ], "unevaluatedProperties": { "not": {} }, "description": "The identity object for social identity providers.", "title": "Social", "x-auth0-owner": "iam-user-management" } ], "description": "Identity object when accounts are linked.", "title": "Identity", "x-auth0-owner": "iam-user-management" }, "description": "Array of user identity objects when accounts are linked." }, "app_metadata": { "description": "User metadata to which this user has read-only access.", "type": "object", "properties": {}, "unevaluatedProperties": {}, "examples": [ { "plan": "pro" } ], "x-auth0-owner": "iam-user-management" }, "user_metadata": { "description": "User metadata to which this user has read/write access.", "type": "object", "properties": {}, "unevaluatedProperties": {}, "examples": [ { "hobby": "skydiving" } ], "x-auth0-owner": "iam-user-management" }, "picture": { "type": "string", "format": "uri", "examples": [ "https://secure.gravatar.com/avatar/15626c5e0c749cb912f9d1ad48dba440?s=480&r=pg&d=https%3A%2F%2Fssl.gstatic.com%2Fs2%2Fprofiles%2Fimages%2Fsilhouette80.png" ], "description": "URL to picture, photo, or avatar of this user." }, "name": { "description": "Name of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "nickname": { "description": "Preferred nickname or alias of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "multifactor": { "type": "array", "items": { "type": "string" }, "description": "List of multi-factor authentication providers with which this user has enrolled." }, "last_ip": { "description": "Last IP address from which this user logged in.", "type": "string", "examples": [ "10.0.0.1" ] }, "last_login": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Last date and time this user logged in (ISO_8601 format)." }, "logins_count": { "type": "integer", "examples": [ 42 ], "description": "Total number of logins this user has performed." }, "blocked": { "type": "boolean", "examples": [ false ], "description": "Whether this user was blocked by an administrator (true) or is not (false)." }, "given_name": { "description": "Given name/first name/forename of this user.", "type": "string", "examples": [ "John" ], "minLength": 1, "maxLength": 150 }, "family_name": { "description": "Family name/last name/surname of this user.", "type": "string", "examples": [ "Doe" ], "minLength": 1, "maxLength": 150 } }, "required": [ "user_id", "created_at", "updated_at", "identities" ], "unevaluatedProperties": {}, "title": "Auth0 User", "x-release-lifecycle": "EA", "x-auth0-owner": "iam-user-management" }, "previous_object": { "description": "The event content as it was prior to the change described by this event, when applicable.", "type": "object", "properties": { "user_id": { "description": "ID of the user which can be used when interacting with other APIs.", "type": "string", "examples": [ "auth0|507f1f77bcf86cd799439020" ] }, "email": { "description": "Email address of this user.", "type": "string", "examples": [ "john.doe@gmail.com" ], "format": "idn-email" }, "email_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this email address is verified (true) or unverified (false)." }, "username": { "description": "Username of this user.", "type": "string", "examples": [ "johndoe" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$" }, "phone_number": { "description": "Phone number of this user.", "type": "string", "examples": [ "+15555555555" ], "pattern": "^\\+[0-9]{1,15}$" }, "phone_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this phone number has been verified (true) or not (false)." }, "created_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was created (ISO_8601 format)." }, "updated_at": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Date and time when this entity was last updated/modified (ISO_8601 format)." }, "identities": { "type": "array", "items": { "oneOf": [ { "type": "object", "properties": { "connection": { "description": "Name of the connection containing this identity.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "user_id": { "anyOf": [ { "type": "string" }, { "type": "integer" } ], "examples": [ "507f1f77bcf86cd799439020", 1234567890 ], "description": "The IDP-specific identifer for the user." }, "profileData": { "description": "Profile data for the user.", "type": "object", "properties": { "email": { "description": "Email address of this user.", "type": "string", "examples": [ "john.doe@gmail.com" ], "format": "idn-email" }, "email_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this email address is verified (true) or unverified (false)." }, "name": { "description": "Name of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "username": { "description": "Username of this user.", "type": "string", "examples": [ "johndoe" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$" }, "given_name": { "description": "Given name/first name/forename of this user.", "type": "string", "examples": [ "John" ], "minLength": 1, "maxLength": 150 }, "family_name": { "description": "Family name/last name/surname of this user.", "type": "string", "examples": [ "Doe" ], "minLength": 1, "maxLength": 150 }, "phone_number": { "description": "Phone number of this user.", "type": "string", "examples": [ "+15555555555" ], "pattern": "^\\+[0-9]{1,15}$" }, "phone_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this phone number has been verified (true) or not (false)." } }, "unevaluatedProperties": {} }, "provider": { "type": "string", "enum": [ "custom" ], "description": "List of custom identity providers.", "x-auth0-owner": "iam-user-management" }, "isSocial": { "type": "boolean", "const": false } }, "required": [ "connection", "user_id", "provider", "isSocial" ], "unevaluatedProperties": { "not": {} }, "description": "The identity object for custom identity providers.", "title": "Custom", "x-auth0-owner": "iam-user-management" }, { "type": "object", "properties": { "connection": { "description": "Name of the connection containing this identity.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "user_id": { "anyOf": [ { "type": "string" }, { "type": "integer" } ], "examples": [ "507f1f77bcf86cd799439020", 1234567890 ], "description": "The IDP-specific identifer for the user." }, "profileData": { "description": "Profile data for the user.", "type": "object", "properties": { "email": { "description": "Email address of this user.", "type": "string", "examples": [ "john.doe@gmail.com" ], "format": "idn-email" }, "email_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this email address is verified (true) or unverified (false)." }, "name": { "description": "Name of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "username": { "description": "Username of this user.", "type": "string", "examples": [ "johndoe" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$" }, "given_name": { "description": "Given name/first name/forename of this user.", "type": "string", "examples": [ "John" ], "minLength": 1, "maxLength": 150 }, "family_name": { "description": "Family name/last name/surname of this user.", "type": "string", "examples": [ "Doe" ], "minLength": 1, "maxLength": 150 }, "phone_number": { "description": "Phone number of this user.", "type": "string", "examples": [ "+15555555555" ], "pattern": "^\\+[0-9]{1,15}$" }, "phone_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this phone number has been verified (true) or not (false)." } }, "unevaluatedProperties": {} }, "provider": { "type": "string", "enum": [ "auth0" ], "description": "List of database identity providers.", "x-auth0-owner": "iam-user-management" }, "isSocial": { "type": "boolean", "const": false } }, "required": [ "connection", "user_id", "provider", "isSocial" ], "unevaluatedProperties": { "not": {} }, "description": "The identity object for database identity providers.", "title": "Database", "x-auth0-owner": "iam-user-management" }, { "type": "object", "properties": { "connection": { "description": "Name of the connection containing this identity.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "user_id": { "anyOf": [ { "type": "string" }, { "type": "integer" } ], "examples": [ "507f1f77bcf86cd799439020", 1234567890 ], "description": "The IDP-specific identifer for the user." }, "profileData": { "description": "Profile data for the user.", "type": "object", "properties": { "email": { "description": "Email address of this user.", "type": "string", "examples": [ "john.doe@gmail.com" ], "format": "idn-email" }, "email_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this email address is verified (true) or unverified (false)." }, "name": { "description": "Name of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "username": { "description": "Username of this user.", "type": "string", "examples": [ "johndoe" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$" }, "given_name": { "description": "Given name/first name/forename of this user.", "type": "string", "examples": [ "John" ], "minLength": 1, "maxLength": 150 }, "family_name": { "description": "Family name/last name/surname of this user.", "type": "string", "examples": [ "Doe" ], "minLength": 1, "maxLength": 150 }, "phone_number": { "description": "Phone number of this user.", "type": "string", "examples": [ "+15555555555" ], "pattern": "^\\+[0-9]{1,15}$" }, "phone_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this phone number has been verified (true) or not (false)." } }, "unevaluatedProperties": {} }, "provider": { "type": "string", "enum": [ "ad", "adfs", "google-apps", "ip", "office365", "oidc", "okta", "pingfederate", "samlp", "sharepoint", "waad" ], "description": "List of enterprise identity providers.", "x-auth0-owner": "iam-user-management" }, "isSocial": { "type": "boolean", "const": false } }, "required": [ "connection", "user_id", "provider", "isSocial" ], "unevaluatedProperties": { "not": {} }, "description": "The identity object for enterprise identity providers.", "title": "Enterprise", "x-auth0-owner": "iam-user-management" }, { "type": "object", "properties": { "connection": { "description": "Name of the connection containing this identity.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "user_id": { "anyOf": [ { "type": "string" }, { "type": "integer" } ], "examples": [ "507f1f77bcf86cd799439020", 1234567890 ], "description": "The IDP-specific identifer for the user." }, "profileData": { "description": "Profile data for the user.", "type": "object", "properties": { "email": { "description": "Email address of this user.", "type": "string", "examples": [ "john.doe@gmail.com" ], "format": "idn-email" }, "email_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this email address is verified (true) or unverified (false)." }, "name": { "description": "Name of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "username": { "description": "Username of this user.", "type": "string", "examples": [ "johndoe" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$" }, "given_name": { "description": "Given name/first name/forename of this user.", "type": "string", "examples": [ "John" ], "minLength": 1, "maxLength": 150 }, "family_name": { "description": "Family name/last name/surname of this user.", "type": "string", "examples": [ "Doe" ], "minLength": 1, "maxLength": 150 }, "phone_number": { "description": "Phone number of this user.", "type": "string", "examples": [ "+15555555555" ], "pattern": "^\\+[0-9]{1,15}$" }, "phone_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this phone number has been verified (true) or not (false)." } }, "unevaluatedProperties": {} }, "provider": { "type": "string", "enum": [ "email", "sms" ], "description": "List of passwordless identity providers.", "x-auth0-owner": "iam-user-management" }, "isSocial": { "type": "boolean", "const": false } }, "required": [ "connection", "user_id", "provider", "isSocial" ], "unevaluatedProperties": { "not": {} }, "description": "The identity object for passwordless identity providers.", "title": "Passwordless", "x-auth0-owner": "iam-user-management" }, { "type": "object", "properties": { "connection": { "description": "Name of the connection containing this identity.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "user_id": { "anyOf": [ { "type": "string" }, { "type": "integer" } ], "examples": [ "507f1f77bcf86cd799439020", 1234567890 ], "description": "The IDP-specific identifer for the user." }, "profileData": { "description": "Profile data for the user.", "type": "object", "properties": { "email": { "description": "Email address of this user.", "type": "string", "examples": [ "john.doe@gmail.com" ], "format": "idn-email" }, "email_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this email address is verified (true) or unverified (false)." }, "name": { "description": "Name of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "username": { "description": "Username of this user.", "type": "string", "examples": [ "johndoe" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$" }, "given_name": { "description": "Given name/first name/forename of this user.", "type": "string", "examples": [ "John" ], "minLength": 1, "maxLength": 150 }, "family_name": { "description": "Family name/last name/surname of this user.", "type": "string", "examples": [ "Doe" ], "minLength": 1, "maxLength": 150 }, "phone_number": { "description": "Phone number of this user.", "type": "string", "examples": [ "+15555555555" ], "pattern": "^\\+[0-9]{1,15}$" }, "phone_verified": { "type": "boolean", "examples": [ false ], "description": "Whether this phone number has been verified (true) or not (false)." } }, "unevaluatedProperties": {} }, "provider": { "type": "string", "enum": [ "amazon", "apple", "dropbox", "bitbucket", "auth0-oidc", "baidu", "bitly", "box", "daccount", "dwolla", "evernote-sandbox", "evernote", "exact", "facebook", "fitbit", "github", "google-oauth2", "instagram", "line", "linkedin", "oauth1", "oauth2", "paypal", "paypal-sandbox", "planningcenter", "salesforce-community", "salesforce-sandbox", "salesforce", "shopify", "soundcloud", "thirtysevensignals", "twitter", "untapped", "vkontakte", "weibo", "windowslive", "wordpress", "yahoo", "yandex" ], "description": "List of social identity providers.", "x-auth0-owner": "iam-user-management" }, "isSocial": { "type": "boolean", "const": true } }, "required": [ "connection", "user_id", "provider", "isSocial" ], "unevaluatedProperties": { "not": {} }, "description": "The identity object for social identity providers.", "title": "Social", "x-auth0-owner": "iam-user-management" } ], "description": "Identity object when accounts are linked.", "title": "Identity", "x-auth0-owner": "iam-user-management" }, "description": "Array of user identity objects when accounts are linked." }, "app_metadata": { "description": "User metadata to which this user has read-only access.", "type": "object", "properties": {}, "unevaluatedProperties": {}, "examples": [ { "plan": "pro" } ], "x-auth0-owner": "iam-user-management" }, "user_metadata": { "description": "User metadata to which this user has read/write access.", "type": "object", "properties": {}, "unevaluatedProperties": {}, "examples": [ { "hobby": "skydiving" } ], "x-auth0-owner": "iam-user-management" }, "picture": { "type": "string", "format": "uri", "examples": [ "https://secure.gravatar.com/avatar/15626c5e0c749cb912f9d1ad48dba440?s=480&r=pg&d=https%3A%2F%2Fssl.gstatic.com%2Fs2%2Fprofiles%2Fimages%2Fsilhouette80.png" ], "description": "URL to picture, photo, or avatar of this user." }, "name": { "description": "Name of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "nickname": { "description": "Preferred nickname or alias of this user.", "type": "string", "examples": [ "John Doe" ], "minLength": 1, "maxLength": 300 }, "multifactor": { "type": "array", "items": { "type": "string" }, "description": "List of multi-factor authentication providers with which this user has enrolled." }, "last_ip": { "description": "Last IP address from which this user logged in.", "type": "string", "examples": [ "10.0.0.1" ] }, "last_login": { "type": "string", "format": "date-time", "examples": [ "2025-02-01T12:34:56Z" ], "description": "Last date and time this user logged in (ISO_8601 format)." }, "logins_count": { "type": "integer", "examples": [ 42 ], "description": "Total number of logins this user has performed." }, "blocked": { "type": "boolean", "examples": [ false ], "description": "Whether this user was blocked by an administrator (true) or is not (false)." }, "given_name": { "description": "Given name/first name/forename of this user.", "type": "string", "examples": [ "John" ], "minLength": 1, "maxLength": 150 }, "family_name": { "description": "Family name/last name/surname of this user.", "type": "string", "examples": [ "Doe" ], "minLength": 1, "maxLength": 150 } }, "required": [ "user_id", "created_at", "updated_at", "identities" ], "unevaluatedProperties": {}, "title": "Auth0 User", "x-release-lifecycle": "EA", "x-auth0-owner": "iam-user-management" }, "context": { "description": "Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.", "type": "object", "properties": { "client": { "type": "object", "properties": { "id": { "description": "The client identifier.", "type": "string", "examples": [ "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc" ] }, "name": { "type": "string", "description": "The client name." }, "metadata": { "description": "Client metadata.", "type": "object", "properties": {}, "unevaluatedProperties": {} } }, "required": [ "id", "name", "metadata" ], "unevaluatedProperties": { "not": {} }, "description": "The OAuth Client requesting or presenting an access token.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "connection": { "type": "object", "properties": { "id": { "description": "The ID of the connection.", "type": "string", "examples": [ "con_kFOHQUeaCSC1Kjqz" ], "pattern": "con_[a-zA-Z0-9]{16}" }, "name": { "description": "The name of the connection.", "type": "string", "examples": [ "Username-Password-Authentication" ], "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$" }, "strategy": { "type": "string", "description": "The auth strategy implemented by the connection." } }, "required": [ "id", "name", "strategy" ], "unevaluatedProperties": { "not": {} }, "description": "The Auth0 Connection used for the authentication transaction that generated the event.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "request": { "type": "object", "properties": { "geo": { "description": "Geographic information about the request origin.", "type": "object", "properties": { "continent_code": { "type": "string", "description": "Continent code." }, "country_code": { "type": "string", "description": "Country code." }, "country_name": { "type": "string", "description": "Country name." }, "latitude": { "type": "number", "description": "Latitude coordinate." }, "longitude": { "type": "number", "description": "Longitude coordinate." }, "subdivision_code": { "type": "string", "description": "Subdivision (state/province) code." }, "subdivision_name": { "type": "string", "description": "Subdivision (state/province) name." }, "city_name": { "type": "string", "description": "City name." }, "time_zone": { "type": "string", "description": "Time zone." } }, "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "hostname": { "type": "string", "description": "The hostname the request is for." }, "custom_domain": { "type": "string", "description": "The custom domain used in the request (if any)." }, "ip": { "type": "string", "description": "The originating IP address of the request." }, "method": { "type": "string", "description": "The HTTP method used for the request." }, "user_agent": { "type": "string", "description": "The value of the `User-Agent` header." } }, "required": [ "geo", "hostname", "ip", "method", "user_agent" ], "unevaluatedProperties": { "not": {} }, "description": "An HTTP request.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "tenant": { "type": "object", "properties": { "id": { "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]", "description": "User-provided tenant identifier." } }, "required": [ "id" ], "unevaluatedProperties": { "not": {} }, "description": "Reference to a tenant in event context" }, "transaction": { "type": "object", "properties": { "acr_values": { "type": "array", "items": { "type": "string" }, "description": "acr_values in the request." }, "locale": { "type": "string", "description": "The locale used for this transaction." }, "login_hint": { "type": "string", "description": "Hint about the login identifier the user might use in this transaction." }, "prompt": { "type": "array", "items": { "type": "string" }, "description": "Instructions indicating whether the user may be prompted for re-authentication and consent." }, "protocol": { "description": "The protocol used for this transaction.", "type": "string", "enum": [ "oidc-basic-profile", "oidc-implicit-profile", "oauth2-device-code", "oauth2-resource-owner", "oauth2-resource-owner-jwt-bearer", "oauth2-password", "oauth2-webauthn", "oauth2-access-token", "oauth2-refresh-token", "oauth2-token-exchange", "oidc-hybrid-profile", "samlp", "wsfed", "wstrust-usernamemixed" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "redirect_uri": { "type": "string", "description": "The URL to which the client will be redirected when the transaction completes." }, "requested_scopes": { "type": "array", "items": { "type": "string" }, "description": "The scopes requested." }, "response_mode": { "description": "This transaction's method for returning parameters from the Authorization Endpoint.", "type": "string", "enum": [ "query", "fragment", "form_post", "web_message" ], "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "response_type": { "type": "array", "items": { "type": "string", "enum": [ "code", "token", "id_token" ], "description": "OAuth/OIDC response types.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" }, "description": "The kind of credential issued by this transaction." }, "state": { "type": "string", "description": "The OAuth state parameter for this transaction." }, "ui_locales": { "type": "array", "items": { "type": "string" }, "description": "The ui_locales requested for this transaction." } }, "required": [ "acr_values", "locale", "requested_scopes", "ui_locales" ], "unevaluatedProperties": { "not": {} }, "description": "An auth transaction.", "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "tenant" ], "unevaluatedProperties": { "not": {} }, "x-release-lifecycle": "EA", "x-auth0-owner": "platform-streaming-foundations" } }, "required": [ "object" ], "unevaluatedProperties": { "not": {} }, "x-auth0-owner": "platform-streaming-foundations" }, "a0tenant": { "description": "The auth0 tenant ID to which the event is associated.", "type": "string", "examples": [ "my-tenant" ], "minLength": 3, "maxLength": 63, "pattern": "[a-z0-9][-a-z0-9]{1,62}[a-z0-9]" }, "a0stream": { "description": "The auth0 event stream ID of the stream the event was delivered on.\nPresent when the event is delivered via an event stream; omitted when\nevents are retrieved via the Events API (GET /api/v2/events).", "type": "string", "examples": [ "est_vjFVP5pVdfvsfRKatshkVV" ], "pattern": "est_[a-zA-Z0-9]{22}" } }, "required": [ "specversion", "type", "source", "id", "time", "data", "a0tenant" ], "unevaluatedProperties": { "not": {} }, "description": "Represents an event that occurs when a user is updated.", "x-release-lifecycle": "GA", "x-auth0-owner": "iam-user-management", "x-auth0-event-category": "user", "example": { "specversion": "1.0", "type": "user.updated", "source": "urn:auth0:example.auth0app.com", "id": "evt_vjFVP5pVdfvsfRKatshkVV", "time": "2025-02-01T12:34:56Z", "data": { "object": { "user_id": "auth0|507f1f77bcf86cd799439020", "email": "john.doe@gmail.com", "email_verified": false, "username": "johndoe", "phone_number": "+15555555555", "phone_verified": false, "created_at": "2025-02-01T12:34:56Z", "updated_at": "2025-02-01T12:34:56Z", "identities": [ { "connection": "Username-Password-Authentication", "user_id": "507f1f77bcf86cd799439020", "profileData": { "email": "john.doe@gmail.com", "email_verified": false, "name": "John Doe", "username": "johndoe", "given_name": "John", "family_name": "Doe", "phone_number": "+15555555555", "phone_verified": false }, "provider": "custom", "isSocial": false } ], "app_metadata": { "plan": "pro" }, "user_metadata": { "hobby": "skydiving" }, "picture": "https://secure.gravatar.com/avatar/15626c5e0c749cb912f9d1ad48dba440?s=480&r=pg&d=https%3A%2F%2Fssl.gstatic.com%2Fs2%2Fprofiles%2Fimages%2Fsilhouette80.png", "name": "John Doe", "nickname": "John Doe", "multifactor": [ "sample" ], "last_ip": "10.0.0.1", "last_login": "2025-02-01T12:34:56Z", "logins_count": 42, "blocked": false, "given_name": "John", "family_name": "Doe" }, "previous_object": { "user_id": "auth0|507f1f77bcf86cd799439020", "email": "john.doe@gmail.com", "email_verified": false, "username": "johndoe", "phone_number": "+15555555555", "phone_verified": false, "created_at": "2025-02-01T12:34:56Z", "updated_at": "2025-02-01T12:34:56Z", "identities": [ { "connection": "Username-Password-Authentication", "user_id": "507f1f77bcf86cd799439020", "profileData": { "email": "john.doe@gmail.com", "email_verified": false, "name": "John Doe", "username": "johndoe", "given_name": "John", "family_name": "Doe", "phone_number": "+15555555555", "phone_verified": false }, "provider": "custom", "isSocial": false } ], "app_metadata": { "plan": "pro" }, "user_metadata": { "hobby": "skydiving" }, "picture": "https://secure.gravatar.com/avatar/15626c5e0c749cb912f9d1ad48dba440?s=480&r=pg&d=https%3A%2F%2Fssl.gstatic.com%2Fs2%2Fprofiles%2Fimages%2Fsilhouette80.png", "name": "John Doe", "nickname": "John Doe", "multifactor": [ "sample" ], "last_ip": "10.0.0.1", "last_login": "2025-02-01T12:34:56Z", "logins_count": 42, "blocked": false, "given_name": "John", "family_name": "Doe" }, "context": { "client": { "id": "QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc", "name": "sample", "metadata": {} }, "connection": { "id": "con_kFOHQUeaCSC1Kjqz", "name": "Username-Password-Authentication", "strategy": "sample" }, "request": { "geo": { "continent_code": "sample", "country_code": "sample", "country_name": "sample", "latitude": 3.14, "longitude": 3.14, "subdivision_code": "sample", "subdivision_name": "sample", "city_name": "sample", "time_zone": "sample" }, "hostname": "sample", "custom_domain": "sample", "ip": "sample", "method": "sample", "user_agent": "sample" }, "tenant": { "id": "my-tenant" }, "transaction": { "acr_values": [ "sample" ], "locale": "sample", "login_hint": "sample", "prompt": [ "sample" ], "protocol": "oidc-basic-profile", "redirect_uri": "sample", "requested_scopes": [ "sample" ], "response_mode": "query", "response_type": [ "code" ], "state": "sample", "ui_locales": [ "sample" ] } } }, "a0tenant": "my-tenant", "a0stream": "est_vjFVP5pVdfvsfRKatshkVV" } } } } }